--- title: How do CISOs get the executive to ‘buy in’ to cyber security? description: Recent data from Palo Alto’s Networks Unit 42 report shows almost all cyber events from recent survey respondents are attributed to six attack sources. image: https://www.enablis.com.au/hubfs/blog%20image%20Jan%2024.jpg --- ![icon-13](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/icon-13.svg) Sydney: [02 8272 4000](tel:0282724000) Support: [1300 887 664](tel:1300887664) ![icon-14](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/icon-14.svg) [info@enablis.com.au](mailto:info@enablis.com.au) [![Enablis](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/Enablis.svg) ](https://www.enablis.com.au/) [ Speak to Us ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLLSvCizWf2Jw2xZi451VjL9LuqA8ueRgrW8adMpNCRQ4FlXntI4wpoe4APcWv22cBL4FcYji%2FxdbPqoyQEZnvbrJbJBlKMkUdgv%2FtQb8GZS3421foxyvO6Zm27LQf6roWNvH5FNakVdn6jRQZwh5VAkWuFrmLxRIxSqDyazFPD68YRKUlv3bIvFp1Ub%2B1o%3D&portalId=19555244) [ Customer Portal ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLLUGT52GqIj5S0ix9r0QkzyIyKDl376cyN4VHq1qpoFJ5wM9A0mF8wkaI8WwkBIUNuvPVLb5VnWkvQjGfthSmmG%2Fbi2N8rDZTpbnHIlTwVh044Dj659iiJMf31OLt0Lg9g3Z9h0Zbe05Ap7B3AfLIEFQoApuR1%2F7LLmLygtpy3nSoVo77%2FLbl304QPZMkkQ6X5A22niwhKXAdSu&portalId=19555244) - [ About Us ](https://www.enablis.com.au/about-us) ![ENA-2025.01-1-11_Website_Homepage_v5_FA2-02](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/ENA-2025.01-1-11_Website_Homepage_v5_FA2-02.svg) [ Our Team ](https://www.enablis.com.au/about-us#team) ![ENA-2025.01-1-11_Website_Homepage_v5_FA2-03](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/ENA-2025.01-1-11_Website_Homepage_v5_FA2-03.svg) [ Case Studies ](https://www.enablis.com.au/case-studies) ![ENA-2025.01-1-11_Website_Homepage_v5_FA2-04](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/ENA-2025.01-1-11_Website_Homepage_v5_FA2-04.svg) [ Partners ](https://www.enablis.com.au/about-us/partners) ![icon-contactus](https://www.enablis.com.au/hubfs/Enablis_May2021/images/icon-contactus.svg) [ Contact us ](https://www.enablis.com.au/about-us/contact) - [ Connectivity ](https://www.enablis.com.au/solutions/connectivity) [ Security ](https://www.enablis.com.au/solutions/security) - [ Managed Services ](https://www.enablis.com.au/managed-services-ensure) [ Professional Services ](https://www.enablis.com.au/services/professional-services) - [ Our Blog ](https://www.enablis.com.au/our-blog) [ Knowledge Centre ](https://www.enablis.com.au/knowledge-centre) # Our Blog Stay up-to-date with the latest communications, technology and security insights. 09 Jan 2024 [It security, ](https://www.enablis.com.au/our-blog/tag/it-security) [Sase, ](https://www.enablis.com.au/our-blog/tag/sase) [Network security, ](https://www.enablis.com.au/our-blog/tag/network-security) [Security strategy, ](https://www.enablis.com.au/our-blog/tag/security-strategy) [#zerotrust, ](https://www.enablis.com.au/our-blog/tag/zerotrust) [#cybersecurity, ](https://www.enablis.com.au/our-blog/tag/cybersecurity) [#zerotrustnetworkaccess, ](https://www.enablis.com.au/our-blog/tag/zerotrustnetworkaccess) [Palo alto networks](https://www.enablis.com.au/our-blog/tag/palo-alto-networks) ## How do CISOs get the executive to ‘buy in’ to cyber security? As cyber security cements its place top of the list of critical priorities for CEOs and the board these days, CISOs need to get better at explaining what they and their teams are doing in simple terms and the broader implications for the business to get the support they need. A good place to start is trying to imagine what questions business leaders might naturally have to improve their understanding of the current threat landscape and how to respond to it. **For instance, where are these attacks coming from?