Cyber resilience fuels AI growth, but CISOs see key gaps

Introduction

Cyber resilience has become a powerful tool for growth. It helps businesses to scale up AI securely
and take products and services to market faster. Businesses appear to understand this. In LevelBlue’s
latest cybersecurity research, 52% of senior executives say they are less likely than they were 12 months ago to see cybersecurity as an isolated function. As organizations integrate cyber resilience across the business and the influence of the Chief Information Security Officer (CISO) grows, how can they shape future business opportunities?

CISOs are building resilience and enabling innovation

Nearly three-quarters of CISOs say that high-profile attacks have put cybersecurity front of mind, and 38% worry about the increasing frequency of attacks. And they understand that the workforce can be a weak link: 61% worry about the vulnerabilities created when employees find it increasingly difficult to identify cyber attacks.

But our data shows that CISOs will need to get more comfortable with emerging areas of security to
protect their organizations against new types of threats. They have high levels of confidence in the
more traditional areas of security — about 60% say they are very competent in areas relating to cyber
resilience, cybersecurity, and collaboration with the wider business — but they are less confident in their
visibility of the software supply chain and using AI to enhance cybersecurity. Only 53% have confidence
that they can defend against cyber adversaries that are using AI.

CISOs are modernizing resilience

CISOs believe they are making good progress in transforming security to better support business
growth, with 61% saying their adaptive approach to cybersecurity enables the company to take greater
risks when it comes to innovation. This shift from a reactive approach to security to a proactive, continuously evolving one is important because it allows businesses to experiment more confidently
with new technologies that can fuel growth. Our survey findings show that better-performing and
higher-quality data insights could help to unlock more business opportunities. More than half (53%) of CISOs are concerned about data security and privacy issues, which means they are using resources to strengthen these foundations instead of focusing on enabling secure data-driven innovation. Better data resilience ensures continuity across cloud environments and directly supports business goals, including scaling AI safely and expanding into new markets.

CISOs’ survey responses also suggest that there is not enough alignment across the business, and this could be affecting cyber resilience. Less than half (45%) believe that business risk appetite has been aligned with cybersecurity risk management effectively, and only 37% say that cybersecurity budgets are allocated to every project from the beginning. Compare this with the 46% of executives overall who say this is investment is happening, and it appears that CISOs see the reality differently.

CISOs are pushing cybersecurity up the leadership agenda

For CISOs, this lack of business commitment comes from a disconnect at the highest level. And
they are taking action to address it.

Nearly 60% say that the governance team not understanding cyber resilience is a major barrier that prevents cybersecurity improvements, along with a lack of clarity about who is responsible for cyber resilience.

In response, CISOs are prioritizing more boardroom engagement and integrating cybersecurity into lines-of-business in the coming year. And they are starting to see results:

This is progress, but the data also shows that businesses could be exposing themselves to unnecessary risks. Just 30% say they have an effective due diligence strategy for mergers and acquisitions, and only 36% say they have an effective business continuity plan.

And they are preparing the business for new types of attack

CISOs say they are likely to experience newer types of attack within the next 12 months: 45% say both AI-powered attacks and deepfake attacks are likely. But just 29% say the business is prepared for AI-powered attacks and only 34% say it is prepared for deepfake attacks.

In response, CISOs say there is investment across a range of different tools and technologies. About two-thirds say their organization is investing at least moderately in advanced threat detection and in generative AI for social engineering attacks.

These executives are also increasingly turning to external expertise to improve their knowledge about emerging threats:

There is not enough software supply chain visibility

Sophisticated threat actors are increasingly using supply chain attacks, and with regulatory pressure increasing a lack of visibility could lead to non-compliance. This makes a robust software supply chain a vital component of a proactive cybersecurity posture.

But our research reveals that many CISOs have a blind spot here. Just 25% say that the need to assign or create a confidence level of suppliers is an important factor in better software supply chain visibility. Only 31% say that the biggest security risk they face today could come from within the software supply chain, and between half and two-thirds of CISOs say that some aspects of the software supply chain pose no particular risk to the business.

Four ways for CISO to improve cyber resilience

About LevelBlue

LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure-play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services. Learn more at levelblue.com.