Perhaps the most challenging and exciting aspect of cybersecurity is the need to account for business context when making decisions. One way to do this is to determine the unique strengths of the company—its competitive advantages—so you can frame risk conversations accordingly.

Economic Moats to Safeguard the Business

Gunnar Peterson discussed aspects of this concept using the notion of economic moats. According to Morningstar, an economic moat "refers to how likely a company is to keep competitors at bay for an extended period." This term is similar to what others might call a sustainable competitive advantage. Just like a moat helps safeguard the castle from attackers, an economic moat contributes towards protecting the business from competitors.

Companies have different economic moats and those without a sustainable competitive advantage tend to stagnate. Gunnar outlined several types of moats highlighted by Morningstar, including: Low operational costs, intangible assets (strong brand, patents, etc.), high switching costs (customers tend to stay), etc.

Relate Security Risks to Economic Moats

What are your organization's economic moats? If you don't know what capabilities help the company protect or expand its market share, find out. This knowledge will help you make informed security decisions and will allow you to be a more persuasive participant in risk discussions. As Gunnar pointed out, "the two most important things in infosec are identifying what kind of moat your business has and then defending that moat."

Cybersecurity professionals often complain that executives ignore their advice. There could be many reasons for this. One explanation might be that you are presenting your concerns or recommendations in the wrong business context. You're more likely to be heard if you relate risks to an economic moat relevant to your company.

A common approach to emphasizing the importance of cybersecurity is to focus on the brand-tarnishing repercussions of a data breach. However, businesses don't always suffer in the long term, and in some cases the attention brought by the breach could actually help the company. Even if the company might suffer in the short term, an argument based on brand tarnishing could fall on deaf ears if the organization doesn't consider its brand a competitive advantage.

Security in Support of Sustainable Competitive Advantages

A company whose economic moat is its brand, will spend considerable efforts to protect its brand equity. For organizations like that, the brand-tarnishing argument might be effective and could be a good way to justify security funding. However, companies that have other moats, won't care that much about safeguarding their brands.

For instance, consider a firm whose economic moat is tied to low costs due to its operational expertise and supplier relationships. A good context for making security decisions in this organization might be its efforts to protect proprietary details related to internal and supplier logistics. Threats to this moat will likely capture executives' attention.

Another organization whose moat is its proprietary intellectual property will want to hear your thoughts on protecting such trade secrets. Alternatively, if a firm sees its time-to-market as a competitive advantage, it will want to know about the security risks that could slow it down and prevent the next timely release of its product.

An economic moat might protect the company from competitors, but it could be eroded by internal factors such as a security breach. Understand your company's economic moats. Use them to frame security decisions and to ensure that your infosec advice are relevant to the company's business objectives and strategies.