Beyond the Dashboard: Turning Cyber Data Into Risk Insights

00:00:02 The IIA

The Institute of Internal Auditors presents All Things Internal Audit Tech. In this episode, PWC's Tanya Yugoritz and Amanda Herron discuss how organizations can move beyond cybersecurity dashboards to turn data into meaningful risk insights and assurance. They discuss the importance of aligning cyber metrics with business risks,

00:00:23 The IIA

strengthening collaboration across the three lines model, and using continuous monitoring to identify emerging threats. The conversation also covers cyber resilience, evolving responsibility for cybersecurity, and how artificial intelligence is reshaping both cyber threats and internal audit's approach to assurance.

00:00:44 Amanda Herron

So Tonya, I'm very excited to be with you here today for all things internal audit.

00:00:49 Amanda Herron

As our US internal audit leader, this is my jam and this is going to be fun. I'm going to learn a lot here from you about cybersecurity. So I'm excited to jump in.

00:00:59 The IIA

Great.

00:01:00 Tonya Ugoretz

I'm sure I'm going to learn a lot from you as well.

00:01:02 Amanda Herron

Excellent. Let's go ahead and start the conversation. Would love to hear from you in terms of organizations. We're seeing so much cyber data. There's a lot of continuous monitoring happening. There's a lot of reporting.

00:01:17 Amanda Herron

Do you think that gives leaders greater confidence that cyber risk is being managed effectively with this volume of information coming at them?

00:01:26 Tonya Ugoretz

Honestly, not always. I mean, it's certainly helpful to have more data and

00:01:32 Tonya Ugoretz

I think it's helpful that cyber has now been elevated out of just, I think, where it was previously in an IT silo to be seen as more of a business-wide risk. But having more data doesn't always translate into insights that are decision-ready. And I think that's the real difference that we see. And we actually see this reflected in some of the surveys that we've done

00:01:58 Tonya Ugoretz

of business leaders and board directors. So for example, there's an annual survey of corporate directors, and this year it found that 82% of board members see opportunities for improvement in the materials that are provided for them. And they're specifically looking for not just data, but better synthesis of key issues to enable them to have more of a strategic discussion and more forward-looking insights.

00:02:28 Tonya Ugoretz

So in that context, I think when you're looking at a whole lot of data, you want to make sure that you are using that data to surface the right things. So imagine, for example, a report to the board that says

00:02:42 Tonya Ugoretz

We've patched thousands of vulnerabilities this quarter. That's great, but that's reflecting activity rather than an outcome. And it doesn't really tell me as a director whether the vulnerabilities that were patched were the right ones. Were they the weaknesses that an attacker would be most likely to exploit if they did exploit it? Are they the weaknesses that would have the most impact on the business? And it doesn't really tell me, is the company more secure as a result?

00:03:12 Tonya Ugoretz

of all that activity. So instead, think about we reduce the time that our most critical weaknesses stay open to attackers from a week to about a day. That's more of an outcome metric that tells you something about the direction in which your risk is moving. And I think this really matters all the more now because the stakes have gone up. We've seen

00:03:39 Tonya Ugoretz

new frontier models coming online that are enabling cyber threat actors to identify and exploit weaknesses, vulnerabilities at a scope and scale that was previously unimaginable. And when you layer that on top of geopolitical risk and how that has the potential to affect companies, I think the importance is only greater to make sure that we're not just talking about numbers, but deriving insights from them so that we see if a company is actually

00:04:09 Tonya Ugoretz

becoming more secure. But I'm curious from your perspective, I mean, what do you see as the difference between having more visibility and having more assurance?

00:04:21 Amanda Herron

Yeah, I completely agree with you. And I'll tell you the story of a tale of two internal audit experiences that I've had that really bring it to life for me. So the first one, I worked with a company as their outsourced head of internal audit.

00:04:37 Amanda Herron

and had just come on board. And I saw the CISO just absolutely bury the audit committee with technical data and information. And he really thought he was doing a great job, that he was providing lots of transparency to the audit committee. And then when I had a one-on-one with the audit committee chair, he said, hey, really need your help.

00:05:00 Amanda Herron

to decipher what all of this information means and to build a taxonomy and a scorecard that really gives the audit committee a view into risk instead of just technology talk and metrics. And it took a long time to get to the language that everyone could understand and get around and that was oriented back to risk, but it was a really, really meaningful journey. And I think that CISO learned a lot about communication and about risk through the process.

00:05:30 Amanda Herron

And I juxtapose that with a company that I'm working with today. They have a concerted 3 lines model for cybersecurity specifically. And the whole company is aligned on cyber as one of the most critical risks, if not the most.

