An organization’s management, both executives and board, need to view cybersecurity as not just a cost center but a way to enable the business to move forward at a faster pace, instead of slowing it down. Managing risk exposures with proactive cybersecurity tools and platforms should be a mindset, not a technology requiring investment. Since good risk management is the foundation of trust, organizations that do it well achieve the trust outcomes mentioned in our framework, benefiting themselves as well as partners and customers. Engendering trust within and outside an organization helps build loyalty; it only takes one lapse in the management of cyber-risk exposure to tear down what took time to build.

IDC’s expanded view of risk exposures includes:

Unknown IT assets, including cloud assets, which are left unprotected by endpoint security tools
Open ports that can be accessed by attackers from outside the organization
End-of-life software because discovered issues are no longer being fixed
Unsupported/antiquated devices that lack innate protections such as printers or IoT/OT assets
Forgotten/unused/unauthorized applications, including SaaS applications, because the security team is not paying attention to vulnerability issues in that software, nor the data that is being stored in and transferred to or shared through that application, and nor misconfigurations in user access policies or password policies
Remote desktop protocol (RDP) open to the internet
Misconfigurations in cloud access policies
Unknown domains/subdomains and forgotten subsidiaries
Data in the cloud that is inadvertently exposed to cloud administrators through improper cryptographic key management
Sensitive or confidential data that is stored improperly with a “trusted” third party
Expired certificates because the browser cannot tell whether the website is authentic (If the users do connect, they cannot be assured that their communications with the website are secure and not through someone in the middle rerouting their traffic.)
Unknown application programming interfaces (APIs) since APIs are being used to share information between applications (The APIs may be created by the organization or a third party to share information or integrate with partner applications.)
Vulnerabilities in the code and applications the organization writes or assembles from open source
Data exposed through lazy backup practices such as information stored in public folders during routine backup maintenance
Hardcoded credentials/secrets such as API keys stored where they are accessible to attackers

The search and discovery of risk exposures needs to be continuous; there should be continuous scanning to enable continuous discovery and monitoring for continuous assessment and analysis of the data. Environments have grown complex with hybrid work, hybrid cloud, ephemeral workloads, and no traditional perimeter that can be protected by a firewall, so point-in-time data is not good enough. The days of monolithic software applications that are updated twice a year on a planned cadence have passed, replaced with a reality of a CI/CD-fueled microservices software architecture that experiences up to thousands of code drops daily. Today much of the code is open source as opposed to being developed internally.

In addition to new types of exposures, the sheer number of common vulnerabilities and exposures (CVEs) is growing as more are being identified and they are also being weaponized more quickly. Security teams need help to make sense of what is important.

Today, many point security products identify and report on these exposures including attack surface management (ASM), cloud workload protection, application security orchestration and correlation (ASOC), SaaS security, API security, certificate management, and vulnerability management. The data may come from various types of sensors: passive sensors, network scanners, internet scanners, agents, virtual scanners, secrets scanners, cloud connectors, APIs, and SaaS connectors. Each point product has its own reporting system and possible integrations with other platforms, making it harder, if not impossible, to correlate the data.

Ideally, all risk exposures should flow into a singular system, no matter how they are discovered, to ensure they can be comprehensively prioritized so the security team can direct their efforts accordingly and ensure it is maximizing cyber-risk reduction across the organization. The risk exposures need to be assessed, measured, and risk weighted based on a singular, homogeneous scoring criteria instead of individual security tools each measuring risk in its own unique fashion. Then the risk score is a comprehensive measure of cyber-risk that can then be integrated into the ultimate assessment — business risk.

Consolidation of point solutions provides a view of risk that, when combined with threat intelligence, provides a reality context weighted view. For example, a vulnerability that is recognized to have a known rootkit being leveraged within your market vertical and geography has a higher risk, all other things being equal, than one that does not. Other benefits may include a reduction of agents, simplicity in implementing automation, volume-based pricing available from a single vendor, and potential tool consolidation because fewer vendors require less time to manage.

In the meantime, some organizations could take even smaller steps towards better proactive cybersecurity by improving the percentage of assets scanned or scanning for vulnerabilities more frequently. According to IDC’s December 2022 Security Operations Center Survey, though device vulnerability management/scanning solutions are used by 82% of U.S. organizations with more than 500 employees, only 34% scan at least weekly. Only 26% report scanning 85% or more of their known IT assets. And that is the known assets; organizations may find around 30% more assets in their shadow IT that is unknown until an external scan is done.

In conclusion, cybersecurity risk management is not an end goal but a journey because the threat environment is continuously evolving, as is the organization. Being proactive means understanding the risk, determining what risk exposures are acceptable and remediating those that are not. Trust is an outcome of successful risk management.

