Reframing Cyber Risk with Jane Frankland MBE

Speaker A: So a serious incident can take the whole business out in an afternoon. And that's why I keep pulling it back to survivability rather than security. AML failures, they cost you fines and reputation, but cyber failures can cost you the ability to operate at all.

Speaker B: That's Jane Franklin MBE. She's an entrepreneur and author who spent nearly 30 years in cyber. In fact, she's one of the most respected experts on it in the world. She spent years building and advising businesses and turning cyber risk into plain language that leaders can understand. As we continue our cyber miniseries here on the podcast, Jane and I had a wide ranging conversation. We looked at the difference between cyber and other forms of compliance, why the field needs more people with unconventional backgrounds and, and why the key to understanding cyber could lie in a mid century psychological model. Sitting in for Hanyu Cyber Today, I am Malene Gerlinger and this is BCG on compliance. Hi Jane, welcome to the podcast. Could you give the audience a quick introduction of who you are and how have you spent nearly 30 years in Cyber?

Speaker A: Yeah. It's so good to be here. Thank you so much for having me. So this is really hard actually because there are so many ways that I can describe myself, but right now I'm describing myself as someone who is really all about cyber for survivability. So I'm a strategist, I'm a bridge, and uh, I'm an advocate. And the bridge part is really important. It really matters because I spend so much of my life and time in my career, like moving between so many different worlds that don't naturally speak the same language. So, so that could be with journalists, it could be with analysts, executive chief, information security officers, boards and vendors. So I spend a lot of the time translating between these different groups of people and I would say creating win win situations.

Speaker B: A big part of why I wanted to talk to Jane today is her unconventional entry into the industry.

Speaker A: I was always kind of like taught to follow my passion and I was good at art. So my parents said like, if you want to do it, go do it. So I actually chose woven textile design. So I'm a, I have a degree in woven textile design and um, for so many years I avoided letting anyone know because I was slightly embarrassed about it because I, uh, didn't come from a tech background. But I still, even though I said, you know, I'm about cyber for survivability, I'm a strategist and an advocate and a bridge, I actually really identify still as a designer because that's really What I'm doing, I'm designing solutions to help. Certainly in this case we're talking about cyber security, cyber to do better. And it's shown up in so many different ways. But essentially that's how I came into the industry. From having a background in art and design. And yeah, it's fun, it's creative. And I use my creative skills, not necessarily to, to like design patterns anymore or certainly to weave, but I look for patterns and trends and I tend to see that quite easily now. Um, maybe that's because, you know, I have this ability to spot things quite easily and to kind of see trends and patterns.

Speaker B: So if you were to design a corporate governance structure completely from scratch, where does cyber risk sit within the compliance function?

Speaker A: Well, I would say first of all, actually cyber risk would not sit in it and it would not sit in compliance either. I'd actually put it in two places at the same time as well. Now this sounds really complicated, but kind of hear me out. Governance lives at the very top in leadership. So that's really with the board because they have the ultimate accountability. They. But it also sits halfway up a model. And I'm gonna talk to you about this model. Cause it's based off Maslow's hierarchy of needs through a cyber lens. After leadership you have culture, but that's where the structure and the authority and the decisions are really concrete. The way that I see it is both right at the very top of the house and it's also a load bearing layout right in the middle.

Speaker B: Can you then, um, give the audience an example of what healthy cyber risk culture looks like in practice?

Speaker A: I would say it's where somebody actually has the ability, or employees have the ability to raise an alarm so they know who to contact and they feel safe doing that. Because if they don't know who to contact, they're going to fall flat on their feet. The detection tools will pick up the actual attack that's happening, but it's going to take time to find out, well, who actually is responsible for it. So they need to know who to call and they also need to feel safe doing that. They really need to understand that bad news can be received really well and they need to feel really safe. So that's where the psychological safety comes into it. If you don't have any of those things, you won't have security embedded throughout the organization as culture.

Speaker B: That's a great way to put it, Jane, from your perspective, who is responsible for building that culture that you just described?

Speaker A: Yeah, leaders are responsible. You know, it really starts with leaders, full stop. If you don't get it there, you are fighting a, uh, losing battle.

