During my first few years as a CISO at Avid Technology, I was able to install a robust cybersecurity program. (Avid is a software provider that equips digital content creators with innovative tools.) With the help of my security team, Avid had become more mature in their control measures. This maturity meant we were better armed to address cyber vulnerabilities. ‍ Unfortunately, on top of my regular duties, I also had to face an even greater challenge.

‍ As one of the youngest global industries, cybersecurity presents many challenges. It's a complex sector with many components to master. Security leaders find fortifying an organization's security measures tough. This obstacle is made even greater by the quickly evolving threat landscape. Another tricky hurdle is communicating and justifying their actions to the boardroom. ‍

‍ The use of risk matrices for decision-making purposes extends back to the 1980s when the US Department of Defense needed a quick and easy way to evaluate hazards in safety systems engineering. Since then, the matrix has been applied in multiple fields to assess potential results and their associated risks, emerging as an instrumental tool for organizations grappling with making high-level strategic investments. ‍

‍ The US Securities and Exchange Commission's complaint against SolarWinds and its Chief Information Security Officer (CISO) Tim Brown has sent shockwaves through the cybersecurity community. Solarwinds and Brown have been accused of fraud, the details of which can be found in an extensive 68-page document. ‍ This complaint, in itself a bold move, has been particularly jolting to cyber professionals given the SEC’s July 2023 regulations.

The global marketplace faces an increasingly destructive cyber risk landscape each year, and 2024 is set to confirm this trend. The cost of data breaches alone is expected to reach $5 trillion, a growth of 11 percent from 2023. As technology advances, attackers continue to develop new, more sophisticated methods for infiltrating systems and exploiting vulnerabilities. ‍ Amongst cyber experts, it is now widely acknowledged that the question of an attack is not ‘if’ but ‘when.’