00:05:44 Amanda Herron

The CIO, CISO, and head of internal audit meet regularly to go through their cyber risk metrics, their audit results, their third party assessments, threat intelligence, et cetera, and really anchor that back to risk. And they provide a very cohesive picture to the board at each audit committee. They all present together. They talk about the risks. They talk about what each has done relative to the risks, the progress that they're making around those key risk indicators and their impacts.

00:06:13 Amanda Herron

and then how audit has provide assurance around that data. So I do think, greater visibility can support assurance, but it really doesn't provide assurance on its own.

00:06:26 Amanda Herron

Better reporting can really provide more timely insight into how cyber is operating, but internal audit still needs to make sure that information is complete, reliable, and connected to the risks that matter. That is really, I'd say, one of the most critical takeaways here from this podcast, if anything.

00:06:46 Amanda Herron

And the question that internal audit should be asking is, as you pointed out, Tanya, it's not just an internal audit question. It's really an enterprise risk question. What is the risk? And when I think about cyber at different organizations, within a retail environment, it might be stolen customer data. In a power company, it might be an outage that can impact livelihoods.

00:07:10 Amanda Herron

you really have to get to what are we trying to prevent, detect, remediate in a timely manner and prevent from happening within the organization and provide the right layers of defense in order to support that. And how do you really prove that out on a continuous basis? We just put out a new white paper, which I'm really excited about. It's called the New Internal Audit Moving Beyond Traditional Constraints.

00:07:37 Amanda Herron

Really at the heart of it, it's about how monitoring and automation can increase the volume of findings, but the harder task is deciding what matters and really using our auditor judgment to have a good discussion with the organization and with boards about what can realistically be addressed within the organization based on that risk profile.

00:08:03 Amanda Herron

So I think Tanya was saying we're two sides of the same coin here in terms of what we're talking about. And I'd love to hear more from you. If we've seen a lot of cybersecurity dashboards, especially being presented to audit committees and boards of directors lately, how do you think organizations should determine which cyber risks and metrics really matter?

00:08:25 Amanda Herron

and go beyond the dashboard.

00:08:29 Tonya Ugoretz

and I love the examples you gave, by the way, and especially the idea of leaders presenting together, because I think that just reinforces that cyber shouldn't be thought of as its own silo of risk anymore. It truly spans across the business. But I think you're right that I think what we're both saying is that the takeaway here isn't to not use dashboards. It's just that they need context. And so

00:08:54 Tonya Ugoretz

When we think about which risks and metrics really matter, I would flip the script in terms of not starting necessarily with the numbers, but starting with the business. Because as you've said, really the risk needs to be understood in the context of the organization. I think there's some fundamental cyber risk metrics that probably every organization should track.

00:09:20 Tonya Ugoretz

based on the types of risks that we're seeing. So how identity access is managed, how vulnerabilities are handled, how third parties and end parties are treated, and response and readiness. But within that, I think deciding which metrics deserve the most attention

00:09:40 Tonya Ugoretz

And thinking about that against what to that particular business constitutes an acceptable or unacceptable level of risk is really important. And here's where, based on my background, my former life as a leader of intelligence in the FBI, I would bring threat intelligence into the equation because one thing that experience taught me is the importance of understanding the surrounding environment, that businesses aren't looking at these metrics in a vacuum. They're trying

00:10:10 Tonya Ugoretz

to understand what their exposure is to the threats that are out there. And that will help determine what risks they focus on. So for example, two companies might have similar vulnerabilities, but they may have very different exposure depending on who's targeting them and what those actors are trying to accomplish, just looking at some of those external threat variables.

00:10:36 Tonya Ugoretz

And then I would think about prioritizing the risks that have the greatest potential consequences to the business. So considering the likelihood and the potential impact of different scenarios, including, for example, operational disruption, data theft, financial loss, third party compromise, whatever metrics are chosen should help leadership understand their exposure to those scenarios. And then

00:11:03 Tonya Ugoretz

looking at it in context. So not everything is equal. A vulnerability that's on an isolated system is going to be looked at differently from the same vulnerability on a critical internet-facing system. I think we saw this just this past week with the news about the internet-facing refrigeration systems in France that were hacked

00:11:26 Tonya Ugoretz

and where the attackers were able to raise the temperature level to a point that all of the food items within the refrigeration system spoiled. Businesses should be making conscious decisions about what's exposed to the internet, whether it really needs to be, and if it does, how are they managing that exposure and putting appropriate security controls around that. So the bottom line here is that

00:11:55 Tonya Ugoretz

There's no one size fits all in terms of which metrics to focus on. I think the important thing is tailoring it to where a particular company sits. From your perspective, where do you think internal audit comes into that risk conversation?

00:12:13 Amanda Herron

Yeah, definitely at the beginning, I would say it is a risk conversation before it's an assurance conversation and understanding

00:12:22 Amanda Herron

the risk environment is so critical before you can provide the right level of assurance. I think about some of the tools that we have in our arsenal in order to be able to do that. That's definitely where they.

