Cybereason Announces 'Persona Spotlight: CIO (Chief Information Officer)' for the AI Era

Cybereason G.K. (A LevelBlue Company), which provides the AI (Artificial Intelligence)-powered cyberattack defense platform "Cybereason" in Japan, has released a survey report titled "Persona Spotlight: CIO (Chief Information Officer)". The report targeted 1,500 CIOs and their direct reports in 12 countries, including the United States.

Facing the increasing severity of AI threats, CIOs strongly recognize the need for AI-driven cybersecurity tools but face significant challenges in building and operating effective defense systems in practice. Furthermore, this survey highlighted a structural problem where limited budgets are spent on reactive "firefighting," delaying proactive investments. To overcome this situation, the report revealed an urgent need to shift towards a resilience strategy that deepens management involvement and integrates security from being an IT department-only issue to a concern across all business units.

■ Key Points of This Survey Report

1. While 71% consider investment in AI tools essential, only 20% of CIOs feel their effectiveness in practice.

* 51% predict AI-powered attacks will occur within the next 12 months.
* 72% responded that AI-driven cybersecurity tools are necessary to improve the organization's threat detection and response capabilities.
* Only 20% responded that their organization's efforts in defending against AI-powered attackers are "extremely effective."
* 71% responded that building adaptive security enables companies to take greater risks in innovation.

2. Enormous costs spent on reactive measures and the necessity of a proactive security strategy.

* 62% spent more on "firefighting" incidents that had already occurred than on threat prevention and detection in the past two years.
* 46% predict that the damage from cyber breaches will be even greater if security strategies do not become more proactive.
* 41% responded that internally managed security solutions are "effective."
* Less than 47% responded that a company-wide cybersecurity culture is "effective."

3. Nearly 70% do not positively evaluate collaboration between business units and security departments.

* 47% responded that management not prioritizing cyber resilience is a barrier to improvement.
* 49% prioritize integrating cybersecurity into business units and all projects within the next 12 months.
* Only 33% rated the collaboration between cybersecurity teams and business units as "very effective."
* Less than 50% responded that they have established key performance indicators (KPIs) that effectively link security and business outcomes. However, the same number (less than 50%) responded that business risk tolerance and security risk management are not effectively linked.

4. High vigilance towards software supply chains: Over 56% responded that software supply chain attacks are an imminent threat, stating the need to strengthen the supply chain.

* 59% responded that software distribution channels, and 57% responded that third-party risk management, pose high risks, both exceeding the overall senior executive figure (49%).
* Only 22% responded that they are "very effectively responding."
* 70% responded that they have made moderate to significant investments in enhanced software supply chain security.
* Only 25% responded that the introduction of AI poses a risk to software supply chain risk. They view AI's potential to improve software supply chain risk management positively.

■ Recommended Points for AI-driven Cyber Resilience

* **Link to business value:** Explain the benefits of AI for cyber resilience to management and connect relevant strategies to improving business value.
* **Management awareness reform:** Increase alignment in management policies to strengthen overall organizational resilience.
* **Collaboration with external experts:** Promote collaboration with incident response and threat intelligence experts to prepare for new attack methods.
* **Supply chain risk management:** Strengthen overall supply chain risk management, such as identifying vulnerabilities related to third parties and implementing strict due diligence.

【About This Survey】

* **Survey Period:** January 2025
* **Survey Method:** Quantitative survey by FT Longitude
* **Target:**
* **Countries/Regions:** United States, United Kingdom, France, Germany, India, Australia, Canada, South Korea, Singapore, Brazil, Ireland, Mexico
* **Employee Size:** Less than 999 employees (2%), 1,000-1,999 employees (42%), 2,000- employees (remaining percentage)