A global pandemic coupled with a global cybersecurity skills shortage, make these uncertain times for organisations of all shapes and sizes. The shortage of skilled IT Security workers in Europe has doubled in the past twelve months rising from 142,000 to 291,000, according to a recent report. Globally that figure is now over four million. A lack of skilled or experienced security personnel was declared as the number one workplace concern in the same report. With a lack of skilled technical resource inhouse organisations need to seek alternative ways to keep secure.

Skills aren’t the only issue; the threat landscape is continuing to evolve at pace. As highlighted in our latest Global Threat Intelligence Report, attackers are innovating faster than ever, and more recently are looking to take advantage of the current pandemic to proactively target vulnerable organisations. Adding to this complexity is the rise in cloud-based services, mobile devices, big data, and the Internet of Things blurring traditional network boundaries and creating a broadening footprint. It’s unsurprising then that 57 per cent of respondents cited security as the biggest challenge of managing IT inhouse in NTT’s 2020 Global Managed Services Report. Evaluating security postures and dealing with security risks is a perennial challenge, not least amidst constant change. Now more than ever organisations are looking to services providers, calling on their expertise to fill any internal gaps and resource as their needs increase.

The responsibility of managing this challenge and ensuring information assets are properly protected, usually sits with the Chief Information Security Officer (CISO) but they are in high demand and short supply. As a result, we have seen an emergence of a hybrid approach to procuring security services called ‘CISO as a Service’. Designed to bridge a widening gap in cybersecurity knowledge and experience the service is delivered to organisations by a third party and provides them with access to highly skilled security people and tools.

Digital drivers

One of the key drivers for this service is the desire for organisations to digitally transform whilst remaining secure.  They recognise the need to be ‘secure by design’ which means making sure that security is at the heart of the business’s overall strategy and building it in from the start.  Despite the benefits that digital transformation offers such as increased productivity, the ability to reach new markets and improved business processes it’s almost impossible to achieve without there being at least some risk.

Digital isn’t the only driver though. Enhancing rather than hindering user experience is important but it’s hard to balance security with ease of use while being innovative. Adhering to the appropriate governance and compliance regulations is a constant struggle as is preserving operational security with compliance and all this while keeping up to date with changing practices.

Furthermore, maintaining visibility and control over a fast-changing hybrid IT environment which has disparate monitoring systems and tools are adding to the mounting task. Last and by no means least is the design, building and operating of a proactive cybersecurity environment. The reality is that most organisations would require a sizeable, skilled team to achieve all of the above which is not only costly but challenging when we’re faced with a global shortage of skilled, IT security professionals.

Why CISO as a Service is a viable proposition

Those challenges I’ve listed above will be a familiar story to many organisations and it’s likely to be a similar tale to those even with CISO’s on-board.

What we do know is that cybersecurity is a complex subject that isn’t getting any easier. Using the expertise of a third party to provide a CISO as a Service capability provides the necessary levels of assurance to organisations that their cybersecurity strategy is being driven by highly skilled experts with access to the latest threat intelligence.

CISO as a Service also offers considerable levels of flexibility to organisations so that they are able to flex up and down depending on their requirements. It can be used to solve a specific task such as managing a compliance project or developing an incident response plan or it can cover the full range of security services

Gaining access to skilled cybersecurity professionals and knowing how to deal with the fast-evolving threat landscape are ongoing challenges faced by organisations globally. They either don’t have the skills or expertise, they aren’t able to source them, or they can’t afford the associated investment costs that additional headcount involves. For them, the concept of CISO as a Service offers a very welcome alternative and should certainly be considered a viable proposition whether it’s to support all or part of an organisation’s cybersecurity services.