5 Cybersecurity Questions Every CEO Should Be Asking

The responsibility of becoming cyber resilient no longer rests solely with the IT team. A breach could halt business workflows, damage corporate reputation and relationships, and result in significant financial loss, making it a major enterprise-level risk that should be owned at the top.

That doesn’t mean CEOs and board members need to build the technical expertise of a security professional. Rather, they need to rely on their teams or outside partners to help them better understand cyber risks and invest in security that makes an impact. By working together, CEOs and security teams can make cybersecurity a company-wide priority and build an effective security program. 

A common cybersecurity pitfall for CEOs

According to a Gartner survey, 85% of CEOs say cybersecurity is critical for business growth — that’s a strong start. Though CEOs are becoming increasingly invested in their company’s cybersecurity efforts, many fall into the trap of learning security buzzwords and asking specific questions like, “Are we patched?” or “Is MFA enabled?” But these questions are rarely helpful and often lead to a false sense of security.

Simple yes-or-no questions about specific security protocols leave out important context. Most security professionals will say MFA is enabled across the organization, but MFA is only one step in protecting company data. Without the appropriate identity and access controls, anyone who successfully logs into a system will have access to all company data — whether or not they need it. So, although MFA is effective at stopping credential stuffing or brute-force attacks, it won’t stop a disgruntled employee from stealing data, nor can it fully protect against all malware or social engineering attacks.

Similarly, asking whether or not a specific defense mechanism is “turned on” is only helpful if you know what to do with that information. If a system is patched, what does that mean? What risk still exists? If a system isn’t patched, why not? It’s unlikely that your security team simply forgot to patch a system or enable MFA. There’s likely a roadblock keeping them from adopting best practices — a roadblock you may be able to lift.

Finally, asking specific, buzzword-heavy questions often leads to a box-ticking approach to security. Cybersecurity can only be effective when reviewed holistically and regularly through the lens of business risk. While the CISO and security team need to understand the technical tactics and specific best practices, the CEO is responsible for managing overall business risk, creating budgets and allocating resources for security, prioritizing initiatives, and rallying the company around the importance of following security best practices.

Rather than assuming which cybersecurity tactics will work and assigning them to security teams, CEOs, board members, and company leaders should instead ask these five questions, thereby shifting the conversation from “reassuring the boss” to “translating cyber risk into business terms.”

1. If ransomware hit tomorrow, how quickly would we recover?

CrowdStike’s State of Ransomware Survey found that while half of organizations feel “very prepared” to face ransomware attacks, 78% experienced these types of attacks last year and fewer than 25% achieved recovery within a day. What’s more concerning is that nearly 50% of companies paid the ransom to get their data back, according to a recent Sophos survey.

Government agencies like the FBI strongly discourage paying ransoms, but if companies don’t have backup systems in place or can’t get systems back online in a timely manner, they view the ransom as a cost of doing business.

Businesses need a plan to recover from a ransomware attack and get systems back online quickly, should one occur. Not only can asking about recovery timelines be eye opening for CEOs, but these conversations also help the team determine which tools and processes to invest in to create effective prevention and remediation plans.

If a remediation and recovery plan does exist, when was the last time it was tested? Did the team map out a plan on paper, or did they run tabletop exercises? The latter is key to becoming cyber resilient.

2. What keeps our security team awake at night?

A quick query to any LLM will result in a laundry list of security tools and activities every company should invest in, but those suggestions are probably already on your team’s radar. Rather than guessing at what your security team needs, let them identify the biggest threats or gaps in your posture and propose possible solutions.

Gaps in security posture are almost always due to a lack of resources or buy-in from leaders or employees. This is where CEOs and company leaders can have the biggest impact on security. Asking this question forces your team to prioritize top security gaps and associated risks, so you can determine where you need to reallocate dollars or enforce policies that will close any existing security holes.  

3. Which business processes are most vulnerable?

Unfortunately, there is no one-size-fits-all security program. True resiliency is a result of several processes, tools, and risk management policies that work together to protect your data and systems. It requires insights into all business processes, vendors, tools, and devices to ensure each is adequately protected against an attack.

Asking about vulnerable processes invites the team to analyze each process from beginning to end to identify gaps. CEOs can then take their analysis and compare the most valuable and most vulnerable systems to ensure they’re investing in the right place. 

With the help of leadership, thinking through this question may also help uncover instances of shadow IT and shadow AI. IT and security teams can’t protect systems they don’t know exist, and senior leadership may be able to highlight systems IT is missing. 

4. How secure are third-party vendors?

All too often, breaches start with a vulnerability exploited in a vendor’s system. Every business partner connected to your supply chain is an entry point to your environment. If your company doesn’t have security requirements in place for vendors, you may be more vulnerable than you think.

While IT teams are analyzing the security programs of vendors, CEOs should be assessing how necessary their services are to the business. That way, vendors with weak security postures that provide minimal value to the business can be cut or replaced as quickly as possible.

5. What risks aren’t currently funded?

Security departments are generally underfunded, and it can be a challenge for CEOs to know how to best allocate budget. All of the above questions will likely highlight gaps in your security posture, but this question may be the most important in terms of determining what your next steps should be. Security, IT, business, and leadership teams will likely need to weigh in on prioritization of unfunded or underfunded risks, but this list from security and IT should serve as the starting point.

How CEOs can advance their security program

The CEO and leadership don’t need to master the technical elements of cybersecurity in order to play instrumental roles in keeping the organization secure. While security teams know which tools and activities will best secure their organization, they rely on leaders for the budget and bandwidth to actually do the work. Similarly, security experts can write policies all day, but if leaders aren’t actively publicizing and enforcing those policies, employees will likely ignore them and opt for more efficient ways of working.

The best way for CEOs to protect their organizations is to have gaps in security posture translated into business risk. This empowers them to compare business risks against the cost of measures to provide security, while also giving IT teams the resources they need to get the job done without sacrificing the efficiency needed to keep the business running. 

Organizations with robust security teams and budgets can tackle these big conversations and issues in-house, but many others lack the resources and expertise to quickly and cost-effectively close the gaps in their security posture. These CEOs and leaders need to turn to an outsourced security partner.

The SolCyber solution for CEOs

SolCyber is a fully managed, human-led MDR that can help CEOs, boards, and CISOs manage security risks and ensure gaps in security posture are closed, eliminating cyber-related business risk.

Our team resolves more than 95% of incidents without ever involving your team, at a third of the cost of building an in-house SOC. We also partner with leading insurers to ensure you get a discount on cyber insurance. This is possible because they know, with us, you’re protected.

If your conversation with your security leaders reveals you have more security risk than you can take on in-house, contact the experts at SolCyber today.

Photo by Tony Hand on Unsplash