Is digital security a market for lemons?

Since the number of security specialists, security hard- and software technology vendors and security service providers have increased over the past decade, we have also experienced a significant increase in security spending. And these security budgets have become an important part of the organizations’ financial planning cycle. Recent predictions indicate that budgets will continue to grow and it’s not clear where it will end.

We think however that the novelty of digital security will wear off at a certain stage and budget pressure will increase. We simply cannot try to empty the ocean with a thimble. To prevent this from happening, staff being responsible for digital security will have to show the added value of their investments but also from themselves. Just as any other business process or department manager within the company.

To shed some historical light and background about our reasoning we first compare Digital Security with regular IT and the IT department, and what has happened to IT, when being unable to show value and being misaligned with the business. After that we will provide some guidance on how to demonstrate “true” value and to make it taste as sweet as cherries.

Business-IT alignment has been an issue since the seventies and is mainly caused by

• lack of collaboration,
• lack of mutual understanding and a
• lack of tangible added value.

To overcome these alignment issues and improve this relationship, multiple Business and IT alignment models have been introduced. Over the last few years, multiple ‘Value of IT” methods have been introduced, including ITIL, focusing on showing value to the business. However, the focus of these models is often on the more generic objective value (ROI, KPIs, SLAs) instead of the subjective value (customer satisfaction score and how people perceive and experience IT). More about that later on.

The main reason for this switch from more process focused to value focused is the result of Boards and Senior Management starting to ask the question “What is the value of IT for the money we spend on it?”. Maybe this is caused by the experience they had in their personal life while consuming IT. What we mean with that is that they experience in their personal life that IT can work smoothly and that iPhones are safe by biometric access, something the IT department never delivered to them. This department of “no” had a sour taste of lemon. But they also experienced budget pressure. The main reason for this budget pressure is that budget holders were unable to judge the value delivered by IT. If you can’t understand or see the benefits of something, you start trying to lower the costs. They simply squeeze the people that do not deliver or truly contribute.

It must be mentioned that budget limitations have currently become less of an issue due to the digitalization trend and Covid. One can however question whether companies spend their money on digitalization out of fear for being the next Kodak or Nokia or whether they actually know the digital value they are getting for their money.

In the book “Discover the IT Cherry” we made a comparison between the 1970 paper “Market for Lemons” of Akerlof and whether IT is a Market for Lemons as well. The paper examines how the quality of goods traded in a market can degrade in the presence of information asymmetry between buyers and sellers, leaving only “lemons” behind^[1]. In the table below the criteria for a lemon market are stated and the parallel with IT organizations is made. The parallel with Digital Security is made based upon our own experience to determine whether Digital Security is also a market for lemons. We consider Digital Security in this case as a whole and not only the security software or services providers.

1. The buyer is unable to fully determine the value and quality of a product before the product is bought. The salesman is aware of this value (asymmetric information).

Parallel with IT organizations:

Business (the consumer) has too little information to determine the actual costs and quality of an IT service. The internal or external IT organization or IT suppliers could or do hold this information. For example, looking at the selection of an outsourcing partner, a comparison between suppliers is hard to make and it is unclear what quality is actually given for the paid price.

Parallel with Digital Security:

Business has too little information to determine the actual costs, benefits and quality of digital security. Although the seller market has increased significantly, it remains difficult to understand the difference between products and services. Decisions are mainly made based upon “can we afford this?” instead of understanding the benefits or ability to determine the value.

The current situation can’t last forever. At a certain stage a company wants to have a sufficient level of security and wants to focus its attention and spend its budgets on things that generate revenue or contribute to business goals. More and more questions will be asked why certain investments in Digital Security must be made and whether security budgets can decrease. This will be the case when security incidents will not occur or will have limited impact. When a board's mindset is “assume the breach” and the focus is on to reduce the blast radius rather than reduce all the blast: that is simply throwing money down the drain. To precede this budget pressure, Digital Security professionals, Tech vendors and Suppliers should now start showing their value.

Showing value of Digital Security might be more difficult than one thinks. Value of Digital Security is more than reporting about the number of vulnerabilities found and remediated, number of security incidents resolved, number of people trained in awareness courses or the number of auditor findings resolved. To understand value, it is a good start to with a definition of value:

This way of showing value is the way most of us learn in management schools via business cases etc. A good way to measure Digital Security value in an objective way is using ROSI (Return on Security Investment). We’ve also talked about that in our Blog. An easy way to increase or keep the same level of benefits but lowering the costs is to start using the software and licenses to the fullest, instead of buying additional software that provides functionality you might already have. We refer to the term technology utilization. During operations it is a good practice to measure the security occurrences and show the impact of newly implemented security measures. Make reporting about benefits and cost effectiveness a part of your daily routine, just as every other manager or director in the company is doing.

Subjective value is all about the perception of the person or group experiencing the security measures or level of security. In this case it becomes important to start managing the perception people have. The perception can be for example “we’re way to secure and not a bank!”, “we’re completely insecure” or “security makes my work so much more inefficient, can’t we shut this down?”.