00:12:35 Amanda Herron

the SEC cyber disclosure is focused for the stakeholders and shareholders to be able to understand that cyber risk as well. The topical requirement around cybersecurity is also designed to think about risk before the auditor is focused on the actual audit and providing assurance. And it's all meant to drive that good conversation about

00:12:58 Amanda Herron

how risks are identified, what those business impacts are, and what the mitigations are that really matter, and that as auditors we should be focused on. The other thing I want to bring up, because I do think in terms of cyber dashboards, they are a helpful tool to understand what the impact can be and what cyber thinks is most critical in line with the business.

00:13:24 Amanda Herron

But there's this notion of timeliness that I do want to also talk about here. So the dashboards that I typically see are the ones that are presented to the audit committee or that are presented within a management meeting. And they're historically periodic. And I think we need to shift the time frame a bit and make sure that they are more real time so that as internal audit and even as

00:13:53 Amanda Herron

of course, management and the audit committee, they're understanding those metrics at every point in time and how they change and then also what impact they can have when they change. One of the things that has been made more possible with AI and new technology tools is that ability to do more and more risk sensing.

00:14:16 Amanda Herron

We just built a tool called the Intern Audit Orchestration Suite, which I'm really excited about because it has fantastic risk sensing capabilities that can really get into some of these key risk indicators that are on risk dashboards and understand those changes and those risk signals and what is driving some of those changes to those metrics on a real-time basis and create those notifications to audit to say,

00:14:45 Amanda Herron

hey, there's something going on here. You need to go have that good conversation with cybersecurity and with the business, Tanya, as you mentioned, to really understand what the event is, what the threat is, what the impact could be, so that you're having a good point in time conversation, but also the ability to provide some good point in time assurance. And just as you mentioned with those frontier AI models,

00:15:12 Amanda Herron

are changing geopolitical status and risk. Threats are every day, every second, not once 1/4. And so I think that timeliness notion becomes much more important. And I also love that connection you made between cyber and the business. I mean, I think what we've

00:15:30 Amanda Herron

learned quite a bit over a number of these cyber events that have occurred is that cyber may manage or own the policy and some of the mitigations, but the function alone doesn't have the full view of business impact. And so as internal audit is coordinating with maybe ERM or with cyber and really understanding the scale of risk,

00:15:55 Amanda Herron

that conversation has to be had across the business. It is a true enterprise risk. I think about one board meeting I was in and there was a CEO from another organization that was talking about the cyber attack that had occurred within her organization. And

00:16:15 Amanda Herron

She mentioned that the impacts were beyond what they saw day one. And as they started to kind of live the attack and have more and more conversations with the business, they started to understand the full scale and ramifications of that attack. And they learned from that to really think through, okay, what are all my threat vectors? What are the potential attacks? And how do I pull the thread

00:16:43 Amanda Herron

on everything that can occur so that I am providing the right level of assurance and I'm involving the right people from the get-go instead of further down the line. A loaded answer to your question, Tanya, but it really pulled a lot of good thoughts that I was having on that topic. Let's delve maybe a little bit more into cyber reporting.

00:17:06 Amanda Herron

What do you think makes for a useful cyber metric? What's one that is easy to report, that's transparent, and what's one that's potentially misleading?

00:17:20 Tonya Ugoretz

Well, I think like we've been discussing, it's really that distinction between activity and outcome. And to me, a useful metric should show whether risk is changing.

00:17:32 Tonya Ugoretz

and should show it in a way that helps inform decisions or actions. I think that gives the recipients of that reporting a better basis for our understanding where the organization stands and whether management's actions are making a difference and having the intended impact and return on investment.

00:17:54 Tonya Ugoretz

And one of the positive signs I've seen, especially over the past year, is how much more boards are engaging with CISOs in particular. Again, referring back to that survey I mentioned that PWC conducts annually of corporate directors, 58% of them this year said that their boards have increased interactions with the CISO over the past year. So I think that's really an opportunity

00:18:22 Tonya Ugoretz

as we've said, to have this treated more as a business risk than just a cybersecurity risk. But I think part of that opportunity is making sure that in that conversation,

00:18:35 Tonya Ugoretz

there's improvement in expressing cyber risk in business terms. And there are frameworks that can help organizations, for example, estimate the probable frequency and financial consequences of specific cyber risk scenarios. I think that's helpful. It helps give leadership a common basis for comparing risks and evaluating whether investments that they may be considering are worth making. But of course,

00:19:03 Tonya Ugoretz

those estimates are only as valuable as the underlying assumptions. So I think, too, there should be some challenging of the quality of the inputs and making sure that conclusions are supported by evidence. But back to your original question, I think every significant metric needs to have a so what. So you're not just reporting a number for its own sake. But if, for example, a metric is showing that exposure is increasing or exceeds the

00:19:34 Tonya Ugoretz

stated risk tolerance. So what should change? So I think if a metric ultimately doesn't change what a company understands about their exposure and what they might do about it, then I would question whether it really belongs on the dashboard. So I think a lot of times, maybe you've had this experience too, when an audit committee sees a mostly green dashboard

00:20:01 Tonya Ugoretz

and they're getting the message that everything is fine here.

