The past 36 months has seen two significant developments that should have woken up Boards of Directors to their cybersecurity obligations.
This past summer we witnessed various blue-chip firms like Maersk, Merck, FedEx and Mondelez, none of whom likely anticipated the reality of a major cyber event, all declare major impacts on operations and in some cases a resulting impact of hundreds of millions of dollars in losses. The leaves are now falling and so are the executives as Equifax, with more almost certainly on the way, compensation clawbacks being discussed, and years of litigation ahead. Most recently we’ve seen Deloitte suffer the exact fate that it proudly attempts to help thousands of clients avoid. While all of these companies are different, they likely share a common thread of investing an incredible amount of money in security technology, employing many capable security professionals, and thinking that their losses would be insured. Does anybody still believe that the current cybersecurity paradigm is working?