Research by Ponemon Institute highlights a hazardous misalignment between IT security and the C-suite.

The Ponemon report, Digital Transformation & Cyber Risk: What You Need to Know to Stay Safe, identifies four major themes:

1. Digital transformation is increasing cyber risk, and IT security has very little involvement in directing efforts to ensure a secure digital transformation process. Such misalignment of resources is illustrated by 82% of respondents believing their organizations experienced at least one data breach as a result of digital transformation. Fifty-five percent of respondents say with certainty that at least one of the breaches affecting their organization was caused by a third party.
2. Digital transformation has significantly increased reliance on third parties, specifically cloud providers, IoT and shadow IT; and many organizations do not have a third-party cyber risk management program. Sixty-three percent of respondents say their organizations have difficulty in ensuring a secure cloud environment and 54% of IT security professionals say avoiding security exploits is a challenge. Additionally, 56% of C-level executives say their organizations find it a challenge to ensure third parties have policies and practices that ensure the security of their information.
3. Conflicting priorities between IT security and the C-suite create vulnerabilities and risk; these two groups do not agree on the importance of safeguarding risk areas, including high value assets. IT security respondents are more likely to say the rush to produce and release apps, plus the increased use of shadow IT, are the primary reasons their organizations are more vulnerable following digital transformation. But in contrast, C-level respondents say increased migration to the cloud and increased outsourcing to third parties makes a security incident more likely. The majority of C-level respondents do not want the security measures used by IT security to prevent the free flow of information and an open business model.
4. Budgets are, and will continue to be, inadequate to secure the digital transformation process; the majority of organizations do not have adequate budget for protecting data assets and don’t believe they will in the future. In fact, only 35% of respondents say they have such a budget. Because of the risks created by digital transformation, respondents believe the percentage of IT security allocated to digital transformation today should almost be doubled from an average of 21% to 37%. In two years, the average percentage will be only 37% and respondents say ideally it should be 45%.

“If there’s one major takeaway from our research, it’s that digital transformation is not going anywhere. In fact, organizations should expect—and plan for—digital transformation to become more of an imperative over time,” says Dave Stapleton, Chief Information Security Officer, CyberGRX, which conducted the study with Ponemon Institute. “For this reason, organizations must consider the security implications of digital transformation and shift their strategy to build in resources that mitigate risk of cyberattacks. Based on these findings, we recommend involving organizations’ IT security teams in the digital transformation process, identifying the essential components for a successful process, educating colleagues on cyber risk and prevention, and creating a strategy that protects what matters most.”

CyberGRX’s research in partnership with Ponemon identifies trends and best practices from organizations that had mature digital transformation programs in place. These findings suggest that across organizations, flexibility and collaboration — particularly between IT teams and C-level executives — will be key to ensure digital transformation that is both efficient and secure. Going forward, it is imperative that C-level executives comprehend the level of risk they take on when they become vulnerable to reputational damage brought on by security incidents involving third-party relationships. At the same time, both security personnel and senior management need to unite on a strategy that lowers the organization’s cyber risk profile while keeping key business goals and operations in sync. Finally, significant investments in skilled personnel and the technologies that secure and protect data and assets must be made to reduce third-party risk.

“Our research think tank is dedicated to advancing privacy and data protection practices—and these report findings underscore a growing need for such mitigation tools, at a time when we see rapid digital transformation across industries,” said Dr. Larry Ponemon, Chairman and Founder of the Ponemon Institute. “We chose to study both IT security professionals and C-suite executives to tap into the intersection of two groups making the biggest impact on organizations as they adopt new digital practices.”