Good cyber security starts with understanding risk, not buying technology

When organisations look to improve cyber security, the conversation often turns quickly to technology.

Which firewall should we buy? Do we need a new security platform? Should we invest in monitoring tools?

While technology is important, it is rarely the starting point.

One thing that consistently surprises me is how often organisations can describe their controls in detail but struggle to explain their most significant cyber risks.

The organisations that manage cyber risk most effectively tend to have a clear understanding of:

• Their most important information, systems and services.

• The threats and risks that matter most to their business.

• Their current level of cyber maturity.

• Who owns cyber risk and key security decisions.

• Roles and responsibilities during normal operations and incident response.

• How cyber risk is reported, reviewed and governed.

Without this foundation, organisations can spend significant amounts on technology without materially reducing risk.

Technology is an important enabler of cyber security.

Understanding risk, setting priorities and establishing accountability is what turns security activities into effective risk management.