In early October, hackers targeted American Water, one of the largest utility providers in the US. While the attack didn’t disrupt delivery, it followed similar attacks on water utilities in Arkansas, Indiana, and Texas. 

The American Water incident came on the heels of other notable cybersecurity breaches this year. In March, AT&T revealed that the personal data of more than 70 million current and former customers had leaked to the dark web. In May, Ascension, one of the nation’s largest healthcare systems, suffered a ransomware attack that locked employees out of its critical systems for almost six weeks. In June, CDK Global, a leading SaaS vendor for auto dealerships, experienced a series of attacks that shut down customer operations across the country. 

These are just a fraction of the thousands of attacks that occur every day.

All Eyes on Cybersecurity Leadership 

The cost of cybersecurity breaches is also growing. According to the FBI, losses associated with cybercrime complaints hit $12.5 billion in 2023—up $2 billion year-over-year. These high-profile events and the accelerating pace of financial loss have placed a renewed emphasis on data security. However, achieving real protection requires the right leadership, something many organizations struggle to implement. 

Having a full-time chief information security officer (CISO) on staff would be ideal, but that solution isn’t viable for every organization. Some assign CISO responsibilities to existing leaders, such as a chief technology officer (CTO) or chief information officer (CIO). Others turn them over to a compliance manager.

Unfortunately, organizations operating without CISOs often develop glaring holes in their security leadership, leaving them vulnerable to attack or hamstrung for further growth. In these scenarios, a virtual chief information security officer (vCISO) can provide cost-effective, strategic leadership to help organizations align cybersecurity with their long-term business goals and growth plans.

Five Reasons a Company Should Consider Hiring a vCISO? 

Hiring a vCISO isn’t the right choice for everyone. However, there are certain situations where the role will provide significant added value. Here are a few examples:  

1. Strategic Leadership Without Full-Time Commitment

Many organizations need strategic security leadership but can’t fully utilize an in-house CISO. A typical vCISO contract will provide 10-20 hours of expert strategic security guidance each month, which is often enough to keep critical projects on track.

2. Limited In-House Security Expertise

Sometimes, an organization’s IT or compliance staff lacks specialized security knowledge. In these instances, a vCISO can provide the necessary expertise to complete both short-term projects and long-term strategic planning initiatives.   

3. Regulatory Compliance Requirements

Some organizations may hire a vCISO to help them manage specific regulations, such as HIPAA, PCI compliance, or GDPR requirements. Some regulations require organizations to appoint a head of cybersecurity, and a vCISO could fill this role. 

4. Balancing Security with Business Growth

For many organizations, there’s an ongoing tension between optimizing systems for performance and efficiency while ensuring everything remains secure. A vCISO will strategically balance these needs, identifying where security controls are crucial and where organizations can take calculated risks to support business growth. They’ll also have the experience to effectively communicate those decisions to a board of directors or leadership committee.

5. Creating Checks and Balances for Existing IT Efforts

In some cases, a vCISO provides checks and balances to executives who want an outside perspective on their existing security initiatives. These executives value feedback from experts who operate outside of the organization’s traditional reporting structure and can offer reassurance that the IT department has handled the company’s security needs.

Qualities of an Effective vCISO 

vCISOs fill a critical organizational role, but as outsiders, they face challenges different from those of traditional CISOs. Consequently, a good vCISO must be a mature individual who knows they can’t come into an organization and expect to implement wholesale change. Instead, they need to understand where the organization is, where it needs to be, and how they can help it get there. With that in mind, here are a few qualities effective vCISOs share:

Broad Technology and Business Experience

A vCISO’s work will probably touch every aspect of an organization because they are all connected to security and compliance in one way or another. The best vCISOs understand how different parts of an organization work together, along with their strengths, struggles, and how they’re spread thin. This knowledge enables them to find the balance between efficiency and security that will keep an organization moving in the right direction.  

