What do CEOs really think about cyber risk? First-of-its-kind study reveals all

Saïd Business School at the University of Oxford and ISTARI, a Temasek-founded global cybersecurity firm dedicated to helping clients build cyber resilience, have today revealed the findings of their joint CEO Report on Cyber Resilience. The report applies a top-management lens to cybersecurity risks and underscores the critical role CEOs play in building cyber resilience.

It shares insights from thirty-seven, one-hour-long face-to-face interviews with American, Asian and European CEOs whose businesses’ average annual revenue is $12 billion, employing an average of 40,000 employees. Nine of the CEOs interviewed had guided their company through a serious cyberattack.

What CEOs really think about cyber risk: secret fears, uncertainty and discomfort

Under the condition of anonymity, the CEOs spoke with remarkable honesty about their feelings, frustrations and regrets about cyber threats and security.

The CEOs acknowledged that they are formally answerable to regulators, shareholders and their boards for cybersecurity. Yet the majority (72%) said they were uncomfortable making decisions about it, often leading them to delegate responsibility for, and understanding of, cybersecurity to their technology teams, which can jeopardise resilience.

Co-author of the report, Dr Manuel Hepfer, Head of Knowledge and Insights at ISTARI and a Research Affiliate at Saïd Business School, says: 'Many CEOs we spoke with highlighted the agonies of having to make existential decisions on imperfect information under extreme pressure in an area they lack familiarity and intuition.'

Four mindsets CEOs need to lead cyber resilient businesses

The study outlines four mindsets CEOs should adopt to build cyber resilience:

1. All CEOs interviewed said they feel accountable for cybersecurity. However, a parallel ISTARI survey of Chief Information Security Officers (CISOs) found one in two European (50%) and almost a third of US (30%) CISOs did not believe that their CEOs feel accountable. This gap in perception, according to the research, lies partly in the meaning of accountability: instead of seeing themselves as accountable – being the face of the mistake – CEOs should assume co-responsibility for cyber resilience together with their CISO.
2. CEOs should stay away from blindly trusting their technology teams. Instead, they should move to a state of informed trust about their enterprise’s cyber resilience maturity. 
3. CEOs should embrace what the authors call the ‘preparedness paradox’: an inverse relationship between the perception of preparedness and resilience – the better-prepared CEOs think their organisation is for a serious cyberattack, the less resilient their organisation likely is, in reality.
4. CEOs should adapt their communication styles to regulate pressure from external stakeholders who have different and sometimes conflicting demands. Depending on the stakeholder and the situation, CEOs should either be a transmitter, filter, absorber or amplifier of pressure.

'Put down your phones'

Leaders who have endured a cyberattack feel strongly about helping others avoid some of the mistakes they have made. As one CEO said: 'Whenever I speak to a group of CEOs to share my learnings from the cyberattack, I start by saying, "put down your phones for 15 minutes, you’ll want to listen carefully to what I have to tell you.'

Rashmy Chatterjee, a co-author of the report and CEO of ISTARI, said: 'It is self-evident that the impacts of a cyberattack go beyond IT. But, as our research shows, CEOs struggle to know how to lead their organisations’ responses. From these candid conversations, we can better answer what their role should be and fill the gap in what CEOs need to do to build and command cyber resilient organisations.'

The second part of the report synthesises such advice in a playbook for CEOs wanting to build cyber resilience in their enterprises, laying out specific steps CEOs can personally take to anticipate, withstand, respond and adapt to serious cyberattacks. 

Michael Smets, co-author and Professor of Management at Saïd Business School said: 'The fact that all CEOs in our study felt accountable for cybersecurity, but less than a third of them felt comfortable making decisions in that area reveals an alarming gap. To build cyber resilience, CEOs must close that gap. This report offers a first playbook to help CEOs do so.'

Read the CEO Report on Cyber Resilience