Featured Article

Develop a serious cybersecurity strategic plan that incorporates CCM

A company that’s been hacked is a less attractive acquisition target


Image Credits: Jon Feingersh Photography Inc (opens in a new window) / Getty Images

Robert R. Ackerman Jr.


Robert R. Ackerman Jr. is the founder and managing director of AllegisCyber, a venture capital firm specializing in cybersecurity, and the co-founder and executive at DataTribe, a cybersecurity startup foundry which focuses on launching startups based on cyber domain expertise from the intelligence community and national laboratories.

More posts from Robert R. Ackerman Jr.

It’s a new year and corporate concerns about cybersecurity risk are high. Which means top executives at Fortune 500 companies will do what they always do — spend big on security technology. Global cybersecurity spending is on a path to exceed $1 trillion cumulatively over the five-year period from 2017 to 2021, according to Cybersecurity Ventures.

But increasing budgets each year with little strategic forethought is a corporate failing. Further, the lack of proactive monitoring of cyber risk profile almost ensures gaps and vulnerabilities that will be exploited by hackers.

Corporations that don’t formulate a thorough cybersecurity plan and monitor its implementation will encounter more breaches and increasingly become mired in scuttled M&A opportunities. Market research firm Gartner says that 60% of organizations engaging in M&A activity are already weighing a target’s cybersecurity track record, posture and strategy as a key factor in their due diligence. A company that has been hacked is a less attractive acquisition target — hardly a minor point, given that M&A activity globally, led by the U.S., has set records in recent years and is widely expected to maintain or exceed this level going forward.

The most highly publicized example of an M&A-related cybersecurity headache was Verizon’s discovery of a prior data breach at Yahoo a couple of years ago, after formulating an acquisition agreement. The discovery almost killed the deal and ultimately resulted in a $350 million reduction in Verizon’s purchase price.

Enterprises must step up to the plate once and for all and develop meaningful metrics to assess the quality of their cybersecurity protection and monitor its completeness and effectiveness. And the best way to do this is to begin taking steps to incorporate continuous controls monitoring (CCM).

The ultimate goal of CCM is to ensure real-time visibility into the cybersecurity posture of the enterprise while identifying coverage gaps for priority remediation and introducing a level of accountability into the effectiveness of the spectrum of products and tools that are likely installed within an enterprise’s security operations. At the end of the day, it’s about monitoring and measuring effectiveness and providing a framework for determining ROI from cybersecurity investments.

Adopters of CCM, which provides a thorough snapshot of an enterprise’s cybersecurity posture in real time, must first begin scoping their cybersecurity ecosystem. Understanding all the nooks and crannies inside their enterprise and outside with third-party vendors is critical. It’s best to start with easy CCM controls as a pilot, providing the opportunity to work out kinks without big headaches and to help build the confidence of the technical team involved. Analytics, of course, also have to be run on the collected data.

Early versions of CCM, recently introduced into the market, enable companies to stop playing whack-a-mole when trying to discern which one or two of scores of security threats are truly legitimate, then swiftly respond. CCM helps reduce business losses by using effective continuous auditing mechanisms and control monitoring of various aspects of cybersecurity procedures — courtesy of a dashboard providing a holistic view of a company’s cybersecurity posture.

The concept of continuous monitoring in an enterprise isn’t new — it has been used successfully in financial auditing for years — and tool vendors such as Panaseer, Prevailion, vArmour and Code Dx have begun introducing the required goods. The federal Office of Management and Budget has already been ramping up for the implementation of CCM for a year, and Goldman Sachs is also an early adopter.

For CCM adopters, scoping their cybersecurity ecosystem is simply the start of a multi-step process. The implementation of CCM actually entails five additional steps. They are:

Take time to thoroughly understand your IT footprint. In particular, analyze how CCM will be incorporated into your company’s entire IT and compliance strategy and how it may change over the next five years. This helps to determine which CCM system is best for you.

Gauge your security needs with the help of risk analysis and then prioritize them. Also take the measure of your in-house cybersecurity talent. Decide who can help implement and work with CCM and whether your budget may need to be increased to accommodate outside experts and unknown contingencies.