00:20:05 Tonya Ugoretz

What do you think internal audit should ask before just taking comfort that everything is green?

00:20:12 Amanda Herron

I agree with your question, so what, right?

00:20:15 Amanda Herron

And how do we know that our risks are being managed to really tie it back to risk?

00:20:21 Amanda Herron

I would be surprised these days, frankly, to see a dashboard that is completely green because

00:20:28 Amanda Herron

the risk is changing, the threats are changing, the activities and attacks are changing.

00:20:34 Amanda Herron

And so from both an inherent risk and a residual risk perspective, I think it should be much more dynamic than a dashboard that's all green.

00:20:45 Amanda Herron

And the audit committee needs to dig into that as well as internal audit to really get that understanding of are we anchored back to risk?

00:20:54 Amanda Herron

What's changed?

00:20:56 Amanda Herron

And frankly, as you started to talk about investments, Tanya, and most of the time now, I see audit working together with cyber to have a good resourcing conversation, frankly, and how they present that view to management and the board about coverage over those risks, whether it's appropriate, how it's changing, what types of skill sets are needed, what types of technology is needed.

00:21:24 Amanda Herron

So it can sometimes, I mean, internal audit sometimes can be a path to management action plans, which can be a path to funding.

00:21:33 Amanda Herron

So getting back to those actual risk scenarios, likelihood and impact, mitigation and layers, how does that align to the organization's risk appetite?

00:21:44 Amanda Herron

And are those resources in the appropriate areas to manage that risk effectively?

00:21:52 Amanda Herron

those metrics should reflect that story.

00:21:56 Amanda Herron

And so much of the time the conversation is about, hey, this is what we're doing today, but we need to be seen ahead to what's coming.

00:22:06 Amanda Herron

And here's what we need in order to do that.

00:22:09 Amanda Herron

Or here's what we're moving in order to do that.

00:22:12 Amanda Herron

And so the dashboard needs to get more and more dynamic.

00:22:16 Amanda Herron

Like I mentioned, not just timeliness of the data, but timeliness of the metrics to be thinking about where you are today, but also where you're going.

00:22:26 Amanda Herron

So Tanya, with that, we always get asked this question.

00:22:31 Amanda Herron

And I think we're going to start talking a little bit about risk ownership, the three lines model, independent assurance.

00:22:38 Amanda Herron

Where should cyber responsibility sit within the organization?

00:22:44 Amanda Herron

Yeah, the CISO has responsibility, IT has responsibility, the business.

00:22:49 Amanda Herron

We've talked a little bit about it, but I'd love to get your perspective on where responsibility for cyber risk exists in an organization today.

00:22:59 Tonya Ugoretz

Well, this makes me think about a broader conversation that's happening right now about the scope of the CISO role, because I think some organizations are thinking about

00:23:09 Tonya Ugoretz

whether and how they distinguish cybersecurity responsibilities and AI security responsibilities.

00:23:17 Tonya Ugoretz

For example, as you know, PWC leads a program to train

00:23:24 Tonya Ugoretz

aspiring and future CISOs in conjunction with Harvard Business School.

00:23:29 Tonya Ugoretz

And we ran an iteration of that program this past May.

00:23:33 Tonya Ugoretz

And this question was posed to the aspiring CISOs at the start of the course about where the lanes of responsibility are.

00:23:44 Tonya Ugoretz

And

00:23:45 Tonya Ugoretz

their views on it really shifted over the course of a week of describing the various challenges that CISOs face, the resources that the CISO role has in terms of how they lead security teams, what the challenges are right now in AI deployment and governance.

00:24:06 Tonya Ugoretz

And it was interesting to watch them from the beginning of the program to the end really move from

00:24:13 Tonya Ugoretz

I think AI is someone else's responsibility to actually, I think it might be part of my job jar.

00:24:20 Tonya Ugoretz

And that's a little bit off topic, but I think it just illustrates kind of this grappling with these security responsibilities that we're seeing in companies right now.

00:24:31 Tonya Ugoretz

That was kind of

00:24:32 Tonya Ugoretz

my feeling coming out of that session.

