James Lamond is the Executive Director of Trusted Future, a Washington-based think tank focused on technology policy.
After a summer of high-tension developments in the geopolitical space, including U.S. intelligence assessments that Russian leaders could target NATO members in coming years, some analysts are warning that bad actors and government leaders could be mounting threats of all levels.
These potential scenarios, some of which have already started to unfold, exist on a spectrum. On one end of the spectrum, the less likely and more extreme end, are invasions, sabotage, airspace incursions and more.
On the other end of the spectrum, the more likely and less extreme end, is an increase in cyberattacks. In fact, European and Western officials have already reported an intensifying campaign of Russian cyber operations targeting critical infrastructure, digital economies and government networks.
How should companies think about operating in this threat environment where increased cyber intrusions are the new norm?
How Businesses Must Operate In The Face Of Cyberthreats
Leaders need to focus on outcomes, not documents. One of the challenges that we have seen in Europe over the last couple years is an increase in regulations, reporting requirements and compliance frameworks that haven’t actually resulted in meaningful cybersecurity. Even as organizational spending on information security has doubled, cyber incidents have increased. Companies should avoid getting bogged down in this compliance trap.
Ukraine has many lessons to offer here. Their cyberdefenses have proven to be incredibly innovative and resilient, even in the face of war. This is partially due to the fact that Ukrainian institutions have increasingly adopted outcome-based performance metrics like objectives and key results (OKRs), which measure real-world impact like reduced service disruption or fraud losses. This focus on measuring outcomes that matter should be the highest priority for companies.
Leaders must also increase information sharing with both the private sector and governments. Too often, threat intelligence is thought of as a competitive advantage. However, increased cooperation between companies on incident response could go a long way in increasing resilience.
Airline safety provides a useful model to learn from here. Safety and threat intelligence is shared constantly because safety in the sky is seen as urgent, operational and noncompetitive. In this increased threat environment, there is no reason that cybersecurity should be thought of any differently.
Unfortunately, the infrastructure for effective EU-wide operational coordination among firms remains fragmented. An industry-led initiative here could help bridge this gap.
Leaders should continue to rigorously use AI red-teaming. While the debate about the pace of development of AI and the appropriate governance models for it is incredibly important and should continue, cyber practitioners have to deal with the reality as it exists today. Current AI models are able to find software flaws at a pace and efficiency previously inconceivable. Just as nation-states and criminal organizations can use these tools to exploit weaknesses, they can also give defenders their most powerful tool to find and close those vulnerabilities.
Finally, leaders must invest in trusted security architectures. The twin threats of nation-states and superior AI models present a dangerous combination. The CSA CISO Alliance, a group of the world’s leading cybersecurity practitioners, recommended key steps that technologists can use for becoming cybersecure in the age of AI. They include focusing on known security basics, like those that have been embedded directly into the core architecture of smartphones and mobile devices, to protect users.
Embracing The Opportunity To Focus On Results
The digital environment is facing new and growing threats, but there are also new and exciting opportunities here for leaders hoping to make their mark on the future of security. Companies that are able to focus on a results-oriented approach to cybersecurity may be best able to take advantage of these opportunities.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?