Half of chief information security officers will adopt human-centric design to reduce cybersecurity operational friction, while large enterprises will focus on implementing zero-trust programs.
“There’s no question that CISOs and their teams must be laser focused on what’s happening today to ensure their organisations are as secure as possible,” Addiscott says. “But they also need to make time to look up from their daily challenges and scan the horizon to see what’s coming down the track that might impact their security programs in the next couple of years.
Gartner research shows that over 90% of employees who admitted undertaking a range of unsecure actions during work activities knew that their actions would increase risk to the organisation but did so anyway. Human-centric security design is modeled with the individual — not technology, threat or location – as the focus of control design and implementation to minimise friction.
The CISO role and purview of responsibility is shifting from being control owners to risk decision facilitators. Reframing the cybersecurity operating model is key to the changes coming. Gartner recommends thinking beyond technology and automation to deeply engage with employees to influence decision making and ensure they have appropriate knowledge to do in an informed way.