Cybercrime. What does the most damage, losing data or trust?

Trust can be destroyed by a cyberattack. To maintain or restore trust, cyber strategies must protect, optimize and enable an organization.

New technologies are exposing financial services firms to greater vulnerabilities. While cybersecurity is enabling innovation and change, the ongoing impact of cyberattacks threatens to erode trust in many institutions. And many organizations have yet to provide the levels of cyber resilience and protection needed to maintain or restore the trust of their customers and stakeholders.

In recent years, there has been a significant trust disconnect between the public and major institutions. This is exacerbated by macro and geopolitical trends, as well as a concern for data privacy and cybersecurity. As customers provide more data, it becomes more costly for firms to take care of that data. Not only is there an immediate operational impact, but long-term brand reputation will likely be at risk.

Securing trust is critical for firms seeking to sustain long-term value in their business, products and services.  In fact, the 2018 Edelman Trust Barometer reveals that building trust is the most important job for today’s CEOs. Cybersecurity is an increasing priority.

The EY Global Information Security Survey (GISS) shows that cybersecurity is also rising the board agenda, as firms work to optimize their programs. In today’s digital era, many have a long way to go to fine-tune their capabilities. 

The survey reveals that “only 6% of financial services companies say their information security function currently meets their organization’s needs, but 65% plan to make the required improvements.” In one sense, these results are shocking. But, if you reflect on all the shocks in the system, the continued pace of new cyberattacks, and increased risk to a firm’s brand (loss of data, a breach or reputation), the figures are not surprising. Do financial services firms truly think their security team is best in class in protecting their organization? Most would say no. And for those that have a cyber risk program, the pace of improvement needs to increase.

Organizations in this sector are most anxious about the immaturity of their information security processes in the areas of architecture (cited as non-existent or very immature by 18%), metrics and reporting (18%) and asset management (17%), based on survey results. There is a concern that cyber expertise is not as involved as it should be in the ongoing transformation. Most organizations are on a digital transformation journey and are talking about adding artificial intelligence (AI), robotics and more valuable customer data into their operational models. However, cyber data, metrics and reporting should be embedded in the system from the outset to achieve agile transformational change – which is clearly not the case right now. If you build the right systems and security level into the design phase, it is easier to address gaps and flaws in the lifecycle.

Readiness requires a level of education from the top. Yet, there is an ongoing concern about the lack of talent in this area. In fact, 31% of survey participants warn that skill shortages are a potential stumbling block. Employees can also be a major threat to an organization. Certain cybersecurity functions can be automated through the use of robotics and AI, reducing risks and often improving efficiency. Innovation presents one of the biggest opportunities for the industry, and technology can help accelerate the level of organizational change. A high degree of trust in business correlates to the critical role of leading change. 

Keeping the board in the dark

Even though the majority of cyber functions are in- house , the levels of board reporting are insufficient. The survey shows that 84% of firms are not getting adequate board level reporting for cyber risk. Financial services is increasingly dependent on data. If boards' risk and audit committees lack the data they need, how can they effectively influence change?