** According to recent data from Palo Alto Networks cyber research division, Unit 42, almost all cyber events reported by survey respondents could be attributed to just *six *attack sources: - Phishing (37%) - Software vulnerabilities (31%) - Brute force credentials (9%) - Previously compromised credentials (6%) - Insider threat (5%) - Social engineering (5%) Interesting numbers, however, to the uneducated they can be misleading. While ‘insider threats’ make up just 5 percent, they can account for vastly greater damage and loss due to the unique access that staff and other trusted people are typically granted. Within this category, the so-called ‘disgruntled worker’ poses amongst the greatest cyber threat facing any organisation, motivated as they are by revenge, coupled with detailed knowledge about how to inflict the most pain and / or obtain the greatest reward. Many CISOs are now working more closely with departments like HR to develop so-called behavioural analytics to pay closer attention, say when an employee is passed over for a promotion. HR is also expected to work more closely with CISOs and the tech team to ensure access privileges are revoked when staff leave, and this is something that business leaders need to be alert to and support. Phishing attacks on the other hand are relatively easy to launch, especially at scale. And of course, most CEOs and board members understand what these sorts of attacks entail, and the importance of improving education to prevent staff from falling victim. If we look at the next most common source of attack ‘software vulnerabilities’, this is something that senior business leaders need to know more about, given that TAs seem to be finding and exploiting them faster, often with disastrous effects. Unit 42 reports that a whopping 1 in 3 cyber breaches stem from inadequate patch management, and that TAs take a mere 15 minutes on average to develop payloads that attack CVEs (common vulnerabilities and exposures). **Does your cyber plan look ‘ROSI’?** ‘Return on security investment’ or ROSI is emerging as an important area of discussion amongst CISOs and their colleagues in the executive team as the costs of cybersecurity-related activities continues to rise. Of course, demonstrating ROSI is no easy task and remains very much a work in progress because we’re talking about measuring the value of preventing something from happening. A good place to start is providing the executive with detailed documentation along with a clear plan that identifies an organisation’s critical assets or ‘crown jewels’. A key part of this involves creating scenarios that run through the circumstances that might lead to such assets being compromised and what it would mean for the business, staff and stakeholders. Unit 42 reports that it’s often a missing piece in between creating a critical asset inventory and getting business buy-in for that inventory. They recommend presenting the board with a ‘value at risk assessment’ outlining what it would cost, for example, if an asset got compromised by a competitor. It’s also important that the executive understands what their ‘jewels’ are, which assets TAs are most interested in. Unit 42 further notes that the current top 5 are: 1. IP 2. Source code 3. Sales pipeline 4. Marketing materials 5. Commercially Sensitive Data Looking again at patching metrics, typically, CISOs will report on the number of patches deployed in a given period. But might it be better to take the number of ‘critical’ patches verses remaining patches and to then report on the estimated time to complete everything, with the ‘actual’ time to report revealed in the next reporting period? This is likely to resonate more strongly with business or ‘non-security’ leaders. Spiralling patch management costs might also help CISOs and other tech leaders make the case for the retirement of technical debt, especially as legacy systems attract more scrutiny from government and regulators tasked with addressing cyber threats. Ideally CISOs and their teams should involve the executive and wider business in the design and execution of ‘fire drills’ or TTX (table top exercises) to develop ‘muscle memory’ and to analyse and refine how