Cybersecurity Beyond Traditional Risk Management

While some time-tested risk management concepts and strategies may be exactly the right approach for dealing with cyber risk, relegating it to a subset of anything speaks to a lack of understanding of the problem and will ultimately increase risk significantly. The rapid pace of increasing complexity and the increasingly crippling impacts of cyber-specific threats demand a different degree of prioritization, resources and tireless attention than any other type of risk corporations face today. In the same way that technology will change the way we do business more in the next five years than any other catalyst, cyber risks will challenge our ability to operate more than any other threat.

It is against that backdrop that governments and large enterprises have continued to harden their defenses and small to mid-sized businesses (SMBs) have lagged behind due to lack of resources or lack of motivation to mitigate risk. The prohibitive cost of comprehensive prevention measures and the frightening cost of breach response may lead many smaller companies to oversimplify the problem or to put their head in the sand hoping that no hackers pick on them. While that may have been a safe bet a few years ago, it's becoming increasingly likely that being small doesn't keep you off the target list. According to Symantec's 2016 Internet Security Report, 43% of cyber-attacks target businesses with 1 to 250 employees ' two and a half times the share attributed to that segment four years ago ' making SMBs a growing sweet spot for bad actors.