Future of risk management: What will it look like in 2023?

In recent years, enterprises have gone through a significant technological metamorphosis. The pandemic, which forced businesses to rethink their risk management policies and encouraged them to implement advanced cloud, security, and risk management technology, is mainly responsible for such significant progress. With the present Ukraine war and the volatile economy foreshadowing an uncertain future, the importance of risk management has continued to rise, with the market predicted to reach USD 4.6 billion by 2026.

Approximately 64% of Indian CIOs emphasise the importance of risk management and cybersecurity and are listed at the top of their security and business plans. However, a new year is drawing near, bringing new opportunities, developments, and risks that businesses must be ready to adapt to and manage. So, let's examine what the risk management industry will look like in 2023.

Internal assessments will take front seat
Cyber invasions have been in the news throughout 2022, with 1.9 million attacks in the healthcare sector, and a 51% increase in ransomware attacks across multiple industries. Companies like Razorpay lost ₹7.3 crores on unauthorised access, Oil India Ltd. paid ₹58 crores in ransom, and tech giants like Amazon, Flipkart, JioMart, and Airtel sold 10 crores of consumer data on exfiltration.

Cybersecurity pitfalls such as poor access controls, inability to segregate data types, and ill-defined responsibilities of security experts expose over 68% of companies to malicious attacks. Thus, finding vulnerabilities in security programs and effective internal investigations will witness a sharp increase in 2023. Deploying real-time risk monitoring platforms will protect sensitive company data, fix security loopholes, and help cyber teams stay informed 24x7.

ERM technology stacks will expand into GRC
Enterprise Risk Management has already extended beyond financial governance and incorporated security, infrastructure, and third-party integrations into its checklist. With 37% of Indian firms experiencing cloud data breaches in the past 12 months, ERM technologies will lean more towards governance risk and compliance (GRC) to assess risk posture, identify compliance gaps, manage incidents and policies, and automate internal audit activities.

All-in-one GRC platforms that integrate intelligent risk analytics combined with the enterprise’s application and infrastructure landscape and monitor security controls will help refine enterprise risk governance strategies. Such platforms will enable enterprises to gain a single-pane view of the complex security ecosystem and offer quick insights into security and compliance posture through intuitive dashboards to help make data-driven security decisions.

SMBs will require robust risk governance strategies
59% of small business owners believe they are too small to be hacked. Consequently, about 43% of cyber attacks target SMBs that do not have a robust risk governance strategy in place. In the past few years, startups like Juspay, Unacademy, Dunzo, and Bigbasket lost over 55 million cumulative records in data breaches.

Unsecured databases and faulty Application Programming Interfaces (APIs) of startups are increasingly getting exposed to cyber criminals, resulting in malware, ransomware, phishing, and more sophisticated invasions.

Security tools that offer deep integrations with commonly-used applications and provide collaborative workflows between teams, auditors, and pen-testers will become inevitable. They will assist cyber teams in managing daily compliance, execute multiple compliance audits simultaneously, and meet the protocols of SOC 2, ISO 27001, FedRamp, CMMC, NIST, and others, along with regulatory requirements from privacy laws like GDPR, HIPAA, PCI DSS, CCPA (to name a few) for efficient risk governance against cyber terrorism.

Cyber risk quantification will become the new standard
With the digital transformation of workflows, boardroom executives are increasingly demanding cyber risk quantification to customise cybersecurity rules and evaluate risks in terms of monetary value. A Gartner 2021 report reveals that 88% of executives consider cybersecurity a business risk that incurs a financial loss and damages brand reputation.

Exhaustive risk assessments will become a priority. Businesses will leverage robust CRQ models to describe highly vulnerable threats and evaluate metrics like risk rating, the time required to combat risk, probability of exposure to identified and unidentified threats, cyber threats capabilities for risk resilience, and damage costs. They will focus more on building unique risk-first infosec programs and demand top-notch support solutions for risk remediation and holistic security services.

Contextualised risk monitoring will steer business operations
Risk management and governance are no more limited to cybersecurity teams. Key business stakeholders such as CIOs, CISOs, and business managers are defining new priorities and risk management mandates to drill-down analytical views and run robust business operations. Over 65% of business executives plan to increase their cybersecurity budgets in 2023, while 52% of the CEOs are committed to driving initiatives to improve risk resilience.

For top business personnel, a unified view of security compliance, 24x7 real-time monitoring of the infrastructure landscape, and complete visibility into cyber assets, vendors, employees, and processes will help simplify cybersecurity. They can seamlessly identify mitigation controls, consolidate data across SaaS applications, code repositories, and IAM policies, and stay updated with the organisation’s risk posture to facilitate a secure business transformation.

Conclusion
2023 will be the year of cyber risk management. On one side, cyber threats will be even more refined with rising online media scams, social engineering attacks, business email phishing attacks, crypto scams, innovative cash-out processes, and Scamming-as-a-Service.

On the other hand, security solutions will evolve with exhaustive internal risk assessments, robust compliance strategies, risk quantification models, and real-time risk monitoring tools. In essence, enterprises will refine risk management programs and deploy market-leading cybersecurity platforms to establish a 360-degree view of the organisational networks and monitor complex, multi-system environments to ensure the end-to-end protection against malicious invasions.

-- Aayush Ghosh Choudhury, CEO and Co-Founder, Scrut Automation.