00:24:35 Tonya Ugoretz

And then when we published our global digital trust insights this year, which is our global survey of business leaders, not just cyber leaders or security leaders, but business leaders overall, about 4,000 respondents across 71 countries, all industries.

00:24:54 Tonya Ugoretz

And the results really illustrated this, that specifically when we're talking about

00:25:01 Tonya Ugoretz

again, AI governance, about a third thought the responsibility fell within more of a technology or CTO function.

00:25:10 Tonya Ugoretz

About 1/4 were thinking or had established A dedicated AI security function, and about 17 or so percent were looking to the CISO for this.

00:25:23 Tonya Ugoretz

So there's a lot of flux in this space overall.

00:25:26 Tonya Ugoretz

But in terms of

00:25:28 Tonya Ugoretz

the CISO's role with cybersecurity in particular, they certainly have a central role.

00:25:34 Tonya Ugoretz

But I think the accountability for cybersecurity extends beyond them.

00:25:41 Tonya Ugoretz

So again, if we mean what we say when we call cyber risk business risk, I think that means that business leaders apart from the CISO also have to be accountable for managing that risk to their operations.

00:25:56 Tonya Ugoretz

So think, for example, about a ransomware attack.

00:25:59 Tonya Ugoretz

The CISO and the security team can assess what's compromised, how the attack is spreading and options for containing it, but more business-wide decisions.

00:26:11 Tonya Ugoretz

So whether to take a customer-facing platform offline,

00:26:17 Tonya Ugoretz

Decisions that could involve financial losses, customer commitments, regulatory obligations, disclosure requirements, that quickly spreads far beyond the CISO to the CFO, general counsel, et cetera.

00:26:32 Tonya Ugoretz

So I don't think it's a simple answer.

00:26:36 Tonya Ugoretz

The CISO is responsible for the effectiveness of the cybersecurity program.

00:26:41 Tonya Ugoretz

in the ways that we've been discussing here today, understanding threats, managing vulnerabilities, implementing security controls.

00:26:49 Tonya Ugoretz

But I think business leaders more broadly are also accountable for the risks to the operations and assets and services that they oversee.

00:26:58 Tonya Ugoretz

And it kind of comes back to your example of the different leaders presenting together, and it's enterprise leadership that really has to bring those perspectives together so that

00:27:10 Tonya Ugoretz

the leaders who are receiving those perspectives can make informed decisions about acceptable risk.

00:27:18 Tonya Ugoretz

You mentioned the three lines model.

00:27:20 Tonya Ugoretz

How do you see that helping with bringing those perspectives together without blurring accountability?

00:27:27 Amanda Herron

Great question, Tanya.

00:27:28 Amanda Herron

So yeah, the Three Lines model provides a very useful structure.

00:27:31 Amanda Herron

The first line is really managing the risk and operating the controls.

00:27:35 Amanda Herron

The second line is helping to define what risk is in the environment and establish monitoring.

00:27:41 Amanda Herron

And of course, the third line is providing independent assurance.

00:27:46 Amanda Herron

I mentioned earlier one company that really does this well, and that's because their leadership is living the Three Lines model.

00:27:54 Amanda Herron

They have been for some time.

00:27:56 Amanda Herron

And I find that a three lines model is most effective when all of our basic COSO components are really clearly defined and owned.

00:28:06 Amanda Herron

So I think about control environment with clear policies and procedures and roles and responsibilities.

00:28:12 Amanda Herron

Risk assessment, which we've talked about a lot here, that there's a group that's doing the risk assessment.

00:28:19 Amanda Herron

That risk is understood between the other lines.

00:28:22 Amanda Herron

and that there's consensus around it.

00:28:25 Amanda Herron

Control activities are established and known.

00:28:28 Amanda Herron

The second line is the one that's typically doing the monitoring and providing some level of independence and objectivity beyond the first line.

00:28:37 Amanda Herron

And of course, third line providing that independent assurance.

00:28:41 Amanda Herron

And then reporting, which we've spent a lot of time talking about here, at least in terms of dashboards, that that's cohesive, integrated, and covers the rest of these components that we've talked about

00:28:53 Amanda Herron

and is agreed upon by all three lines.

00:28:57 Amanda Herron

I've seen this not work well, probably more than I've seen it work well, unfortunately.

00:29:02 Amanda Herron

And I've seen in some cyber organizations, they own the policy setting that the organization is supposed to comply with, but

00:29:12 Amanda Herron

there isn't monitoring or there isn't good reporting.

00:29:15 Amanda Herron

And issues are found when the third line does an audit versus when that risk should be actively monitored because it is so critical to the organization.

00:29:25 Amanda Herron

I mean, I think about a number of my clients and cyber is the top risk or the second risk.

00:29:31 Amanda Herron

And that really does drive the need for a very cohesive 3 lines model when your risk is that critical

00:29:41 Amanda Herron

changing constantly and needs to be managed on a continuous basis.