To manage the perception of the security users and stakeholders (e.g. Board, Regulators) you need to start understanding what their current perception is as well as what their expectation is, since perception is the result of expectation. A well-known rule to manage expectations:

• When you deliver under expectation people are unhappy and want to stop using what you’re “selling”, marketing term for this is cognitive dissonance^[5].
• When you deliver according to expectation people are satisfied, but also still open to other opportunities.
• When you deliver above expectation people are happy and become loyal ambassadors.

The best trick to make people happy is to make sure that the expectations are as low as possible or be an absolute overachiever.

Value for the group is often shown in standard reports made by suppliers or found in public available information. In general, this covers the basic need and is something that is according to expectation. The real value however is in the value for the individual.

Value for the individual is often measured with Customer Satisfaction Scores. You might recognize them from your personal life when you order something online and a week after the delivery you are asked about how happy you are with the product or the service. Often based upon a score from 1 to 10 or with a smiley face. In some cases there is also room for a comment.

In Digital Security we haven’t seen this way of measuring value yet. Within IT we do see Customer Satisfaction scores, but a follow-up of these scores is often limited. While in our experience spending some time on following up this valuable feedback often results in an “above expectation” experience. So customer satisfaction scores can be a valuable instrument to understand the perception of your users and stakeholders about digital security.

Next to customer satisfaction scores we love the empathy factor; This is about understanding the people that have and own the budgets. Understanding what these people find important in Digital Security is to be able to manage their perception or expectations. A recent article by Gartner about “beyond individual passions and concerns”, boards collectively generally care about three things:

• Revenue/mission: Operating or non-operating income and enhancing non-revenue mission objectives
• Cost: Future cost avoidance and immediate decrease in operating expenses
• Risk: Financial, market, regulatory compliance and security, innovation, brand, and reputation^[6]”

These three things are generic statements. So as a Tech leader, Digital Security professional or/and CISO, understanding the budget-holder’s needs, agenda, desires and what’s important to them, understand what’s important for the company, understand the strategy and mission of the company, etc, is very important. Demonstrate sincere empathy.

The hard part about value is the part that is subjective and for the individual. What’s important for one person might not be important to someone else. As a result, decisions are not always made based upon rationality. When people don’t understand, trust or like you or the idea, they tend to decide to go for a different direction which will leave you in confusion. One thing that can support you in these irrational processes is the use of collaborative technologies that facilitate interaction between business and professionals in certain domains (e.g. business or security) like Group Support Systems^[7] in which you can brainstorm collectively on viewpoints, opinions and novelties. Then categorize them into what is important to a certain group or individual. Make the opinions of the group more tangible, explicate them and collectively discuss them and deal with them in a more rational manner. In the end however, you still need to understand the “environment”, since not every organization has the same context, and experiment a bit with what is valuable for the different stakeholders.

For example, start measuring customer satisfaction scores about a specific security solution or experiment with ROSI on individual investment scenarios or a complete portfolio and thereby demonstrate the true value of investments. Asking the help of somebody outside of IT helps you understand the opposite position and cross the gap between IT & Digital security to the business. All of this is to prepare our profession for the year 2025.

Are you interested in these topics and want to learn more? These topics are part of our Master in IT Management, Master in Risk & Cyber Security Management and Master in IT Governance and Assurance.

^Bronnen:

^[1] Akerlof, George A. (1970). “The Market for ‘Lemons’: Quality Uncertainty and the Market Mechanism”. Quarterly Journal of Economics. The MIT Press (zie ook: https://en.wikipedia.org/wiki/The_Market_for_Lemons)

^[2] Onderzoeksrapport cybersecurity technology efficacy, Is cybersecurity the new “market for lemons”?, October 2020, Debate Security

^[3] HACCP is een managementsysteem waarin voedselveiligheid wordt aangepakt door middel van de analyse en beheersing van biologische, chemische en fysieke gevaren vanaf de productie van grondstoffen, inkoop en behandeling, tot de productie, distributie en consumptie van het eindproduct.

^[4] Mark Butterhoff, Barry Derksen, Aart van der Vlist. “Discover the IT Cherry – How to become the most valued IT organization by using cherries”

^[5] Cognitieve dissonantie verwijst naar een situatie met tegenstrijdige houdingen, overtuigingen of gedragingen. Dit veroorzaakt een gevoel van mentaal ongemak dat leidt tot een verandering in een van de houdingen, overtuigingen of gedragingen om het ongemak te verminderen en het evenwicht te herstellen.

^[6] https://www.gartner.com/smarterwithgartner/5-security-questions-board-will-definitely-ask/

^[7] Bobbert & Mulder (2016) on GSS in Digitale Security in ISACA Journal (https://www.isaca.org/resources/isaca-journal/issues/2016/volume-5/boardroom-dynamics-group-support-for-the-boards-involvement-in-a-smart-security-decisionmaking-proce)

https://managementboek.nl/boek/9789090335131/leading-in-digital-security-yuri-bobbert