Effective vCISOs also understand that security is a best effort. Doing the bare minimum isn’t an option, but neither is throwing an unlimited budget at the problem. A good vCISO walks this tightrope by learning about their organization’s risk tolerance and spending enough so that the odds are in their favor. Unfortunately, this work has no guarantees, so vCISOs must also communicate to leadership that there could be a security incident even if they’re doing everything right.  

Strong Communication and Interpersonal Skills

A vCISO can’t accomplish these daunting challenges without solid communication and interpersonal skills. They’ll need to find their place within an organization as they work as an outsider. They’ll also need to build alliances with key stakeholders and recognize competing priorities where they exist. This isn’t a role for someone who shies away from conflict. Instead, an effective vCISO needs to lean into difficulties because this is often where the most important work needs to be done.  

Industry-Specific Expertise

An effective vCISO will also be aware of the organization’s position within its industry. They’ve done their homework and know how much their competitors spend on their security programs and whether they’ve experienced any security breaches. By comparing their budgets, strategies, and results against key competitors, vCISOs can create markers to help them set objectives and judge progress.

Strategic Thinking 

A great vCISO will also be a strategic thinker. They’ll understand the organization’s overall business plans and ensure the security program supports these objectives. These factors could include company growth, expansion into new markets and locations, or international compliance requirements.    

Tips for Selecting the Right vCISO

Unfortunately, finding a great vCISO is difficult because almost every cybersecurity company offers that service. As a result, organizations often receive shallow reporting rather than the strategic leadership they need. Organizations that want to buck that trend should follow these tips during their search and selection process.

• Assess the Organization’s Specific Needs: Organizations operate in unique ecosystems with different regulatory requirements, operational needs, systems, and tech stacks. Outlining these needs at the beginning of a search will help organizations narrow their search field.

• Evaluate Candidates’ Qualifications and Experience: Organizations should look for vCISOs with at least 15 years of overall experience and as many years of experience as possible in a particular industry. Qualified candidates should demonstrate that they’ve continued their education and are up-to-date on modern technology, methods, and emerging threats. Organizations should also prioritize so-called “battle-tested” vCISOs who’ve managed a breach response at some point because this experience is much less common.

• Ask Tough Questions During the Selection Process: Organizations will never have more leverage than they do during the selection process. So, they should use that opportunity to ask tough questions, like, “Does the vCISO I would be assigned have specific experience in my industry?” Organizations can also share their needs with multiple cybersecurity companies and compare the responses they receive. Prioritize specific answers. If a company offers high-level responses, they’re probably not the right partner. 

• Review Deliverables and Reporting Processes: During the selection process, organizations should clearly outline the vCISO’s deliverables and the process they’ll use for reporting progress. Without those elements in place, measuring success will be almost impossible.

Maximizing the Value of a vCISO Partnership

In an era of constantly evolving cybersecurity threats, where the stakes of a breach are astronomically high, organizations need strategic security leadership more than ever. A well-chosen vCISO can provide cost-effective and flexible guidance that will help organizations make smarter security decisions.  

By carefully assessing their needs, thoroughly vetting candidates, and setting clear expectations, an organization can create a partnership with a vCISO that will strengthen its security efforts while aligning them with its broader business objectives.

With the right vCISO in place, an organization can turn cybersecurity from a necessary expense into a strategic advantage, positioning it for secure and sustainable growth.

Here’s a quick story that will send shivers down the spine of every CEO.

Years ago, a promising tech company hired us to revamp its email security. It didn’t take long to uncover several troubling security flaws, which we urged them to fix immediately. The company had just secured $20 million in funding to support a new product launch, an incredible achievement for any startup. However, their focus was strictly on product and they didn’t want to spend the money it would take to really secure their system. They agreed to take some of the basic steps we recommended, but opted out of resolving the larger security vulnerabilities.

Just days later, the company’s COO boarded a flight from Tokyo to Chicago. While their plane was still in the air, the COO’s team received an email from them with instructions to wire $10 million to a new vendor. Being a fast paced startup team, the finance team quickly jumped on the request. It took over 48 hours for anyone to realize what had happened. The COO hadn’t sent the email. There was no new vendor. And that $10 million? It was lost to some very sophisticated scammers.

