For years, companies have approached cybersecurity with a familiar question: Are we protected? But Mike Wyatt of Deloitte believes leaders should be asking a different question: When something happens, how quickly can we recover?
That distinction may fundamentally change how businesses think about cybersecurity, particularly as artificial intelligence introduces new capabilities and new risks at remarkable speed.
Wyatt, who leads Deloitte’s cyber practice for its state, local and higher education industry sector, joined me on Bus Huddle at https://www.podbean.com/eas/pb-8n6cu-1b599d0, to talk about cybersecurity, artificial intelligence and what leaders may still be getting wrong. One of his most important observations was also one of the simplest: cybersecurity should no longer be treated primarily as an IT problem. It is an enterprise risk issue. When a cyber event can interrupt operations, affect customers, damage a company’s reputation and threaten its ability to deliver on its mission, responsibility for that risk reaches far beyond the technology department.
That shift in thinking also challenges the way organizations measure whether they are prepared. Companies spend considerable time and resources on cybersecurity compliance. They complete audits, measure controls, document deficiencies and develop plans to address them. Those activities are important, but Wyatt points out that compliance and resilience are not the same thing. Passing an audit doesn’t necessarily tell leadership what will happen when the organization experiences an actual attack.
The more revealing questions are operational. Can the organization detect an attack? How quickly can it contain the problem? Can critical systems be restored? How long will recovery take? Can the organization continue serving customers or constituents while that work is happening? And can it preserve the trust and reputation it spent years building? Those questions move cybersecurity out of a technical discussion and directly into business continuity and enterprise risk.
There is also an uncomfortable reality leaders may need to accept: perfect cybersecurity doesn’t exist. Organizations can invest heavily in prevention and still carry residual risk. Wyatt compared cybersecurity preparedness to taking care of your health. Exercising and eating well can reduce the likelihood of becoming ill, but they cannot guarantee that you will never get sick. What they can do is put you in a stronger position to recover when something happens. Cybersecurity works much the same way. Prevention matters enormously, but organizations also need to invest in detection, containment and recovery.
One of the most interesting parts of our conversation involved identity. When people hear the word “identity,” they may think primarily about employees with usernames and passwords. That definition is quickly becoming outdated. Modern organizations have human identities, machine identities and applications communicating with other applications. Now AI agents are beginning to communicate and operate within organizational environments as well. Each identity potentially represents access, and access