00:29:47 Amanda Herron

So really when I think about even that further application to cyber, the organization looking across their asset inventory, vulnerabilities, testing, risk definitions, how frequently they monitor and what they monitor, how that's communicated,

00:30:04 Amanda Herron

and other critical areas that really should be done through a common risk framework that everybody's getting comfort around not just the risks, but the asset inventory, the perimeter, third parties.

00:30:18 Amanda Herron

I mean, gosh, that's such a critical risk area these days that we haven't even started to talk about.

00:30:24 Amanda Herron

And just where these vulnerabilities can occur and again, be impactful to the organization, what the level of testing is,

00:30:33 Amanda Herron

and how really we can make sure that we're leveraging every tool in our arsenal to bring together an effective view of cyber risk and how that's being managed.

00:30:44 Amanda Herron

So that's a bit of how I think about the Three Lines model and how I've seen it work and also not work.

00:30:52 Amanda Herron

But Tanya, I'd love to get your thoughts on resilience.

00:30:56 Amanda Herron

And we've talked a lot about dashboards and reporting.

00:31:00 Amanda Herron

What do you think organizations can do either within cyber or across the enterprise to create confidence in their cybersecurity structure beyond a dashboard?

00:31:13 Tonya Ugoretz

I think you've really hit on the word with resilience.

00:31:16 Tonya Ugoretz

It's something we're talking about a lot lately with clients because I think because of the way that the cyber threat environment has changed and especially with the new capabilities with use of the most capable

00:31:30 Tonya Ugoretz

AI frontier models to be able to not only detect vulnerabilities, but to chain them together in a way that can enable compromise of companies at a scope and scale that humans just wouldn't be able to do.

00:31:45 Tonya Ugoretz

I think the conversation is shifting and it has been for some time, but especially now from

00:31:51 Tonya Ugoretz

not just prevention, which is still important, but preparedness for when a breach happens, knowing that given all of these new capabilities, there is a higher likelihood that a breach right now will occur.

00:32:06 Tonya Ugoretz

So

00:32:07 Tonya Ugoretz

having that confidence in resilience and recovery is really critical.

00:32:12 Tonya Ugoretz

And I think that confidence has to come from testing and evidence that the organization can withstand and recover from disruption.

00:32:21 Tonya Ugoretz

So thinking about what happens after a threat actor is inside of an organization, what steps has an organization taken before that happens to limit the impact?

00:32:35 Tonya Ugoretz

So first, and this is the boring answer that everyone is tired of hearing, but the cybersecurity basics that we've been talking about for decades now, probably 30 to 40 years, are still actually what helps answer that question of

00:32:51 Tonya Ugoretz

How do you ensure your company is going to be resilient and be able to recover when that disruption happens?

00:32:58 Tonya Ugoretz

So when I say the basics, it's things like understanding your most critical systems and segmenting those, putting protections around your most critical data, multi-factor authentication,

00:33:12 Tonya Ugoretz

making sure there's dynamic control of identity access mechanisms.

00:33:18 Tonya Ugoretz

We've talked a little bit about AI, but haven't talked about agents.

00:33:22 Tonya Ugoretz

Thinking about the number of steps that a cyber intrusion, either conducted by or enabled by use of agents, how quickly all of that could unfold.

00:33:33 Tonya Ugoretz

For a company, it's really critical to understand what they have in place to be able to contain that impact.

00:33:39 Tonya Ugoretz

So

00:33:41 Tonya Ugoretz

where do they start with that to measure that resilience?

00:33:45 Tonya Ugoretz

We have been talking a lot about a concept called the minimum viable company.

00:33:49 Tonya Ugoretz

What's the smallest set of services, processes, dependencies that a company has to keep running in order to stay viable during a severe disruption?

00:34:00 Tonya Ugoretz

And then from that starting point, doing realistic testing and exercises.

00:34:05 Tonya Ugoretz

I mean, we've talked a number of times here today about

00:34:10 Tonya Ugoretz

scenario planning, tabletops, bringing the right people who are responsible for different aspects of the business into the room and making that a realistic scenario that's tied to something that is more likely to happen and is more likely to have a high impact against that specific company.

00:34:31 Tonya Ugoretz

And I was pretty surprised when

00:34:34 Tonya Ugoretz

We received the results from that global digital trust insights survey I mentioned earlier, and we found that only 39% of the respondents

00:34:45 Tonya Ugoretz

had fully formalized and integrated operational continuity plans that specifically incorporated cyber risk.

00:34:53 Tonya Ugoretz

Given what you said earlier about how cyber risk has risen to the top of a lot of leaders' agenda, there's a disconnect there between understanding its criticality, but then making sure that's factored into

00:35:10 Tonya Ugoretz

operational continuity plans and preparedness.