The company was left reeling from the attack, but its troubles were far from over. Without a robust cybersecurity infrastructure in place, it was ill-equipped to investigate the incident and uncover what really happened. This is where the importance of being able to “tell the story” of a cyberattack comes into play.  

Reconstructing the Narrative

To uncover the truth about the attack, we partnered with experts who could sift through the company’s systems line by line. Their fee was $1 million—payable immediately. So, in a matter of days, this company lost more than half of its funding.

These digital detectives worked around the clock to reconstruct the narrative of this attack. As it turned out, hackers had accessed the company’s email system and monitored conversations for a long time. They knew the COO’s travel schedule and picked a moment to strike when they knew the COO would be unreachable. With no protections in place, the company was helpless to defend itself.

Many organizations wouldn’t have survived such a significant blow, but this company was more fortunate. It did survive and, ultimately, went on to thrive. But, within a year of the hack, the founders and the entire leadership team were replaced.  

Three Takeaways for Business Leaders

This story isn’t just a plug for my team, it’s a real life example of the potential costs when a company neglects its cybersecurity responsibilities. It’s easy to put your security last on your organizational roadmap, but with threats increasing at an alarming rate, business leaders must respond with strategies that protect their organizations’ assets. While most companies won’t experience the kind of losses our client did, their experience still offers valuable lessons business leaders can use as guideposts as they examine their cybersecurity position. Here are a few to consider:

1. You May Not Understand Your Actual Risks

It’s common for business leaders to misunderstand their cybersecurity risk level or, worse, mistakenly believe their systems and processes are stronger than they really are. However, attacks have become so sophisticated and multilayered that it’s shockingly easy to get caught up in them. 

In the example I shared, the tech company believed their vulnerabilities were limited to a single layer: email. And while the attackers used the company’s email system to gain information, they relied on another tactic called social engineering to execute the heist. This approach relies on manipulation, influence, or deception to exploit human vulnerabilities by tricking people into revealing sensitive information or taking actions that compromise security. In this case, it was an email from a trusted supervisor sent at precisely the right (or wrong) time.   

Business leaders must understand that threats exist throughout an organization, both within its computer systems and among the humans that use them. An effective security program maps an organization’s risk profile, aligns resources based on risk tolerance, and creates solutions that address all the elements in play.

2. Upfront Costs Are Not a True Representation of Value

In the same way business leaders misunderstand their cybersecurity risks, they also underestimate the actual value of an effective cybersecurity program. Most organizations classify cyber IT as a capital or overhead cost that accounts for somewhere between 3% and 5% of a typical company’s annual budget. While these expenditures don’t drive profit, they hold value and can protect organizations from incurring even higher costs.  

I was reminded of this a few years ago when I unexpectedly ran into a customer while I was vacationing. During our conversation, he told me, “I always thought security was a waste of money until we had to use you guys for real.” 

He explained that his company had recently received a seemingly legitimate email from one of their current vendors requesting a change in bank account details for payments. The company followed its verification procedures and transferred a significant amount of money to the new account. A few days later, they realized the email was fraudulent and someone had stolen the money. 

The company’s cybersecurity insurance repaid the lost funds minus a 10% deductible. But because they were an edgefi client, we were able to review the interaction and prove that the vendor was responsible for the breach. Our client took this information to their vendor, who agreed to cover the deductible costs. That added value will never be reflected in an IT budget spreadsheet. 

Now, take that idea a step further. How does a financial institution quantify its loss of member trust after it experiences a security breach? How does a legacy brand price its tarnished reputation after customer data ends up on the dark web? Recovering from these challenges is certainly possible, but you’ll need a lot of money to throw at the problem. How much? That’s also impossible to predict.

That tech company I spoke about earlier balked when it came time to address its email security because it didn’t recognize the value in the upfront cost. However, if leadership had the power to go back in time, I’m confident they would have gladly paid twice as much to preserve their positions within the company and avoid such a staggering loss.

