Cybersecurity Sustainability

The CISA’s revised vulnerability management approach is another example of this broader industry trend.

For those experienced in applying security frameworks through highly prescriptive approaches, this shift is a welcome one. However, it is worth exploring why the industry is moving in this direction and what it means for organisations seeking effective cybersecurity outcomes.

To understand this change, we first need to understand the concept of sustainability in cybersecurity.

In this context, sustainability refers to the long-term effectiveness of a cybersecurity program when operating within real-world constraints, requirements, and changing conditions.

The Problem

A Practical Example

The limitations of traditional prescriptive security approaches can be illustrated through a simple analogy.

Imagine you rule a kingdom and want to ensure protection from invasion. Your solution is straightforward: place a soldier along every section of your border to eliminate gaps and maximise coverage.

At first glance, this appears logical. However, several challenges emerge:

• You do not have enough soldiers to maintain complete coverage.
• Your borders and operations continue to expand and change over time, increasing resource demands.
• Your borders must remain open to support trade, commerce, and economic activity.

Very quickly, the reality becomes apparent: there is simply too much to protect and not enough resources to protect everything equally.

The Technology Equivalent

Cybersecurity faces an almost identical challenge.

Historically, and in many cases still today, organisations have approached cybersecurity in a highly prescriptive manner, often aligning to recognised cybersecurity frameworks and standards but attempting to implement every control, remediate every vulnerability, or apply security measures uniformly across all systems.

To make matters more challenging, industry standards and frameworks provide guidance that is necessarily broad and cannot always reflect the unique context of every environment.

Continuing the kingdom analogy, this is similar to attempting to build your defensive strategy based entirely on another kingdom’s borders, adversaries, and requirements. Furthermore, it’s not just one kingdom but multiple.

The result is a familiar and inevitable outcome for any IT and security team: increased operational complexity and resource demands lead to pressure on budgets and personnel, ultimately reducing security coverage and effectiveness.

This is one of the fundamental challenges of modern cybersecurity and a key reason the industry is increasingly embracing risk-based and outcome-focused approaches.

The Risk-Based Solution

The reality is simple: we cannot do everything. Resources such as time, personnel, and budgets are finite.

Once this reality is acknowledged, organisations can move beyond purely prescriptive approaches and focus on achieving meaningful security outcomes.

A risk-based security program recognises that not all vulnerabilities, systems, threats, or incidents carry the same level of risk.

Instead, decisions are informed by the likelihood of a risk materialising and the impact to the organisation if it were to occur.

In cybersecurity, likelihood and impact are often influenced by three key contextual factors.

• Threats – The likelihood of a threat actor, such as a malicious attacker or hacker, targeting a system, including their capability, intent, and the availability of exploitation methods.
• Vulnerabilities – Weaknesses that could be exploited by a threat actor. These can include software bugs, misconfigured settings, insecure processes, or other security flaws that increase the likelihood of compromise.
• Criticality – The importance of an affected system, service, or data to the organisation. This may be driven by internal operational requirements, customer commitments, contractual obligations, or external compliance and regulatory obligations.

When these factors are considered together, organisations can better assess the likelihood and impact of a cybersecurity incident, determine risk, and prioritise accordingly.

The objective is no longer to treat every issue equally. Instead, organisations can direct finite resources towards the risks that would have the most significant consequences, creating a more effective and sustainable security program.

A Practical Application

Risk can sometimes appear abstract, but its practical application is often straightforward.

Website Example A

A critical vulnerability has been disclosed in an internet-facing website.

At first glance, this appears to require immediate action because internet-facing systems are generally more exposed and the vulnerability is rated as severe.

However, additional context reveals:

• No known active exploits are available.
• No threat actor activity has been observed targeting the vulnerability.
• The website contains no sensitive information.
• The website is not critical to business operations.
• Existing mitigations significantly reduce the likelihood of successful exploitation.

While the vulnerability itself may be technically critical, the overall organisational risk may be moderate or even low once broader context is considered.

Website Example B

Conversely, a vulnerability with a lower technical severity rating is identified in another internet-facing website.

Initially, this may appear less urgent.

However, in this scenario:

• Public exploit code is available.
• Threat actors are actively exploiting the vulnerability.
• The website supports critical business operations.
• Sensitive customer information is stored or processed through the platform.
• A successful compromise could result in significant financial, operational, or reputational damage.

Despite the lower technical severity, the overall organisational risk may be critical.

This demonstrates a key principle of risk-based security:

The vulnerability itself is only one part of the story. Context and risk determine priority.

Returning to the Kingdom

The same principle applies to our kingdom.

Suppose the northern enemy has the largest army and is known for direct military invasions. On the surface, this appears to be the greatest threat.

However, the northern border is protected by mountains, rivers, and difficult terrain. Trade routes are limited and there are few direct paths into the kingdom.

Meanwhile, the southern border remains open due to active trade and commerce. Most of the kingdom’s population, wealth, and critical resources are also concentrated in the south.

The southern adversaries may be smaller, but they specialise in infiltration and espionage.

When viewed through a risk-based lens, the greatest threat is not necessarily the largest enemy, but the one with the most realistic opportunity to cause meaningful impact.

We can now allocate our soldiers strategically, concentrating resources on the southern border and other areas based on risk.

A Sustainable Approach to Cybersecurity

Risk-based security is ultimately about sustainability.

Threats will continue to evolve. New vulnerabilities will continue to emerge. Technology environments and organisational requirements will continue to change.

These realities cannot be eliminated. What can be controlled is how organisations prioritise risks and allocate their resources.

By understanding threats, vulnerabilities, criticality, and organisational realities such as available resources and the operating environment, organisations can focus their efforts where they will have the greatest impact.

This creates a cybersecurity program that is both more effective and more sustainable over the long term.

Effective cybersecurity is not about implementing everything. It is about implementing the right things for your organisation to achieve security outcomes that can be sustained over time.