This means core

Cybersecurity is once again a top priority in the C-suite—as it should be. In an era characterized by disruptive technologies and digital-first operations, CEOs are increasingly, and rightly, sensitive to the fact that strong cyber strategies and controls are fundamental to managing business risk across all domains. This awareness rings clear throughout our 2024 CEO Outlook, which shows that Canadian and Global leaders are making a concerted effort to keep up with—and ideally ahead of—today’s evolving cybersecurity demands.

Cybersecurity was last perceived as a top-three risk to organizational growth in 2020 at the onset of the Covid-19 pandemic, when every organization that could quickly adopted remote work as a matter of public health necessity. This made organizations newly reliant on individual employees’ private systems, leading to an increase in emphasis on cybersecurity awareness and vigilance.

As remote work became the new normal and the challenge posed by varying levels of security controls was sufficiently addressed, cybersecurity faded from CEOs’ attention. Now it’s back: in 2024, the threats to growth that cybercriminals pose are ranked No. 2 and No. 3 among Canadian and Global CEOs, respectively. Unfortunately, only half (52 per cent Canadian and 48 per cent Global) feel “well prepared” to defend their organizations against potential attacks.

For the leaders of Canadian small and medium-sized businesses (SMBs), on the other hand, cyber threats are No. 1, as they were last year. Indeed, KPMG’s Private Enterprise^TM Business Survey reveals that small and medium-sized businesses are currently more cyber-confident than larger organizations. Fully 80 per cent say they are prepared for a cyberattack and 79 per cent are confident their organization’s cybersecurity can keep up with rapid AI advancements.

Several factors can explain this renewed focus on cybersecurity among CEOs.

First, cyber threats are constantly evolving and becoming more sophisticated, putting relentless pressure on organizations to stay one step ahead—or at least not two steps behind. Attackers, after all, have access to the same potentially game-changing technologies as their targets, such as generative AI.

Second is a rise in the involvement of nation-states in large-scale cyberattacks. The challenge here is that once one of these attacks is in the wild, it’s available for other threat actors to exploit. Additionally, because part of warfare has become cyber-based, critical infrastructure can be a target, including for companies seen as aligned with one side of a conflict or the other.

Third is that regulations around data privacy and resilience are evolving in different ways and at different paces around the world. This dynamic only adds to the cost and resource demands on organizations looking to do business beyond their borders.

Other factors are more internal. For example, hybrid workforces have given rise to complex cyber needs and considerations, which may be part of the reason large organizations have been pushing to get people back into the office, where security controls can be more easily managed. At the same time, an insufficient supply of cybersecurity talent and skills has organizations feeling more open to the relative convenience of outsourcing.

Ultimately, concerted cyber investment and preparation is an ongoing imperative. Put another way, constantly having to adapt our cyber strategies to keep up with potential financial, regulatory and reputational consequences is simply what it takes for organizations to ensure resilience.

The advantage will go to those who have the best people. Unfortunately, this remains a struggle for many Canadian organizations. Only 52 per cent of Canadian CEOs (59 per cent Global) say they are confident their organization can access suitable cybersecurity talent and solutions to defend specifically against AI threats. And while the federal government has come to their support with skill-building initiatives, many are still grasping for experienced people to put their plans into action.

All of this is likely to remain a struggle, especially as competition for talent continues across borders. For some, the answer may be to leverage managed services for cyber security and rely on the external skill sets of cybersecurity professionals. For others, it may be to find a balance between that kind of outsourced expertise and their own in-house teams. Whatever the response, the value of skill and experience in delivering a robust cybersecurity program should never be underestimated.

Encouragingly, 73 per cent of Canadian and Global CEOs are increasing investment in cybersecurity to protect their operations and intellectual property. This spending is being allocated across several priorities, from reducing technology debt and meeting rigorous regulatory requirements to enhancing cyber processes and, crucially, both recruiting and upskilling people.

A portion of cybersecurity investments are also being reserved for incoming technologies. Quantum computing, for example, is evolving quickly and may require a whole new approach to fundamental controls, such as encryption.

Whether you are looking to assess your existing cyber strategy and response, align it to your business priorities, develop and/or implement advanced solutions, monitor ongoing risks or help you respond effectively to cyber incidents, KPMG’s team of cybersecurity professionals can help.