Cyber resilience needs a place in growth decisions

Cyber resilience is becoming a condition of growth

A partnership that helps a business adopt new technology faster also adds relationships and data handling to its risk decisions. These additions make cyber resilience, the ability to respond and adapt to cyber threats, a condition of growth. Leaders choosing how to modernize therefore need to weigh how quickly they can gain a capability alongside their ability to use it safely.

Protiviti connects these growth decisions with security and resilience in its risk research. As a consulting company advising businesses on risk, technology and transformation, Protiviti benefits commercially when organizations seek help with these challenges. Its findings put a management question at the center of modernization: how can a business gain value from new capabilities while managing the exposure they introduce?

AI and cyber risks shape modernization decisions

The near-term risk rankings in Protiviti’s research show why this question belongs in modernization planning. Half of the top 10 risks concern protecting enterprise value, meaning the business’s overall worth, and cyber threats lead the list. Several kinds of risk fall within this broader category. Its prominence gives leaders a reason to consider protection when deciding where and how the business should change.

Artificial intelligence (AI) adds its own concerns to these decisions: new risks associated with implementing AI rank second in Protiviti’s research, immediately behind cyber threats. For a chief information officer, or CIO, an AI investment therefore involves both the capability the business wants and the consequences of using it. Assessing the opportunity requires examining how adoption changes the company’s exposure and operations.

The assessment needs continued attention after adoption because technology and cyber threats keep evolving. Protiviti describes increasing pressure on CIOs to keep pace. Leaders need to identify vulnerabilities and adjust operations as conditions change, including in the outside relationships through which businesses obtain technology and capabilities.

Alliances expand capabilities and exposure

These outside relationships appeal to executives seeking new capabilities: 65% see significant opportunity in expanding strategic alliances, compared with 62% last year, in the survey discussed by Protiviti. The figures measure perceived opportunity. They show growing interest in partnerships as a route to business development, while leaving each organization to decide which relationships to pursue.

Protiviti says partnerships offer this route by shortening the time needed to access emerging technologies and capabilities. The company also presents a network of partners as an important go-to-market approach, meaning how a company brings its offering to customers. An alliance can therefore influence both what the business can do and how it reaches buyers, helping explain executives’ interest in expanding their relationships.

But expansion also brings exposure: third-party risks, meaning risks associated with outside organizations, rank eighth among the top 10 near-term concerns in Protiviti’s research. Privacy and compliance with identity-protection regulations rank seventh. The first concern involves external relationships; the second involves responsibilities for personal information and people’s identities. Together, they extend risk management into partner relationships and information handling.

Managing this wider responsibility requires cooperation. “No organization can solve the AI or cyber risk challenges alone,” said Kim Bozzella, global CIO and CISO solutions leader at Protiviti. Her recommendation favors collaboration while leaving leaders responsible for examining the vulnerabilities it introduces. For CIOs and chief information security officers, or CISOs, that examination includes suppliers, technology partners and sensitive data handling.

Each area connects a commercial decision with a security responsibility, so assessing an alliance requires input from the people responsible for both. A partner may provide valuable access while introducing vulnerabilities that require operational changes. Understanding those changes helps leaders decide how to pursue the relationship. It also raises a practical question: who inside the business can turn that assessment into action?

Coordinated teams turn risk findings into operational changes

To connect assessment with action, Protiviti recommends close collaboration among information technology (IT) leaders, CISOs and security teams. The sequence is straightforward: identify vulnerabilities together, then adapt operations in response. Joint work brings knowledge of technology and business operations into the security assessment, so findings can reach the people with the authority and responsibility to change the affected operations.

Because those operations can span several functions, Protiviti also calls for security to receive attention across the business. The aim is to help leaders detect threats, make decisions quickly and coordinate their response. A risk arising from a growth partnership can affect the teams pursuing the opportunity as well as those managing technology and security, so they need to consider their responsibilities together.

Shared responsibility is central to the recommendation from Mark Beasley, professor of enterprise risk management and director of NC State’s ERM Initiative, which focuses on managing risk across an organization. “Resilience should be treated as an integrated business capability, not as separate risk, transformation and strategy initiatives,” he said. His recommendation brings exposure, business change and strategic direction into the same discussion, so leaders can recognize when one development affects all three.

Beasley links this integration to management’s ability to respond: “Breaking down silos can help leaders recognize change earlier, accelerate strategic decisions and turn uncertainty into competitive opportunity.” Recognizing change is the first step; acting on it requires cooperation across teams that might otherwise work separately. CIO–CISO collaboration connects recognition with action within technology leadership, while coordination across the business carries that connection into transformation and growth decisions.

Bring risk insight into decisions while they can still change

Coordination gives risk findings a route into decisions, and Matthew Moore, managing director and global leader of legal, risk and compliance at Protiviti, argues that this ability will shape business performance. “Transformation alone will not be enough in 2027,” he said. “The advantage will go to organizations that can turn uncertainty into opportunity, using risk insights to adapt faster, act decisively, and accelerate growth.” Moore’s recommendation extends Protiviti’s commercial case for risk advice into how leaders choose and carry out business change.

For a business considering a new capability or alliance, applying this recommendation means assessing exposure while the decision can still change. A vulnerability found at that stage can influence how the company works with a supplier or technology partner, handles sensitive data, or adjusts operations. The people responsible for these choices need the finding early enough to act, making risk assessment part of choosing how the business proceeds.

Key highlights

• Connect resilience with growth: Technology investments and partnerships introduce exposure alongside new capabilities. Business sponsors need to assess both when choosing how to modernize.
• Assess AI risk throughout adoption: Cyber threats and AI implementation risks lead Protiviti’s near-term risk rankings. CIOs need ongoing vulnerability assessments and operational adjustments as technology and threats evolve.
• Examine partner exposure early: With 65% of surveyed executives seeing significant opportunity in expanding alliances, partnership decisions need security input. CIOs and CISOs need to examine suppliers, technology partners and sensitive data handling before commitments are finalized.
• Connect security findings with operational authority: Joint assessments by IT leaders, CISOs and security teams need to reach the people responsible for affected operations. Coordination across functions helps turn identified vulnerabilities into changes the business can implement.
• Use risk insights while choices remain open: Investment and partnership owners need risk findings early enough to change deployment plans, supplier arrangements or data practices. Bringing those findings into planning gives the business more room to adapt.