With news headlines featuring a steady stream of data breaches, leaked emails and global cyberattacks, it's hard to escape the impression that this threat is escalating. With this growing awareness, New Zealand organisations are increasingly coming to understand that a digital security program is a necessary part of doing business in the modern world.

Despite this new awareness of the threat, for many the solution is less well understood. As a result, defensive strategies are improperly prioritised. Many businesses simply react to security events, rather than preparing for them. Security budgets are misdirected towards shiny toys rather than the IT hygiene fundamentals which have the greatest impact.

When security professionals do get brought in, their effectiveness is limited by organisations who incorrectly believe that placing the tester in a knowledge vacuum to simulate an external attacker is a one-size-fits-all approach.

While organisations with a mature security program can gain value from such exercises, those still developing their security posture may benefit more from closer collaboration with technical experts.

Too often, security professionals are consulted with only when a project is almost complete.Find problems early. Either they incur time and disruption losses in resolving these problems or they accept the risks and proceed with deployment with the intent of finding budget for fixes sometime in the future.

A shift is starting to occur, though. Smaller enterprises are starting to understand what those with more mature information security programs have understood for some time. The cost of retrofitting security to a solution far exceeds that of investing in security review and consultation during the design and planning stages.

Businesses that are in a strong position to defend against the current threat landscape have processes and templates in place to ensure that new systems are built with secure-by-default platforms as a foundation.

Modern organisations bake security into their every operation. They engage with security experts who can provide guidance and context such that their businesses can take the initiative in making informed risk decisions, rather than scrambling to clean up security issues when it is more costly.