00:35:14 Amanda Herron

Tanya, you started to mention AI, and I think AI and automation, as we talked about a little bit earlier with some of these frontier models, et cetera, are really changing cybersecurity as well as the opportunity to monitor for cyber.

00:35:31 Amanda Herron

How do you think that changes the risk conversation for CISOs and for boards?

00:35:36 Tonya Ugoretz

That's a great question.

00:35:38 Tonya Ugoretz

And I should say at the outset that I think thus far in our conversation, I've mainly been talking about some of the maybe more negative challenges with some of the new capabilities.

00:35:48 Tonya Ugoretz

But I also want to emphasize the positive, especially when we're talking about risk, because AI is also and the capabilities of these new frontier AI models are also seen as the greatest benefit to cybersecurity to defenders that we've seen.

00:36:06 Tonya Ugoretz

perhaps ever.

00:36:07 Tonya Ugoretz

So I think some balance and maybe a little bit of kind of breaking down what we mean when we say AI is important because we had this challenge for a long time with the word cyber.

00:36:19 Tonya Ugoretz

Cyber can mean a lot of different things depending on what people are talking about.

00:36:23 Tonya Ugoretz

And I think we're starting to see the same with the word AI.

00:36:27 Tonya Ugoretz

So I think about AI in three different ways for organizations, how they're using it, how they're securing it,

00:36:36 Tonya Ugoretz

and then how they defend against threat actors who are increasingly using AI themselves to conduct cyber operations.

00:36:45 Tonya Ugoretz

So using it, securing it, defending against it.

00:36:48 Tonya Ugoretz

And each of those kind of changes the risk equation differently.

00:36:53 Tonya Ugoretz

So quickly, in terms of how organizations are using AI, there's a risk that

00:37:00 Tonya Ugoretz

As on all topics, cyber adoption is moving faster than security and governance practices can keep pace.

00:37:07 Tonya Ugoretz

I think the opportunity here is for CISOs to be empowered and involved early in those conversations as companies are deciding

00:37:18 Tonya Ugoretz

how to use AI.

00:37:20 Tonya Ugoretz

There should be some lessons learned there from how in the early days of the internet and cybersecurity, adoption and use got way ahead of the security aspect.

00:37:32 Tonya Ugoretz

I hope actually this is an opportunity to make organizations see that the CISO plays a really positive role here in ensuring that security is baked in from the outset.

00:37:44 Tonya Ugoretz

So

00:37:45 Tonya Ugoretz

The same way that brakes on a car are what enable you to go fast because you have confidence that when you need to apply the brakes, they will be there for you.

00:37:55 Tonya Ugoretz

I think of the CISO's role in cybersecurity and AI security the same way.

00:38:01 Tonya Ugoretz

Having the safeguards in place from the beginning is what can help the organizations move more quickly.

00:38:07 Tonya Ugoretz

In terms of how organizations secure their AI, we see a lot of concern from clients about this.

00:38:13 Tonya Ugoretz

In that survey I mentioned, security leaders identified attacks targeting AI systems as the cyber threat they feel least prepared to address.

00:38:23 Tonya Ugoretz

So CISOs and boards need to understand where AI is deployed, what it can access, and how others with nefarious purposes can access it as well.

00:38:35 Tonya Ugoretz

And then lastly, kind of to that point, how to defend an organization against adversaries using AI.

00:38:43 Tonya Ugoretz

Right now, we see threat actors using AI.

00:38:46 Tonya Ugoretz

They're exploring the capabilities in the same way that you and I are, but we see it mainly accelerating the activities they're already doing, phishing, recon, research, and then trying to orchestrate attacks more easily.

00:39:02 Tonya Ugoretz

But as I mentioned at the outset, there is a cybersecurity dividend from use of AI models to be able to

00:39:10 Tonya Ugoretz

help with triage, really integrate it with SOC operations, be able to find and fix vulnerabilities before an attacker can.

00:39:21 Tonya Ugoretz

So I think over the next 18 months or so, the defense is going to catch up to the offense in this space, but all of those different kind of lenses into the risk that AI is posing are important to keep an eye on.

00:39:36 Tonya Ugoretz

From your perspective and from an assurance perspective,

00:39:40 Tonya Ugoretz

Does any of that change what you feel internal audit needs to evaluate?

00:39:45 Amanda Herron

Danya, I think that's a great question.

00:39:47 Amanda Herron

We're talking a lot about AI and internal audit, both the potential side and the risk.

00:39:52 Amanda Herron

In fact, we just did a webcast called AI's Potential and AI's Risk for audit executives and for auditors, because automation creates

00:40:02 Amanda Herron

a fabulous opportunity for internal audit to be able to monitor risks real time and to understand if controls are operating effectively.