3. Action Always Beats Inaction

So why don’t more business leaders prioritize cybersecurity? As with most things, it comes down to time and money, which are very limited resources in most work environments. Leaders are already booked to the brim and asking their employees to do more than ever. They barely have the time to do their core work, let alone take on a problem as significant as cybersecurity.

Some business leaders are also afraid of what they’ll discover after finally getting serious about addressing their cybersecurity needs. So, instead, they prefer to keep their heads buried in the sand, hoping for the best. As a longtime executive myself, I get it, not thinking about it means less to carry on your mind – but waiting will likely create major headaches (and more) at some point in the future

Ultimately, deciding to do nothing is a choice to accept the maximum risk. So, if you’re a business leader who knows they need to get their cybersecurity house in order, taking one step—any step—in the right direction is always the safest move. The tech company’s experience, for example, shows us that inaction can be fatal. 

Crafting Your Cybersecurity Story: A Proactive Approach

Every company has its own cybersecurity story to tell. Some will be dramatic tales of great loss and challenges overcome, like our client. While those stories are exciting to read, nobody wants to experience them firsthand. Instead, you want your story to be uneventful because you were wise and proactively addressed your cybersecurity needs.

Okay, you’ve heard the horror story, and now you’re probably asking, “where should I begin”?

• Get honest about your risks. Bring in experts who can provide the complete picture of your vulnerabilities through comprehensive risk assessments and penetration testing. 
• Look past the initial price tag. The cost of building a cybersecurity infrastructure will almost always be less than the cost of recovering from a breach. This doesn’t mean jump on your first quote. Make a calculated decision, with a trusted vendor, at a reasonable scope.
• Create a bias towards action. Doing nothing is the riskiest path. Even the smallest steps forward can create momentum for significant change. I can’t stress this enough.

If you’re not sure where to start, I always love helping other executives get momentum around their security posture (and swapping a story or two). Don’t hesitate to reach out!

What is Penetration Testing?

Businesses can no longer afford to take cybersecurity lightly. The challenges are endless with threats like phishing scams and ransomware attacks rapidly evolving. That’s why penetration testing has become a critical tool in the cybersecurity toolkit, helping businesses stay one step ahead of cybercriminals and fixing vulnerabilities before cybercriminals can exploit them.

Penetration testing, also known as pen testing or ethical hacking, is a proactive security measure where experts simulate cyber-attacks on a system, network, or application. The goal is to identify and address vulnerabilities before cybercriminals can exploit them. These vulnerabilities can range from software bugs and design flaws to configuration errors that could compromise your security. They can be conducted on various targets, such as IP address ranges, specific applications, or even based on the organization’s name.

The timing and frequency of penetration tests depend on various factors, including the size of your online presence, budget, regulatory and compliance requirements, and whether your IT infrastructure is cloud-based. Conducting them at least once a year to keep your IT infrastructure secure is good practice.

There are five main methods of penetration testing that can be used to protect your systems and data.

The Five Types of Penetration Testing

1. Targeted Testing: Both the tester and the organization work together to keep each other informed about the test.
2. Internal Testing: Conducted from within the organization’s network to simulate an insider attack.
3. External Testing: Focuses on the organization’s external-facing assets to identify vulnerabilities that could be exploited from outside.
4. Blind Testing: Testers have limited information about the organization, simulating an external hacker’s perspective.
5. Double-Blind Testing: Only a few people within the organization know about the test, mimicking a real-world attack scenario.

