IT teams are not famed for their charm. While the monotonal pleas of the fictional Maurice Moss and Roy Trenneman for users to turn their computers on and off again may not accurately reflect the lived reality of securing a business, the stereotype isn’t terribly wide of the mark for anyone forced to plea for help fixing a juddering work laptop.
This reputation also extends to IT teams’ interactions with CIOs, though the consequences in those instances involve more than recapturing a wifi connection. According to a recent report by FTI Consulting, persistent communications gaps between the C-suite and their IT teams remain a key barrier to effective cybersecurity safeguarding. 98% of C-suite executives surveyed, meanwhile, support further funding for CISO communications training.
It’s this communications gap that fascinates and repulses Chris Henderson. As Huntress’s senior director of threat operations, Henderson helps to oversee a cybersecurity firm whose USP lies in protecting small and medium-sized enterprises (SMEs) – firms that, he explains, are rarely au fait with the latest trends in ransomware or which API configuration is most likely to leak their account information all over the internet. As such, he’s grown used to boiling complex threat data into language relevant to the daily challenges such businesses face.
“When you talk to non-technical consumers and customers about technical security risks, it just flies over their heads,” says Henderson. “But when you break it down into something they do understand… people realise they’re already experts at risk analysis.”
That’s easier said than done. To guarantee against the kinds of surly interactions IT teams are known for in the market, Huntress prioritises emotional intelligence when it comes to hiring for its threat detection teams. This manifests itself on a practical level when the firm frames arguments to clients for, say, downtime for vital systems – systems that might be crucial for the running of that business – in light of what would happen to their business if they hadn’t prepared for such a breach at all. Henderson himself recently wrote a tabletop exercise for clients about such a scenario involving a vulnerability in ConnectWise Screen Connect, a popular remote access software among SMEs.
“That really walked those SMEs through the thought exercise of, ‘If we don’t do this and we do get breached, what are the follow-on costs associated with that?’” recalls Henderson. Most concluded that they would be exorbitant – and certainly worth the price of bringing vital systems down temporarily to update them against such an eventuality.
Cybersecurity comms according to Huntress
In that case, Huntress was able to kickstart a conversation with multiple clients about necessary contingency measures should such a vulnerability impact their business, including whether the firm could patch certain systems automatically. Keeping such interactions not only simple but relevant to the operational nuances of an SME, argues Henderson, has helped to establish a great degree of trust in Huntress among its client base. It has also cemented a reputation for straightforwardness, reinforced by its publicly available blog on new and pervasive cyber threats.
“We are seen as the predominant resource that the MSPs are going to for this information,” says Henderson, who argues that this transparent attitude toward the dispensation of useful cybersecurity advice is another factor in Huntress’s overall success.
Might all this effort soon be superseded by AI? It’s a reasonable possibility, says Reliance Cyber’s chief technology officer Lawrence Munro. “Generative AI can create reports that simplify complex cybersecurity findings into understandable formats for clients,” says Munro. What’s more, “AI-driven chatbots can provide real-time support and information to clients, answering common questions about cybersecurity threats, incidents, and best practices.”
For his part, though, Henderson does not believe that Huntress’s outsized efforts on the communication side of its business are wasted effort. After all, he reasons, “cybersecurity is best explained through analogy and the LLM models are still not great at that.” Without the feedback loop between the customer and the cybersecurity provider, argues Henderson, “they’re just not at the level.”
Read more: Communication gaps between IT departments and senior corporate leadership worsening application security risks