Speaker B: One of the driving ideas behind the Cyber miniseries is the understanding that right now we're in a very unique moment. While other compliance aspects are still important, the threat experienced in Cyber might be unlike anything we have ever seen before. And people on the front lines are having to deal with very distinct challenges.

Speaker A: There's some real common ground with something like aml. Both are about detecting bad actors and moving through your system. Both are heavily regulated and, um, both live or die on culture and on people actually reporting what they see. The other thing I would say is both suffer from the same disease, that temptation to treat the regulation as the goal or to comply your way to a false sense of safety. But I think really the fundamental difference is that Cyber has an adversary who is actively adapting against you in real time. Whereas your money laundering, um, typologies, they evolve, yes, but they do that quite slowly and the rulebook can more or less keep pace. Whereas in Cyber, the moment you deploy a defence, someone somewhere is working out how to get around it. And the attack surface itself keeps expanding underneath you with every single new tool, every new, like cloud service and the supply you want on board. It's dynamic, it is intelligent in a way most compliance risks aren't. And it's also faster and it's also more existential. So a serious incident can take the whole business out in an afternoon. And that's why I keep pulling it back to survivability rather than security. AML failures, they cost you fines and reputation, but cyber failures can cost you the ability to operate at all. They can take out your whole business. And we've seen this happen time and time again. I mean, AI shines a light on everything. AI scales everything. And AI, in this instance, it has poured petrol on that. And if we look at agentic AI, well, that means that the adversary now adapts at machine speed, um, and machine scale. So reconnaissance that took a human team. It could be days or it could be weeks. That can be automated, and I've seen that be done in less than a minute. Phishing is flawless now, and it's personalized. Vulnerabilities are getting found and weaponized faster than most teams can patch. It is a huge, huge problem. And then we've got all of the synthetic media as well. So it's just like, well, what can you trust? Trust is under attack. It's really interesting to see what is happening and how we are evolving as cybersecurity practitioners more than anything.

Speaker B: One of the key innovations Jane is suggesting is that Maslow's hierarchy of needs might be a useful framework for understanding and assessing cyber risk. If you're not familiar with it. Maslow's hierarchy of needs is a model that says people have to satisfy basic needs first, so things like safety, health and shelter before they can chase self esteem or self actualization. It's normally a pyramid with physical needs at the bottom, underpinning all other emotional goals. I wanted to find out more how this relates to cyber. Jane, I'd love to speak about your new book in which you mentioned Maslow's hierarchy of needs as a framework for understanding cyber risk. How did this idea come to you?

Speaker A: From having been in cyber for so long, I'm constantly thinking, why have we got this problem? What is happening here? Why are we not getting on top of this? So for me, it kind of came about from my creative thinking, having the space to think and looking at the industry and, um, where we kind of focus our attention. So typically we're technologists. A, uh, lot have come from tech fields and been in technology for a long time. Some have come from military and intelligence services and uh, some have come from elsewhere as well. Typically we like to solve or try and solve the problem with technology. It's very easy to buy and it's very easy to measure. And we like to measure things. Uh, we like to get caught up in the data and things like that. And we also have pressure to do that as well. But what I see is that because we focus this attention onto the tooling layer, we miss the supporting layers that really enable it to be strong. So coming back to Maslow and my understanding of Maslow and having an interest in psychology and behavior science and things like that, because my whole world isn't cyber. So for me it's like looking at all of these things and having this problem of like, how can we do better, how can we do better? And so I just kept seeing us focusing our attention on the tooling layer and uh, not building those other layers beneath it to really support it. So those layers of, if I'm talking in practitioners language or two practitioners, then I would say leadership, culture, governance, then have the tooling layer, the defense layer, and then on top of that, collaboration. And if I'm talking to executives, then I'm speaking more in the language of outcomes. So I'm talking about judgment, truth, authority, capability and collective strength. So it's like, you know, a house built on sand or a, uh, stack of cards. It doesn't have those firm foundations. So we need leaders to really understand this, to level up. We need that governance layer. Uh, they are responsible, the board is responsible for that to, so we need them to level up and start asking better, uh, questions so that they can pay attention and do a better job of governance.