everyone would respond in the event of a cyber-attack targeting these or other assets. Initiating procedures like this helps to reinforce the reality of cyber risk today for the executive and wider organisation. This all costs money of course, but if CISOs are able to compare this investment with the costs of doing nothing, then it’s more likely they will get the financial and organisational support they need. **[Download](https://www.enablis.com.au/hubfs/5-security-concerns-for-cisos.pdf) the Report titled: 5 Security Concerns for CISOs and How to Address Them: [here](https://www.enablis.com.au/hubfs/5-security-concerns-for-cisos.pdf)** or if you would like to discuss your security requirements to ensure your data and staff are protected[ email here](mailto:belinda.johnson@enablis.com.au) to get in contact with one of Enablis’ security experts. [ Share ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.enablis.com.au%2Four-blog%2Fhow-do-cisos-get-the-executive-to-buy-in-to-cyber-security) [Next](https://www.enablis.com.au/our-blog/theres-2024-cyber-security-trends-and-then-theres-sase) ### Categories Pick a category - [Network Security (49)](https://www.enablis.com.au/our-blog/tag/network-security) - [IT security (46)](https://www.enablis.com.au/our-blog/tag/it-security) - [SASE (45)](https://www.enablis.com.au/our-blog/tag/sase) - [#cybersecurity (37)](https://www.enablis.com.au/our-blog/tag/cybersecurity) - [#zerotrust (34)](https://www.enablis.com.au/our-blog/tag/zerotrust) - [security strategy (34)](https://www.enablis.com.au/our-blog/tag/security-strategy) - [#Zerotrustnetworkaccess (28)](https://www.enablis.com.au/our-blog/tag/zerotrustnetworkaccess) - [managed service providers in Australia (26)](https://www.enablis.com.au/our-blog/tag/managed-service-providers-in-australia) - [security (25)](https://www.enablis.com.au/our-blog/tag/security) - [Palo Alto Networks (23)](https://www.enablis.com.au/our-blog/tag/palo-alto-networks) - [cloud (19)](https://www.enablis.com.au/our-blog/tag/cloud) - [enablis (18)](https://www.enablis.com.au/our-blog/tag/enablis) - [Network (16)](https://www.enablis.com.au/our-blog/tag/network) - [Enterprise Browser (9)](https://www.enablis.com.au/our-blog/tag/enterprise-browser) - [Not for profit (9)](https://www.enablis.com.au/our-blog/tag/not-for-profit) - [#ZTNA (8)](https://www.enablis.com.au/our-blog/tag/ztna) - [protect (8)](https://www.enablis.com.au/our-blog/tag/protect) - [Identity Management (6)](https://www.enablis.com.au/our-blog/tag/identity-management) - [communications (6)](https://www.enablis.com.au/our-blog/tag/communications) - [donate (6)](https://www.enablis.com.au/our-blog/tag/donate) - [#cybersecurityfail (5)](https://www.enablis.com.au/our-blog/tag/cybersecurityfail) - [Charity (5)](https://www.enablis.com.au/our-blog/tag/charity) - [IT Partner (5)](https://www.enablis.com.au/our-blog/tag/it-partner) - [MS teams voice (5)](https://www.enablis.com.au/our-blog/tag/ms-teams-voice) - [Managed Service Provider (5)](https://www.enablis.com.au/our-blog/tag/managed-service-provider) - [Youth (5)](https://www.enablis.com.au/our-blog/tag/youth) - [collaboration (5)](https://www.enablis.com.au/our-blog/tag/collaboration) - [communication (5)](https://www.enablis.com.au/our-blog/tag/communication) - [digital transformation (5)](https://www.enablis.com.au/our-blog/tag/digital-transformation) - [networking security (5)](https://www.enablis.com.au/our-blog/tag/networking-security) - [social responsibility (5)](https://www.enablis.com.au/our-blog/tag/social-responsibility) - [technology (5)](https://www.enablis.com.au/our-blog/tag/technology) - [video conferencing (5)](https://www.enablis.com.au/our-blog/tag/video-conferencing) - [volunteers (5)](https://www.enablis.com.au/our-blog/tag/volunteers) - [Community Services (4)](https://www.enablis.com.au/our-blog/tag/community-services) - [Information Technology (4)](https://www.enablis.com.au/our-blog/tag/information-technology) - [calling (4)](https://www.enablis.com.au/our-blog/tag/calling) - [managed service (4)](https://www.enablis.com.au/our-blog/tag/managed-service) - [IT (3)](https://www.enablis.com.au/our-blog/tag/it) - [Legacy systems (3)](https://www.enablis.com.au/our-blog/tag/legacy-systems) - [Mimecast (3)](https://www.enablis.com.au/our-blog/tag/mimecast) - [The Benevolent Society (3)](https://www.enablis.com.au/our-blog/tag/the-benevolent-society) - [email security (3)](https://www.enablis.com.au/our-blog/tag/email-security) - [multiple IP telephony platforms (3)](https://www.enablis.com.au/our-blog/tag/multiple-ip-telephony-platforms) - [network security. cloud computing (3)](https://www.enablis.com.au/our-blog/tag/network-security-cloud-computing) - [AI (2)](https://www.enablis.com.au/our-blog/tag/ai) - [IDAAS (2)](https://www.enablis.com.au/our-blog/tag/idaas) - [NFP (2)](https://www.enablis.com.au/our-blog/tag/nfp) - [Okta (2)](https://www.enablis.com.au/our-blog/tag/okta) - [Palo Alto (2)](https://www.enablis.com.au/our-blog/tag/palo-alto) - [attack (2)](https://www.enablis.com.au/our-blog/tag/attack) - [business technology (2)](https://www.enablis.com.au/our-blog/tag/business-technology) - [customers (2)](https://www.enablis.com.au/our-blog/tag/customers) - [employees (2)](https://www.enablis.com.au/our-blog/tag/employees) - [hackers (2)](https://www.enablis.com.au/our-blog/tag/hackers) - [identity (2)](https://www.enablis.com.au/our-blog/tag/identity) - [leadership (2)](https://www.enablis.com.au/our-blog/tag/leadership) - [networks (2)](https://www.enablis.com.au/our-blog/tag/networks) - [secure browser (2)](https://www.enablis.com.au/our-blog/tag/secure-browser) - [4 steps (1)](https://www.enablis.com.au/our-blog/tag/4-steps) - [Aged Care (1)](https://www.enablis.com.au/our-blog/tag/aged-care) - [Australia Malware (1)](https://www.enablis.com.au/our-blog/tag/australia-malware) - [Crowdstrike (1)](https://www.enablis.com.au/our-blog/tag/crowdstrike) - [Disruption (1)](https://www.enablis.com.au/our-blog/tag/disruption) - [IT Budget (1)](https://www.enablis.com.au/our-blog/tag/it-budget) - [IT Challenges (1)](https://www.enablis.com.au/our-blog/tag/it-challenges) - [IT Director (1)](https://www.enablis.com.au/our-blog/tag/it-director) - [IT Services Provider (1)](https://www.enablis.com.au/our-blog/tag/it-services-provider) - [IT consolidation (1)](https://www.enablis.com.au/our-blog/tag/it-consolidation) - [IVE (1)](https://www.enablis.com.au/our-blog/tag/ive) - [MSP (1)](https://www.enablis.com.au/our-blog/tag/msp) - [Management (1)](https://www.enablis.com.au/our-blog/tag/management) - [NBN (1)](https://www.enablis.com.au/our-blog/tag/nbn) - [NFP's (1)](https://www.enablis.com.au/our-blog/tag/nfps) - [Race4Change (1)](https://www.enablis.com.au/our-blog/tag/race4change) - [SD-WAN (1)](https://www.enablis.com.au/our-blog/tag/sd-wan) - [Security Partner (1)](https://www.enablis.com.au/our-blog/tag/security-partner) - [Shadow IT (1)](https://www.enablis.com.au/our-blog/tag/shadow-it) - [Strategic IT (1)](https://www.enablis.com.au/our-blog/tag/strategic-it) - [Sydney (1)](https://www.enablis.com.au/our-blog/tag/sydney) - [The Y NSW (1)](https://www.enablis.com.au/our-blog/tag/the-y-nsw) - [Wearables (1)](https://www.enablis.com.au/our-blog/tag/wearables) - [Z Scaler (1)](https://www.enablis.com.au/our-blog/tag/z-scaler) - [aged care partner (1)](https://www.enablis.com.au/our-blog/tag/aged-care-partner) - [aged care technology provider (1)](https://www.enablis.com.au/our-blog/tag/aged-care-technology-provider) - [amalgamation (1)](https://www.enablis.com.au/our-blog/tag/amalgamation) - [connectivity (1)](https://www.enablis.com.au/our-blog/tag/connectivity) - [csr (1)](https://www.enablis.com.au/our-blog/tag/csr) - [cutting edge technology (1)](https://www.enablis.com.au/our-blog/tag/cutting-edge-technology) - [data (1)](https://www.enablis.com.au/our-blog/tag/data) - [ivy (1)](https://www.enablis.com.au/our-blog/tag/ivy) - [kitchen (1)](https://www.enablis.com.au/our-blog/tag/kitchen) - [malware (1)](https://www.enablis.com.au/our-blog/tag/malware) - [merger (1)](https://www.enablis.com.au/our-blog/tag/merger) - [mid size business (1)](https://www.enablis.com.au/our-blog/tag/mid-size-business) - [middle size business (1)](https://www.enablis.com.au/our-blog/tag/middle-size-business) - [mobility (1)](https://www.enablis.com.au/our-blog/tag/mobility) - [network infrastructure (1)](https://www.enablis.com.au/our-blog/tag/network-infrastructure) - [new technology (1)](https://www.enablis.com.au/our-blog/tag/new-technology) - [obk (1)](https://www.enablis.com.au/our-blog/tag/obk) - [optimal strategy (1)](https://www.enablis.com.au/our-blog/tag/optimal-strategy) - [outsourcing IT (1)](https://www.enablis.com.au/our-blog/tag/outsourcing-it) - [people with disability (1)](https://www.enablis.com.au/our-blog/tag/people-with-disability) - [race for change (1)](https://www.enablis.com.au/our-blog/tag/race-for-change) - [ransomware (1)](https://www.enablis.com.au/our-blog/tag/ransomware) - [strategy (1)](https://www.enablis.com.au/our-blog/tag/strategy) - [top managed service providers in sydney (1)](https://www.enablis.com.au/our-blog/tag/top-managed-service-providers-in-sydney) - [voice (1)](https://www.enablis.com.au/our-blog/tag/voice) - [zscaler (1)](https://www.enablis.com.au/our-blog/tag/zscaler) ### Recent Posts - [ The AI Threat Shift Is Accelerating: The 3 things Organisations Need to Know Now ](https://www.enablis.com.au/our-blog/the-ai-threat-shift-is-accelerating-what-organisations-need-to-know-now) - [ Your business runs on the browser. Your security model doesn’t. ](https://www.enablis.com.au/our-blog/your-business-runs-on-the-browser.-your-security-model-doesnt) - [ Stride Outside This September with Stride Mental Health and Enablis ](https://www.enablis.com.au/our-blog/stride-outside-this-september-with-stride-mental-health-and-enablis) - [ The Role of Enterprise Browsers in a SASE Framework ](https://www.enablis.com.au/our-blog/the-critical-role-of-enterprise-browsers-in-a-sase-framework) - [ Gartner names Palo Alto Networks Leader in 2025 EPP Magic Quadrant Report ](https://www.enablis.com.au/our-blog/gartner-names-palo-alto-networks-leader-in-epp-magic-quadrant-report) [Next](https://www.enablis.com.au/our-blog/top-5-challenges-facing-cisos-today) #### Stay ahead in a connected world Get expert insights on connectivity and cybersecurity. Subscribe to the Enablis blog today. [![logo white](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/logoo%20white.svg) ](https://www.enablis.com.au/) Keeping your business connected, protected and ready for what's next. [![icon-13](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/icon-13.svg) ](tel:+610282724000) [ +61 (02) 8272 4000 ](tel:+610282724000) [![icon-14](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/icon-14.svg) ](mailto:info@enablis.com.au) [ info@enablis.com.au ](mailto:info@enablis.com.au) [![icon-16](https://www.enablis.com.au/hubfs/Enablis%20-%202025/Images/icon-16.svg) ](https://maps.app.goo.gl/rdnkT6SLgt1vLHRPA) [ Level 3, 16 Spring Street, Sydney, NSW, 2000 ](https://maps.app.goo.gl/rdnkT6SLgt1vLHRPA) Follow Us ###### [Connectivity](https://www.enablis.com.au/solutions/connectivity) ###### [Security](https://www.enablis.com.au/solutions/security) ###### Services ###### About Us © 2026 Enablis Pty Ltd. All rights reserved. [ Privacy Policy ](https://www.enablis.com.au/our-blog/how-do-cisos-get-the-executive-to-buy-in-to-cyber-security#popup) ## Privacy Policy of Enablis ###### Why do we have a Privacy Policy? Enablis may hold and use information about you in your capacity as a consumer, a business customer, or in any other capacity. If you are visiting any of our websites or using any our services, by continuing to do so, you indicate your agreement to our use of your personal information as set out in this Privacy Policy. Your privacy is important to us. We want you to feel confident about the personal information we hold about