When you do your pilot testing, make a point of gauging each test before wrapping it into the total CCM solution. Otherwise, this could lead to a larger number of falsely reported cyberattacks. This may also enable better tailoring of your CCM solutions to the specific needs of your organization.

Establish an escalation protocol. If a legitimate red flag arises, this would trigger additional investigation to determine whether a wider problem exists. The protocol should include the notification of specific individuals and departments and, depending on the circumstances, an automatic call for outside help.

Make documentation a priority. If a red flag does spark an investigation, it’s important to carefully document every step that is taken and store this information so it can be easily and quickly retrievable if a regulator wants to review them.

There is one more key step involved in the proper implementation of CCM. After all of this is accomplished and CCM is implemented in your organization, work obviously has to be subsequently done to gauge the value and resilience of the CCM technology.

After a year, for example, companies will know how many cyberattacks were stopped before they became outright breaches and how quickly they were stopped. Then, to the extent possible, they have to compare this data with similar cybersecurity data in past years. Improvement in the number of cyberattacks caught early may be the best single indicator of success.

The ultimate goal of CCM is to stop cyber breaches in the first place, but CCM alone will not accomplish this mission. CISOs and other top cyber executives must also convince top executives that they must learn to trust them. The CEO and the board of directors need to realize that cybersecurity is not a priority only when an intrusion occurs.

If there is any debate about this, it will end soon with the pending implementation of new 5G networks, which could easily become the single most challenging issue in the cybersecurity world. 5G will introduce a new era in which billions of additional devices will be connected to the internet every year, each running crucial applications and infrastructure at hundreds the times the speed of the current internet.

Wireless infrastructure will explode, capitalizing on brand-new infrastructure to connect geographies and substantially improve smart city infrastructures, among other things. But 5G will also materially darken the threat landscape. In fact, potential physical damage at a 5G pace is almost unthinkable.

No question, we’ll be needing a better cybersecurity playbook, one replete with CCM technology. It’s time for enterprises to strategize seriously and realize they must move from firefighting to fireproofing.

More TechCrunch

“When I heard the released demo, I was shocked, angered and in disbelief that Mr. Altman would pursue a voice that sounded so eerily similar to mine.”

Scarlett Johansson says that OpenAI approached her to use her voice

The European venture capital firm raised its fourth fund as fund as climate tech “comes of age.”

ETF Partners raises €284M for climate startups that will be effective quickly — not 20 years down the road

Copilot, Microsoft’s brand of generative AI, will soon be far more deeply integrated into the Windows 11 experience.

Microsoft wants to make Windows an AI operating system, launches Copilot+ PCs

Hello and welcome back to TechCrunch Space. For those who haven’t heard, the first crewed launch of Boeing’s Starliner capsule has been pushed back yet again to no earlier than…

TechCrunch Space: Star(side)liner

When I attended Automate in Chicago a few weeks back, multiple people thanked me for TechCrunch’s semi-regular robotics job report. It’s always edifying to get that feedback in person. While…

These 81 robotics companies are hiring

The top vehicle safety regulator in the U.S. has launched a formal probe into an April crash involving the all-electric VinFast VF8 SUV that claimed the lives of a family…

VinFast crash that killed family of four now under federal investigation

When putting a video portal in a public park in the middle of New York City, some inappropriate behavior will likely occur. The Portal, the vision of Lithuanian artist and…

NYC-Dublin real-time video portal reopens with some fixes to prevent inappropriate behavior

Longtime New York-based seed investor, Contour Venture Partners, is making progress on its latest flagship fund after lowering its target. The firm closed on $42 million, raised from 64 backers,…

Contour Venture Partners, an early investor in Datadog and Movable Ink, lowers the target for its fifth fund

Meta’s Oversight Board has now extended its scope to include the company’s newest platform, Instagram Threads, and has begun hearing cases from Threads.

Meta’s Oversight Board takes its first Threads case

The company says it’s refocusing and prioritizing fewer initiatives that will have the biggest impact on customers and add value to the business.