Speaker B: In Maslow's pyramid, we have physical needs at the base. But if we follow Jane's theory and map that same model onto cyber risk, culture and strong leadership serve a similar function. We can't achieve our higher level goals for cyber risk without securing that base first. If we don't make sure that leadership and culture are strong, it does not matter how many innovative tools you have, the pyramid will not hold up.

Speaker A: We need leaders to actually make sure that they are building culture, culture that permeates through the whole of the organization, which will help us not just spot attacks and do better and build that psychological safety, but and also have that go out into society, into the homes and keep people safe at homes and their family at homes as well as organizations. But we need that to happen. If leaders don't do that, culture doesn't get built and then the governance doesn't get built. And what I see with governance is we have a bit of an accountability issue here because when it comes to security, we have accountability. Our, uh, name sits on the risk register, but often we don't have the authority and then that's a governance failure. It's actually organizational negligence. So I'll give you a really good example of this. We're responsible for the risks. We're responsible for patching, but patching sits in it. So if it decides that they're not going to patch in a timely manner or whatever, deprioritize it, we're still responsible for that, but we have no control as to whether or not that gets done. And then in terms of reporting lines, if we don't get a seat at the table, if we're reporting on to somebody else, say like the CIO or the CTO or the cfo, uh, which are quite, they can be quite typical. The truth can actually get delayed, it can get softened, it can get deprioritized. So the truth isn't necessarily getting up to the CEO, to the board, and um, for them to actually make decisions in a business, decisions, risks, decisions on them. So that's a problem. The defense layer, I think we do really, really well. You know, we've got so many tools, we've got great innovation, the collaboration and the collective strength layer, which is above that that self actualization layer, if we're talking Maslow, we do a pretty good job of that. We can improve, we can improve on all of these layers, even the ones that we do pretty well on. But we need to be sharing more. And I see some companies do a really good job of this and I see other just knowledge hoard and they don't share what has happened for various reasons. And because of that we don't do as well as we can do. So coming back to Maslow, what Maslow called out during the mid century was that psychology was focused on what doesn't make people thrive. You know, the sick half. For security. We focused too much on vulnerabilities and threats and controls. We haven't focused on that operational capability that is required to withstand an attack. So to withstand, to hold strong and to bounce back with minimal damage and impact, uh, and cost.

Speaker B: Such a complex issue from your point of view. Um, Jane, what would you consider best practice in terms of enhance or leveling up leaders and enhancing accountability?

Speaker A: Oh, that's a really good question. I would say, I mean training for a start. So training is a really good place to start, but you can't just leave it with training. So a lot of the time I'll see leaders go through training but they don't have the embedding, they don't have the support. So when you couple that with coaching or mentoring or even just effective management, then you can embed that leadership training. A lot of the time they're just left to it. You know, they might do, they might do a one day course or it might be a few more days and then it's just forgotten. Because leadership, uh, training rather without that embedding, that coaching, that mentoring, that management is really just entertainment. So if you just have training, it doesn't stop, stick. And what happens over time is you get into bad habits and you forget. And that's why you need some kind of constant refresh, someone to hold you accountable to effective leadership. And so much of the time I see leaders having a leadership title but very, very rarely leading. So I would say make it fun, make it relevant and uh, make sure that it happens and make sure the leadership training is supported after so that it can be constant. You want to be always sharpening your saw, you know, as you go along, not letting it get blunt. And a lot of the time with leadership I see it get blunt, I see bad habits form. So a really good example of this is if you have a leader who is absolutely fantastic about bringing revenue in, they're one of those rainmakers. And, um, companies love them. And a lot of the time they'll walk on water. And we see this a lot in the consultancies. But, um, there can be some really, really ugly behavior that happens with those leaders and that's tolerated because they bring in the money. But if those behaviors are tolerated, it becomes culture. And then it sends a very strong signal out to other members of the team, juniors coming up through the ranks, you know, wanting to move into management, into those leadership roles. And it just enforces that, uh, oh, I can do that too. So long as I bring in the revenue, I can do that too.

Speaker B: One of the things Jane is passionate about is advocating for more diverse representation in cyber.