Customizing the tests to your organization’s specific needs and goals, and following up with detailed reports and vulnerability assessments, ensures a thorough evaluation. There are various methods through which these penetration tests can be carried out, such as:

1. Physical Security Testing: Providing a pen tester with your office address and challenging them to access your systems. They might use techniques like social engineering—convincing a staff member to grant them access—or advanced application-specific attacks.
2. Application Testing: Giving a pen tester access to a new, unutilized web application version and observing how they attempt to break in and launch attacks. The degree of access granted to the pen testers and the specific objectives of the test can vary, depending on what your organization aims to evaluate.
3. Network Security Testing: Engaging a pen tester to examine your network infrastructure, including routers, switches, and firewalls. The tester attempts to identify open ports, insecure network protocols, and other vulnerabilities. This type of test helps uncover weaknesses that could allow attackers to gain unauthorized access to sensitive data or disrupt network services.
4. Wireless Network Testing: This involves assessing the security of your wireless networks. Pen testers try to exploit vulnerabilities in Wi-Fi networks, such as weak encryption protocols, default passwords, or poor network configurations. This type of testing helps ensure that your wireless infrastructure is secure against unauthorized access.
5. Social Engineering Testing: This focuses on the human element of security. Pen testers use phishing emails, pretexting, or baiting techniques to trick employees into revealing sensitive information or granting access to secure areas. This helps identify weaknesses in employee awareness and training regarding security protocols.

Understanding how penetration tests can be carried out ensures that your organization is well-prepared to defend against potential cyber threats. However, even with rigorous internal testing, some vulnerabilities may still fly under the radar. This is why it’s crucial to have an objective and unbiased perspective.

Red Team: The Objective Eye

Enter the Red Team: an external group of security experts simulating real-world attacks on your organization’s systems and infrastructure. They aim to identify and exploit vulnerabilities your internal teams may have overlooked.

A third-party Red Team is a critical component of effective penetration testing. A Red Team can assess your security measures without any preconceived notions or biases by providing an outside perspective. Internal teams, while highly skilled, may develop blind spots over time due to familiarity with the systems they protect.

A Red Team’s unbiased approach helps to mitigate this risk, offering insights that result in a more comprehensive evaluation of your security posture. By simulating real-world attacks, they can identify vulnerabilities that might otherwise go unnoticed, ensuring a thorough assessment of your defenses. This external viewpoint is crucial for discovering hidden weaknesses and providing actionable recommendations for improvement.

Additionally, Red Teams bring specialized expertise and experience from working with various organizations and industries, which can allow them to apply advanced tactics and techniques that mimic the strategies used by actual cybercriminals. By continuously adapting to evolving threats, Red Teams help organizations stay one step ahead of potential attackers.

With the expertise of Red Teams, businesses can better protect themselves. But which industries need this protection the most?

Common Targets for Cybercriminals

Cybercriminals often focus on specific industries due to the high value and sensitivity of the data they handle. Understanding these targets helps organizations prioritize security measures and protect their critical assets.

Financial Institutions: Financial institutions such as banks, credit unions, and investment firms are prime targets for cybercriminals. These organizations manage vast amounts of sensitive financial data, including bank account details, credit card numbers, and personal identification information, which can be monetized through fraudulent transactions or sold on the dark web.

Additionally, financial networks are extensive and interconnected, providing multiple entry points for attackers. This complexity increases the likelihood of vulnerabilities that can be exploited. Additionally, financial institutions must comply with stringent regulations and standards, making them attractive targets for cybercriminals aiming to cause disruption and financial loss.

Tailored Strategies and Solutions for the Finance Sector:

To stay ahead of cyber threats, financial institutions should implement the following strategies:

• • Advanced Threat Detection: Use real-time monitoring and advanced analytics to swiftly detect and respond to threats. This helps identify suspicious activities before they can cause significant damage.
  • Encryption and Data Protection: Ensure all sensitive data is encrypted both at rest and in transit to prevent unauthorized access. Strong encryption protocols can significantly reduce the risk of data breaches.
  • Regular Penetration Testing: Conduct frequent penetration tests to identify and address vulnerabilities before they can be exploited. This proactive approach helps maintain a robust security posture.
  • Employee Training: Educate staff on security best practices and phishing awareness to reduce the risk of social engineering attacks. Well-informed employees can act as a strong line of defense against cyber threats.
  • Incident Response Planning: Develop and regularly update a comprehensive incident response plan to mitigate the impact of potential breaches. This ensures that the organization can quickly and effectively respond to security incidents.