SeekOut, a recruiting startup last valued at $1.2 billion, lays off 30% of its workforce

The U.K.’s self-proclaimed “world-leading” regulations for self-driving cars are now official, after the Automated Vehicles (AV) Act received royal assent — the final rubber stamp any legislation must go through…

UK’s autonomous vehicle legislation becomes law, paving the way for first driverless cars by 2026

ChatGPT, OpenAI’s text-generating AI chatbot, has taken the world by storm. What started as a tool to hyper-charge productivity through writing essays and code with short text prompts has evolved…

ChatGPT: Everything you need to know about the AI-powered chatbot

SoLo Funds CEO Travis Holoway: “Regulators seem driven by press releases when they should be motivated by true consumer protection and empowering equitable solutions.”

Fintech lender SoLo Funds is being sued again by the government over its lending practices

Hard tech startups generate a lot of buzz, but there’s a growing cohort of companies building digital tools squarely focused on making hard tech development faster, more efficient and —…

Rollup wants to be the hardware engineer’s workhorse

TechCrunch Disrupt 2024 is not just about groundbreaking innovations, insightful panels, and visionary speakers — it’s also about listening to YOU, the audience, and what you feel is top of…

Disrupt Audience Choice vote closes Friday

Google says the new SDK would help Google expand on its core mission of connecting the right audience to the right content at the right time.

Google is launching a new Android feature to drive users back into their installed apps

Jolla has taken the official wraps off the first version of its personal server-based AI assistant in the making. The reborn startup is building a privacy-focused AI device — aka…

Jolla debuts privacy-focused AI hardware

The ChatGPT mobile app’s net revenue first jumped 22% on the day of the GPT-4o launch and continued to grow in the following days.

ChatGPT’s mobile app revenue saw its biggest spike yet following GPT-4o launch

Dating app maker Bumble has acquired Geneva, an online platform built around forming real-world groups and clubs. The company said that the deal is designed to help it expand its…

Bumble buys community building app Geneva to expand further into friendships

CyberArk — one of the army of larger security companies founded out of Israel — is acquiring Venafi, a specialist in machine identity, for $1.54 billion. 

CyberArk snaps up Venafi for $1.54B to ramp up in machine-to-machine security

Founder-market fit is one of the most crucial factors in a startup’s success, and operators (someone involved in the day-to-day operations of a startup) turned founders have an almost unfair advantage…

OpenseedVC, which backs operators in Africa and Europe starting their companies, reaches first close of $10M fund

A Singapore High Court has effectively approved Pine Labs’ request to shift its operations to India.

Pine Labs gets Singapore court approval to shift base to India

The AI Safety Institute, a U.K. body that aims to assess and address risks in AI platforms, has said it will open a second location in San Francisco. 

UK opens office in San Francisco to tackle AI risk

Companies are always looking for an edge, and searching for ways to encourage their employees to innovate. One way to do that is by running an internal hackathon around a…

Why companies are turning to internal hackathons

Featured Article

I’m rooting for Melinda French Gates to fix tech’s broken ‘brilliant jerk’ culture

Women in tech still face a shocking level of mistreatment at work. Melinda French Gates is one of the few working to change that.

1 day ago
I’m rooting for Melinda French Gates to fix tech’s  broken ‘brilliant jerk’ culture

Blue Origin has successfully completed its NS-25 mission, resuming crewed flights for the first time in nearly two years. The mission brought six tourist crew members to the edge of…

Blue Origin successfully launches its first crewed mission since 2022

Creative Artists Agency (CAA), one of the top entertainment and sports talent agencies, is hoping to be at the forefront of AI protection services for celebrities in Hollywood. With many…

Hollywood agency CAA aims to help stars manage their own AI likenesses

Expedia says Rathi Murthy and Sreenivas Rachamadugu, respectively its CTO and senior vice president of core services product & engineering, are no longer employed at the travel booking company. In…

Expedia says two execs dismissed after ‘violation of company policy’

Welcome back to TechCrunch’s Week in Review. This week had two major events from OpenAI and Google. OpenAI’s spring update event saw the reveal of its new model, GPT-4o, which…

OpenAI and Google lay out their competing AI visions

When Jeffrey Wang posted to X asking if anyone wanted to go in on an order of fancy-but-affordable office nap pods, he didn’t expect the post to go viral.

With AI startups booming, nap pods and Silicon Valley hustle culture are back