you. Enablis takes your privacy seriously and takes all reasonable care to prevent any unauthorised access to your personal information. Enablis is committed to dealing with personal data in the spirit of the Data Protection Act 1998 (“the Act”) and protecting personal privacy in accordance with the law. ###### What does this Privacy Policy cover? This Privacy Policy only applies to how Enablis deals with your personal information. Third party websites that you can link to from Enablis’ websites are not covered by our Privacy Policy and we accept no responsibility or liability for these sites. We recommend that you check the privacy policy of any site you visit. ###### What information do we collect, and when do we collect it? In general, you can visit Enablis websites without giving us any personal information. We collect general information about visitors to our websites, to help us improve our websites and services. This includes how many visitors there are to our sites and how long they view each page. In certain circumstances we may ask for personal information about you. These include if you enter any of our competitions or promotions, subscribe to one of our services, request an audit, complete a survey, submit and enquiry or register for one of our events. We may ask you for information to enable us to provide a service to you. We collect this information in a number of ways, including via telephone, written correspondence, email and websites. If we provide a service to you, we may have information about your use of that service. ###### Cookies Enablis may use cookies to collect information from visitors to our websites. Cookies may contain personal information. A cookie is a text file which saved onto your computer when you visit a website. Your browser may allow you to choose whether to accept cookies or not, and if you choose to accept cookies, you may be able to allow different levels of acceptance. ###### Other technologies Enablis may use other technologies on our websites and in e-mail communications to determine, for example, how many visitors have visited certain pages, opened messages or clicked on links. ###### What do we do with the information we collect? We use the personal information we collect to help personalize your online experience, as well as for administration and marketing purposes. - We are obliged to do so by law; or - With your consent; or - Where necessary to provide the products and services chosen by you; or - In the event that we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets; or - If Enablis or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets. ###### Your ability to opt out You can opt out of all Marketing communications by contacting our Marketing team on telephone 02 8272 4000 or via email through our website contact page. ###### Contact Us If you have any questions or concerns about the information we hold about you and how we use it, please contact our Marketing team on telephone 02 8272 4000 or via email through our website contact page. ###### Changes to This Privacy Policy We reserve the right to change the terms of this Privacy Policy at any time. When we make changes, we shall update the version number of the policy and publish the latest policy on our websites. We encourage you to review this policy whenever you visit one of our sites. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Enablis", "url" : "https://www.enablis.com.au/our-blog/author/enablis" }, "dateModified" : "2025-06-27T13:28:22.288Z", "datePublished" : "2024-01-09T04:49:15.000Z", "headline" : "How do CISOs get the executive to ‘buy in’ to cyber security?", "image" : [ "https://www.enablis.com.au/hubfs/blog%20image%20Jan%2024.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.enablis.com.au/our-blog/how-do-cisos-get-the-executive-to-buy-in-to-cyber-security", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.enablis.com.au/hubfs/Imported%20sitepage%20images/logo-new.png" }, "name" : "Enablis PTY LTD" } } ```