Technology Companies: Technology companies, including software developers, IT service providers, and hardware manufacturers, are frequent targets for cybercriminals. These organizations often possess valuable intellectual property, source code, and customer data.

Technology companies hold valuable intellectual property, such as proprietary software and research data, which cybercriminals can steal and sell or use for competitive advantage. Many tech companies manage large amounts of personal and financial data from their users, making them attractive targets for data breaches. Successful attacks on tech companies can lead to significant reputational damage, making them attractive targets for cybercriminals seeking notoriety or financial gain. Additionally, tech companies often have complex IT environments with multiple systems and networks, increasing potential vulnerabilities.

Tailored Strategies and Solutions for the Technology Sector:

To stay ahead of cyber threats, technology companies should implement the following strategies:

• • Comprehensive Security Assessments: Regularly conduct security assessments to identify vulnerabilities in software, hardware, and network configurations.
  • Secure Development Practices: Implement secure coding practices and regular code reviews to prevent security flaws in software development.
  • Data Protection Measures: Encrypt sensitive data and implement strong access controls to protect intellectual property and customer information.
  • Third-Party Risk Management: Evaluate and monitor the security practices of third-party vendors and partners to ensure they do not introduce additional risks.
  • Incident Response and Recovery: Develop robust incident response and disaster recovery plans to minimize the impact of cyber incidents and ensure business continuity.

Healthcare Industry: The healthcare industry, including hospitals, clinics, and medical research facilities, is a prime target for cybercriminals due to the sensitive nature of the data they handle. These organizations manage extensive personal health information (PHI), including patient records, medical histories, and insurance details.

This highly sensitive data can be exploited for identity theft, insurance fraud, and other malicious activities. The healthcare sector often lacks strong cybersecurity measures, making it an easier target for cybercriminals. Successful attacks on healthcare organizations can lead to significant disruption of services, endangering patient safety and leading to potential financial losses. Furthermore, the healthcare industry is subject to strict regulatory requirements, such as HIPAA in the United States, making compliance and data protection critical.

Tailored Strategies and Solutions for the Healthcare Sector:

To protect against cyber threats, healthcare organizations should implement the following strategies:

• • Robust Access Controls: Implement strong access controls to ensure that only authorized users have access to sensitive data. This includes using multi-factor authentication and regularly reviewing access permissions.
  • Data Encryption: Encrypt all sensitive data, both at rest and in transit, to protect it from unauthorized access. This helps ensure that even if data is intercepted, it cannot be read or used maliciously.
  • Regular Security Audits: Conduct regular security audits to identify and address vulnerabilities in IT systems and processes. This helps maintain a strong security posture and ensures compliance with regulatory requirements.
  • Employee Training: Train healthcare staff on cybersecurity best practices, including recognizing phishing attempts and securing devices. Educated employees can significantly reduce the risk of successful cyber attacks.
  • Incident Response Planning: Develop and regularly update an incident response plan to quickly and effectively address security breaches. This ensures that healthcare organizations can minimize disruption and protect patient safety in the event of a cyber incident.

Understanding the tailored strategies for different sectors emphasizes the critical role of penetration testing in maintaining robust cybersecurity. By implementing industry-specific measures, organizations can significantly enhance their security posture and safeguard sensitive data.

Penetration testing is an essential tool for identifying and mitigating vulnerabilities before they can be exploited by cybercriminals. Regular pen testing helps organizations strengthen their defenses, comply with regulations, and protect sensitive data.

Investing in penetration testing is not just about meeting compliance requirements; it’s about safeguarding the future of your business. Take the proactive step to secure your organization today. edgefi’s penetration testing services offer businesses a precise and scalable approach to security. By employing a combination of advanced techniques, external Red Team assessments, and thorough vulnerability scans, edgefi helps organizations stay ahead of evolving cyber threats.

Contact us to learn more about how our penetration testing services can help you build a resilient security posture and stay one step ahead of cybercriminals.