Insurance and Regulations May Be Biggest Security Drivers of 2023

When talking about big influences on cybersecurity, we tend to think about sweeping trends like digital transformation and the hybrid work revolution. And that makes sense. Cloud adoption, for example, has created complex corporate infrastructures. This is forcing the security industry to rethink how they protect data.

In 2023, I believe we will see new forces emerge that will influence the direction of the industry writ large. First, data privacy and security regulations are picking up steam globally. While they create safeguards for personal data privacy, they also create new challenges for security. At the same time, cyber insurance providers are asking for additional security tool adoption for underwriting. Managed security services providers (MSSP) and managed detection and response (MDR) vendors will also have even greater influence on an organization’s selection of security tools. 

As we enter the new year, there will be countless trends at play, but some will be more influential than others. Below are the four that you should watch closely in 2023.

Regulations to reshape our approach to data protection 

This trend is definitely not brand new. A few years back, laws like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) drove the first wave of regulations that shifted the way the technology industry operates.

But legislation and regulations are accelerating as individuals become hyper aware of data collection practices and issues related to their personal privacy. In the U.S. alone, the federal government is contemplating nationwide privacy legislation, and five states have data privacy regulations going into effect in 2023. 

In the near future, privacy built into products won’t be just a compliance checkbox to meet but a key component of the software development lifecycle. Security vendors may even offer configurable privacy “knobs” in their products, giving greater control to the organization and even the end user on what data may be collected. 

As a consumer, this is great news — it means your data can no longer be freely mined for profit. But for cybersecurity, this can create new challenges, because we’ll have to find new ways to monitor for threats while being more conscious of the way we collect data. Part of this may result in additional manpower requirements, which puts a strain on the existing skills shortage. On the flip side of this, there are major technology players whose business model is based on personalized advertising, and we expect them to come up with new ways to accomplish their goal, which may further endanger personal data privacy.

Cyber insurance will drive security requirements

Another driver reshaping the security industry is coming from the cybersecurity insurance providers. As data breaches become more common, businesses are increasingly looking to mitigate this risk with cybersecurity insurance, and insurance companies are looking for ways to minimize payout. 

Instead of accepting all organizations that seek cyber insurance, insurance providers are raising the bar for coverage. As the skills shortage continues and attackers become more sophisticated, insurance providers are asking organizations to meet an even longer list of requirements to qualify for plans or payouts. I can only anticipate that this list will grow.

Automation and orchestration to be a focus

One of the areas insurance providers may focus on is a minimum level of automation and orchestration capabilities built into the security products used by organizations.

This trend isn’t just pushed by insurance requirements either. Security professionals are already being bombarded by unprecedented levels of threats, and at the same time, there is a severe labor shortage. Automation reduces human inputs and drives scalable processes, and orchestration brings disparate security alerts together to help initiate remedial actions, which can decrease response times.

I expect to see improvements in automation and orchestration that are incorporated into broader product platforms. They will likely offer tighter integrations and interoperability with other vendors’ security tools as well, so that operators do not have to take as many actions from disparate tools. The need for security products that take automated actions may impact the cyber insurance policies of the future as well.

This pivot to automation and orchestration should make security products more plug and play, enabling existing security professionals to do more with fewer resources. It will also make onboarding new personnel easier because security products that incorporate these components won't require as great a technical depth of knowledge to configure and manage.

MDR and MSSP to become go-to resources

With compliance and insurance requirements piling up, I foresee managed services like MDR and MSSPs becoming more popular. As breaches increase in frequency, organizations are looking to rapidly expand their teams without needing to hire more people, which has become a challenge due to the shortage of security professionals.

In addition to acting as an extension of an organization’s security operations, MDR and MSSPs are also becoming influential in driving adoption of security tools. As they are brought in, they can quickly pinpoint what isn’t working in the organization’s security tool stack and make recommendations for vendors they trust to better protect the organization in areas where they’ve identified inadequacies. I believe this will also help promote new product integrations, as MDR and MSSPs look for sets of tools that work well with each other in an enterprise's ecosystem.

Continue looking for trends in unexpected places

Up until recent years, cybersecurity initiatives have often been created as in-house programs. IT and security teams would identify issues and then purchase products to address them.

In 2023 and beyond, this “homegrown” approach to security is no longer feasible. If you’re looking to purchase insurance or operate within a certain jurisdiction, there are new requirements you need to be mindful of. And they will drive you to expand your security teams, their areas of expertise, and their operational capabilities. I believe this will require a further blending of "man + machine" or human intelligence that is augmented by automation, as well as outside guidance and expertise from MSSPs and MDR vendors.

As you review your organization’s security posture for the new year, be sure to stay aware of these trends and adapt accordingly. Don't simply assess the capabilities and efficacies of the security tools you have today, but look more closely at these key areas and how they will impact your evolving cyber security programs and frameworks.