This article discusses the challenges and successes proactive organizations have enabled to help employees prepare for the next cyberattack by adopting a security champions program.

Can an organization develop a security champions approach even in a changing cybersecurity landscape?

Adding Agile to proactive security awareness

Developing a security culture required more than extensive investments in the latest cybersecurity adaptive controls, including zero trust, XDR and cloud-based advanced email security. Organizations need to ensure their proactive security strategy empowers every employee in the firm to become an active team member by sharing their common goals, security knowledge and security risks.

SecOps and NetSecOps teams that roll out new security controls to their internal customers, including supporting remote access, endpoint security and cloud security, continue to meet with resistance. This resistance comes from the end users if these new controls change or block their ability to do their work. Internal rebellion often leads to shadow IT or employees bypassing these controls.

The value of a cybersecurity champions program

Recognizing this dilemma, CIOs and CISOs began incorporating more flexible or agile-based adaptive control strategies designed to build internal champions, not distractors. Here are some examples of these new agility-based proactive security approaches:

• SOC for a Day — This innovative approach by many CISOs opens the door to the world of threat hunting and incident response for every employee. Having employees "staff" a shift in the security operations center, they will witness firsthand what happens when employees click on email phishing lure leading to a download of malware ransomware leading to identity or credential theft. They also see what happens when a new security control like AI-powered email security stops an email phishing attack.
• Demoing the security solution has become a creative, proactive approach to help prepare employees for the next attack. SecOps and NetSecOps teams should show the new advanced controls before the solution goes live. By offering the employees a view into how these tools work and emphasizing how these controls help make their jobs a lot easier and safer for the organization, they become more receptive to change.
• Show the math: The cost per cyberattack continues to rise. In the 2022 IBM report, the average price for cyberattacks rose to $4.35 million. A ransomware attack or data breach costs organizations millions. CIOs, CFOs and CISOs are spending segmenting to explain how a cyberattack reduces capital.

During these meetings, the leadership pointed out several impactful events caused by cybersecurity attacks.

• Loss of brand value — “Clients, prospects, and partners will question our ability to protect their data. This effect could lead to a loss of new revenues for the company.”
• The cost of repair — “Even with cybersecurity insurance, organizations have additional payout expenses not covered. This expenditure takes away value capital that could be used for investment, acquisitions, and employee pay raises and bonuses.”

The cost and reality of proactive security 

Organizations taking an agile approach to proactive security include incorporating SOC-for-a-day, demo day and show the math sessions; these innovative programs provide valuable insight and the complex realities of cyberattacks all employees should understand.

The conclusion is cybersecurity is a team sport; everyone in the company is a critical player in stopping attacks. An organization's investment in creating a network of security champions creates more advocates for security practice's effectiveness.

Everyone has a vital role in reducing the organization's risk, helping available capital resources, and continuing to help build a solid brand in the market leading to new opportunities for the company to grow.