Top Strategic Cybersecurity Trends for 2023

1. Threat Exposure Management

2. Identity Fabric Immunity

3. Cybersecurity Validation

4. Cybersecurity Platform Consolidation

5. Security Operating Model Transformation

6. Composable Security

7. Human-Centric Security Design

8. Enhancing People Management

9. Increasing Board Oversight

“The renewed focus on the human element continues to grow among this year’s top cybersecurity trends,” says Gartner Senior Director Analyst Richard Addiscott. “Security and risk management leaders must rethink their balance of investments across technology, structural and human-centric elements as they design and implement their cybersecurity programs.”

Download Now: Top 3 Strategic Priorities for Security and Risk Management Leaders

We expect these trends to impact enterprise strategies by enabling organizations to address four key priorities: 

• Creating responsive ecosystems that improve organizational readiness

• Restructuring approach points to solutions and greater attack coverage

• Rebalancing practices to focus on people, process and technology

• Pursuing sustainable, balanced cybersecurity programs

These trends move forward risk resolution efforts by applying a continuous approach to threat management and cybersecurity validation. They help improve detection and response capabilities, and build more digitally immune identity ecosystems. 

• Threat exposure management is a pragmatic, effective and systemic approach to continuously refine cybersecurity optimization priorities. Practices evolve in order to better understand their combined exposure to threats and address gaps in their posture.

• Identity fabric immunity applies the concept of digital immune systems to identity systems. The main goal is, with balanced investments in prevention and in detection and response, to minimize defects and failures, for protection before and during attacks.

• Cybersecurity validation merges techniques, processes and tools to validate how potential attackers would actually exploit an identified threat exposure, and how protection systems and processes would react.

Learn More: Everything You Need to Know About Cybersecurity

These trends balance the need for operational simplicity with other platforms, and provide solutions to cover more of their expanding attack surface.

• Cybersecurity platform consolidation decreases complexity, simplifies operations and makes employees more efficient. Organizations are using fewer vendors and are benefiting from improved staff efficiency and integration, and more features from fewer products.

• Security operating model transformation distributes technology and analytical work to expand the volume, variety and velocity of cybersecurity risk decision making and accelerate business outcomes.

• Composable security is an approach in which cybersecurity controls are integrated into architectural patterns and then applied at a modular level in composable technology implementations. It is designed to protect the changes of composable business and applies to all aspects of a business process.

These trends support the need for balance between people, process and technology, in order to successfully reduce cybersecurity risk.

• Human-centric security design prioritizes the role of employee experience — rather than technical considerations alone — across the controls management life cycle. Drawing upon the behavioral sciences, user-experience (UX) and related disciplines, it helps minimize unsecure employee behavior.

• Enhancing people management shifts focus to human-centric talent management tactics to attract and retain talent. When Chief Information Security Officers (CISOs) do this, they see functional and technical maturity improvements. 

• Increasing board oversight mandates board members attend to cybersecurity as part of their governance and oversight activities. This trend will require additional cybersecurity expertise on boards going forward.

Richard Addiscott is a Senior Director Analyst with Gartner, where he works with information and cybersecurity leaders, covering topics focused on improving security risk management maturity and outcomes, optimizing organizational security risk postures, and demonstrating clear alignment between security and strategic business outcomes.