One of the key challenges for security and risk management leaders when addressing the threat landscape is to convince necessary stakeholders involved in investment decisions. That means building a case, discussing with IT, with operational technology and with business teams about the necessity to shift priorities in response to a specific threat.
Security leaders need to also account for their own business environment and dynamics. They need to prepare for unknown inflection points because these can quickly alter the threat landscape. They should therefore reserve some budget for unknown and unpredictable threats.
Even the most well-funded organisations can’t address all the threats. Responding to the threat landscape is about prioritization. This means simultaneously prioritising known volatile and complex threats and preparing for uncertain and ambiguous threats.
