What are the biggest mistakes working with a cybersecurity company?

When it comes to cybersecurity, it is simply less expensive to prevent a cybersecurity attack than it is to repair the damage to your business after the fact.

However, before you can become resilient to ransomware, data breaches or other attacks, you need to understand if you have established the right approach when working with your cybersecurity team and/or vendors. We want to help you avoid the most common mistakes companies make working with cybersecurity firms so you can get to the right start immediately.

So, what are some of the biggest mistakes made when they’re hiring or working with a cybersecurity company?

1. Customers take a technology first approach.

This means that a customer has selected the technology solution for their company before they’ve hired the cybersecurity firm. This happens often, and it means that you’re really looking for somebody to come in and execute the technology implementation rather than developing a full solution that can deliver on the business objectives. This common mistake creates far more issues later as the technology becomes imbedded in the infrastructure of the company, making it very time consuming and expensive to change later. Plus, as threats evolve, you are relying on the technology provider to maintain and adapt their technology continually and expansively, which is risky.

2. Your cybersecurity company focuses on only one or two technologies.

Choosing your own technology isn’t the only tech mistake. You may run into issues if your vendor isn’t technology agnostic. If your cybersecurity partner pushes a specific technology, you need to be concerned as to whether that vendor is looking to sell that technology or solve your security problems. This is important because you want the best solution to be tailored to your business needs, not a solution where the vendor receives a sales commission.

3. The cybersecurity technology isn’t aligned with corporate business objectives.

Cybersecurity isn’t a regulatory compliance issue alone, you want to understand what value, besides the risk reduction, that cybersecurity firms can bring to your business. They need to align technology solutions around a business setting, not just an IT operation setting. This means ensuring that the company and the cybersecurity team takes time to understand the business needs and objectives. Once these are understood and alignment is achieved, you can start digging in depth in terms of the impact to balancing technology, people and data.

4. The timeline and process for delivery are compromised.

In many cases, clients have a timeline that is rushed and a process that hasn’t been properly vetted or understood. The client is ready to sign a statement of work before they really understand what the proper solution should be, all due to a time crunch. And this is a huge mistake because you progress through your project, whether it’s something security related or part of a digital transformation, or a migration to the cloud, you start seeing issues that haven’t been understood at the outset, which may change the scope of the entire engagement. In trying to meet a timeline, you are actually increasing your risk threat to the company.

5. Clients didn’t initiate a strategic and due diligence engagement.

Imagine building a house without understanding the environment or requirements. You can, but it’s less likely that you will get what you really need to have built. So, a smarter way of engaging a security company would start engaging them early. Initially, for a very short scope, in terms of reviewing your business requirements, and then for a smaller investment doing the right strategic and due diligence to create a working plan. By engaging a team to provide a plan, that they or another firm can them execute, you are more likely to get the right solution for your business and save money, rather than creating a rushed SOW that will change as the engagement is better understood.

6. Lack of collaboration and communication.

A client should always ensure that there is good collaboration and communication when they’re working with security vendors. You should have enough access to subject matter experts who can answer your questions or to bounce something off of your vendor to better understand the process, implications and risks. Will they be available, and can they explain industry terms in a manner that you and your team can actually understand. You also want a success manager on the cybersecurity team rather than a gatekeeper. Gatekeepers try to limit the communication that you have with the experts on your cybersecurity team, because they want to control access in order to be compensated for every touchpoint. A success manager, on the other hand, will want to grow the business and they are still looking for financial gain, they want to grow the relationship by finding value and mutual interest between the organizations to grow shared knowledge and ideas that can improve their security stance.

7. You hire doers who do a project versus thinkers who become partners.

Too often clients hire companies that do what they are asked to do, rather than what the client actually needs to do. Clients need to find partners who are looking beyond the initial engagement to become a partner if they are going to be prepared for future threats.

8. Your cybersecurity partner isn’t staying on top of your environment.

You know your business, but does your cybersecurity know it too? It’s critical to have a cybersecurity company that understands your business environment and your industry. This is important for both professional services and managed services, but for managed services, it’s a matter of life and death. The managed service provider is somebody who employs a lot of junior people and there is a high chance of turn over. If your managed service provider doesn’t understand the company’s business objectives, applications, services and data, how can they have the knowledge to properly manage new risks and keep your system resilient? How will you know? If you feel like your cybersecurity team keeps asking the same questions over and over again, or if it takes up a lot of time to get answers to your questions, it may be time to reconsider a new vendor.

9. Success metrics haven’t been defined or monitored.

You understand the security strategy that you want to implement and you understand how you are going to deliver it, what’s required and the timeline needed to complete it all. How are you measuring the overall success of the strategy and implementation? This is something that is often overlooked and it needs to be mutually agreed between the client and the security vendor before the engagement. There should be some very specific metrics on how you’re going to measure that success. Otherwise, you, or even your security partner may not feel that this is successful.

Mistakes can cause system wide failures that can impede or destroy your business. Understanding how to avoid simple mistakes will allow your team to be more successful and ensure that you have created the right synergies to develop and implement the proper solutions for your company. Hiring and working with a cybersecurity firm is not just about understanding the security environment, it’s understanding the business objectives and applications, the industry as a sector and so much more. And that’s something that a lot of security companies are not spending enough time in trying to understand within the company.

About Parabellyx

Parabellyx are security-matter-experts who take a focused and business aligned cybersecurity approach to developing strategies that accomplish your key business goals and objectives. We then train your entire organization in security, preparing you for any threat, until a security mindset is entrenched across your entire company, protecting and ‘future-proofing’ your information, your employees, your customers, your shareholders and your reputation. Contact us