Speaker A: I've done an awful lot of work in regard to women in cyber, women in tech, and making sure that we're getting more in and we're tackling that, um, so that we can do better business. Because really, it's not a case of this is the right thing to do, it's the fair thing to do. We shouldn't be doing that is actually really good for business. So when you have a more diverse team, if we look at gender and in cybersecurity, innovation increases revenues, increase profits increase. Women see risk in a different way to men. So we do a better job of actually ascertaining the risks out there and feeding that up. There's so many advantages. And then women will, I would say what's good for women is good for men and women are the canaries in the, in the cage. So if you've got an environment, and remember, environment dictates performance, if you've got an environment where women are leaving, then you combat, the men will leave too.

Speaker B: So do you think overall that we may lack some of the diversity of thought in compliance team rather than just agenda, but also, um, more generally, especially where people maybe come from a business background. From your point of view, how can, let's say unconventional backgrounds contribute to making cyber or compliance team more effective and resilient?

Speaker A: I think that we badly lack it. Yes, but you knew that I was going to say that because I've been advocating for this, uh, for so long. When it comes to compliance, it's rife everywhere. You know, if you look at the numbers, I'm not going to focus on compliance because I don't have it specifically for compliance, but I certainly do for women in cyber. And if we look at women in Cyber in the UK, the numbers sit around 17%. And that's an Ipsos Mori report. And they do that year after year. So it's a solid report, and I really enjoy reading that report, but I don't enjoy reading those stats and seeing them drop. So we need to do better. We need to have more creative thinking so that we are not biased. Being blindsided and biased is not a good thing. And inherently, as human beings, we are biased, and we can't help that because that's kept us safe for all of these years, for our whole human existence. That has kept us safe. But what we need to do is create these different environments so that we can see things that other people can't and not be blindsided, so that we can innovate better and we can create better solutions, better processes, so that we all benefit. So for me, it's really about bringing in a whole range of different people from different backgrounds, from unconventional backgrounds. My background was art and design. I've met so many people who are from different backgrounds. A lot of them are my age because we could fall into this industry. Whereas nowadays, the younger people coming into it, even though there's been a lot of noise, I don't want to use that word, but a lot of noise about people coming in from unconventional backgrounds, not necessarily needing a degree and things like that. It's not as easy as it was when I came in and I came in an unconventional way and I built my own business so I didn't have to go and get a job. I just built it. But, um, we need people from humanities, you know, from design, from psychology, from behavior science, from anthropology, from tech teachers, economists, journalists. I've seen people who've come in and they've been hairdressers or bricklayers or florists. It is about getting that diversity and having minds that can think really well and. And really importantly, that they have a, uh, mindset and attitude that is conducive to doing better.

Speaker B: So, wrapping up, Jane, last question. When a compliance leader is listening to this, they may have tuned in to hear what the latest best practices on cyber security. What is the one thing you'd bet that they're not getting right, and what can they do to change that before the end of the year?

Speaker A: What I bet on is that they're still measuring compliance instead of survivability. They can show you a beautiful dashboard of controls, really well implemented. They can have these amazing frameworks that are aligned, boxes ticked, but not one of those metrics actually answers the only question that matters, which is, if we get hit tomorrow, do we survive and can we keep operating so Controls in place are not the same thing as being able to take a hit, bounce back, and still keep operating. So the fix for me is, and it is genuinely doable before the end of the year, which I think is really encouraging for anyone listening to this, is to run a proper board level survivability exercise as a number one activity. And I don't mean a tabletop an it tabletop, you know, exercise in a basement. I want them to get the actual decision makers in a room and walk them through a realistic serious incident. And especially in this day and age, I would say build an AI scenario into it as well as ransomware, because that's still extremely common. And the reason I say, um, build AI into it is because this is our world now. AI accelerated attacks are coming at you and one of your own agents going wrong. That is something that can easily happen because the gap almost no board has stress tested is that one. So I would say watch where judgment breaks down, where the truth doesn't travel, when nobody's sure who has the authority to make the call. So that's the one exercise that I would really make sure that leaders were actually getting to do.

Speaker B: When was the last time you tested your company's survivability? Join the conversation by connecting with us, uh, on your podcast app, writing a review of the show, or emailing us bcgoncompliancecg.com I'm Marlene Gallinger. Thank you for listening.