00:40:11 Amanda Herron

I think of one company that we were just talking about this morning with a group and they have created an agent that looks at privileged access every moment, every day across all of their critical systems.

00:40:27 Amanda Herron

whether there's a change in personnel if that privileged access is being updated appropriately.

00:40:33 Amanda Herron

And at the flip side of that, we're now relying on an agent to do that work and we need to get comfort that the agent is doing that work effectively.

00:40:42 Amanda Herron

And so there's a lot of controls that we need to put in place around that agent to make sure it is doing its job and think of it almost as a person.

00:40:51 Amanda Herron

I had one chief audit executive earlier this week tell me that she, as she's deploying agents, she gives them job descriptions and she gives them performance reviews about whether they're accurately doing what they're tasked with doing.

00:41:06 Amanda Herron

And I love that concept of thinking about agents as extensions of your internal

00:41:12 Amanda Herron

audit function.

00:41:13 Amanda Herron

But it also, as you mentioned, creates a whole lot of risk and is changing every day.

00:41:19 Amanda Herron

And that is what really is on the minds of boards of directors that we're talking to and with audit committees.

00:41:27 Amanda Herron

How are we managing this risk not just within the organization, but also within third parties?

00:41:34 Amanda Herron

And that AI risk is real.

00:41:37 Amanda Herron

There are embedded agents in a number of tools.

00:41:40 Amanda Herron

There are agents at

00:41:42 Amanda Herron

third parties that are being leveraged around company information, they are exposed to AI risk as well and AI-enabled hacking.

00:41:54 Amanda Herron

So you really have to, again, it kind of comes back to that risk discussion and how you think about your environment, how you assess for criticality of AI in your environment,

00:42:08 Amanda Herron

and what types of risk assessment you do.

00:42:10 Amanda Herron

And that really all does go back to having a good, strong AI governance program that is not only looking at what you're deploying with your environment, your third parties, but then also what risk that presents within your cybersecurity risk profile as well.

00:42:28 Amanda Herron

So Tanya, I know we've been talking a lot about cyber and dashboards and reporting.

00:42:36 Amanda Herron

Maybe just if we think about how we bring this all together and some advice that we would leave some of these listeners with, is there one shift that you would encourage organizations to make in how they think about cyber reporting?

00:42:51 Amanda Herron

What do you think that one shift should be?

00:42:54 Tonya Ugoretz

It's an uncomfortable one, but I think it's to have the hard conversations and not to treat

00:43:00 Tonya Ugoretz

Cyber reporting is just an exercise in reassuring everyone that everything is under control.

00:43:07 Tonya Ugoretz

I think that's a natural tendency, but some of the most valuable reporting should highlight challenges, especially as the whole landscape around this topic is shifting so quickly should highlight

00:43:21 Tonya Ugoretz

maybe where resources were 1/4 ago or not where they need to be right now.

00:43:27 Tonya Ugoretz

And part of that, I think, is a business leader's responsibility and a board's responsibility to create that climate where that type of candor and really useful reporting is kind of welcomed and valued.

00:43:42 Tonya Ugoretz

And I think it's also important to pay attention to

00:43:46 Tonya Ugoretz

what's not on the dashboard.

00:43:47 Tonya Ugoretz

Just because an issue is not being reported doesn't mean there's an absence of risk.

00:43:53 Tonya Ugoretz

It just might mean that the organization lacks the visibility to identify it.

00:43:59 Tonya Ugoretz

From an insurance perspective, what would you shift?

00:44:02 Amanda Herron

We as auditors have really good skills and we ask really good questions about the hows and the whys and really getting under the data.

00:44:13 Amanda Herron

So I do think

00:44:14 Amanda Herron

Going back to understanding the risk, getting to the how, the why, what really is important and thinking about context and then measure what matters, provide assurance over what matters.

00:44:27 Amanda Herron

That's, I think, exactly what summarizes a lot of this conversation.

00:44:31 Amanda Herron

You've got to get to the what is critical, what is most important.

00:44:36 Amanda Herron

Let's focus our strengths there so that we're providing some level of comfort to the organizations that we're serving.

00:44:42 Amanda Herron

So Tanya, this was a lot of fun, as promised.

00:44:45 Amanda Herron

I think we learned a lot from each other and really appreciate the discussion today.

00:44:51 Tonya Ugoretz

Thank you.

00:44:51 Amanda Herron

Yeah, and thanks to the IA for making this happen.

00:44:56 The IIA

If you like this podcast, please subscribe and rate us.

00:44:59 The IIA

You can subscribe wherever you get your podcasts.

00:45:02 The IIA

You can also catch other episodes on YouTube or at theiia.org.

00:45:06 The IIA

That's T-H-E-I-I-A.org.