Thinking and management of risk exposures needs to be more broad than traditional vulnerability management.
Visibility into the IT environment is key to proactive cybersecurity because a security team cannot protect the unknown, whether that is assets or applications.
Proactive cybersecurity focuses on controlling the controllables, not just reacting to an attack.
Recommended Actions:
Monitor the environment continuously for previously unknown risk exposures because cyber attackers are doing the same.
Investigate holistic risk exposure platforms in order to use standardized risk scoring to report on cyber risk from all parts of the IT environment.
Remediate the risk exposures as soon as possible using automated workflows when feasible because attackers are moving faster than ever before.
Share the risk data throughout the organization to make good cyber hygiene part of everyone’s job.

“With IT environments growing more complex and potential risk exposures more numerous, organizations need to think about using a holistic proactive cybersecurity management platform that brings all cyber-risk exposures to one place, so they are scored in the same manner. One management platform also simplifies prioritization and reporting.“

Michelle Abraham, research director, Security and Trust, IDC

Many organizations do not work in a shared, co-innovative way with industry ecosystem partners.  They may have limited or no sharing and collaboration other than the day-to-day connection with suppliers or service providers.  For some, that may be enough. 

We think, however, that every organization can benefit from expanding the breadth and type of industry ecosystem partners, from a variety of industries.  In fact, our global Future of Industry Ecosystems survey showed that by the end of 2023, almost 60% will be expanding the number of partners they work with outside of their core industry.  This is the ultimate state of an industry ecosystem, but accessible to any size organization, even for a specific short-term project, initiative, or use case. 

However, it could be that extending outside of a core industry is not feasible or desired for an organization, so the goal is to establish a diverse industry ecosystem of partners within the core industry that support and enhance decision velocity within, and outside, their organization.

The maturity of an industry ecosystem will vary from organization to organization – and may change from a simple, short list of organizations working on a specific project or venture, to a complex, multi-participant ecosystem. 

In February 2023, we set out to determine the current state of industry ecosystems by fielding the Future of Industry Ecosystems MaturityScape Benchmark survey (report forthcoming). The survey asks respondents to self-rank themselves based on the IDC Future of Industry Ecosystems maturity curve (full report here: IDC MaturityScape: Future of Industry Ecosystems 1.0). The majority of respondents see their organizations as having a dynamic value chain in place, well beyond an ad hoc or opportunistic approach. 30% of respondents feel they have a broad range of partners that constitutes an industry, or business, network.  While under 20% of respondents note that they are actively and regularly working with partners outside of their core industry. 

While many organizations have a standard value chain in place, half of respondents do not have a multi-faceted, expanded industry network to support their business operations.  We know from our Future of Industry Ecosystems 2023 survey data that there is indeed a focus on this expansion, both inside and outside the organization’s core industry.  Partnering outside of the core industry is a nascent approach, although desired in the future, as organizations consider the use cases for the various functions within their businesses that could benefit.  This would be in addition to the standard industry network partnerships that are in place. 

Organizations are expanding their industry ecosystems to include a vast array of different participants, so that they are complemented by a varied set of knowledge, skills, capability, or capacity that they may not possess.  These participants may be classical design and supply chain partners, but also the customer, end consumer, citizen, and patient which can provide input on products, processes, and quality.  Competitors are joining forces to address common challenges or team up for innovation that benefits and progresses an entire industry – we have seen this, for example, in the oil & gas, automotive, and transportation industries.  Maturing industry ecosystems to this approach is the goal for organizations that want an on-demand, flexible approach to running their businesses – whether there is disruption to address, or opportunity to pursue.

IDC defines industry ecosystems as including a set of partners, customers, suppliers, service providers, industry organizations, governmental entities, experts, and competitors within and outside your industry that you can dynamically collaborate and innovate with as necessary. This could include industry clouds, business networks, consortia, expert forums, industry and governmental (public) organizations, supply chains, cloud platform services, consulting and systems integrators (SIs), and the end user — customers, consumers, citizens, and patients. 

As our Future of Industry Ecosystems MaturityScape Benchmark survey research shows, the first steps have been taken by many organizations to expand their industry ecosystems, establishing a network of capability, capacity, support, expertise, and knowledge that can be scaled up and down as required. The next step, according to IDC’s 2022 Future of Industry Ecosystems Global Survey as well as this MaturityScape Benchmark analysis, is to incorporate partners from outside the core industry, learn best practices, and add assets, resources, and knowledge that may not be present within their core industry.

We will continue to watch, analyze, and predict this evolution as part of our Future of Industry Ecosystems research practice, in 2023 and beyond. 

It’s practically impossible to avoid the buzz about the latest artificial intelligence (AI) tool, ChatGPT. Since its launch in 2022, people have praised its many advantages. These include boosting productivity, content creation, and conversational interaction.

There’s no doubt that ChatGPT and other AI language tools can be hugely beneficial to companies. But amidst the buzz, there are still many questions to be answered.

What exactly is ChatGPT?

I am ChatGPT, a large language model created by OpenAI. I have been trained on a vast amount of data and can perform a variety of natural language processing tasks, such as answering questions, generating text, and translating languages. My purpose is to assist and provide information to those who interact with me.

Source: ChatGPT

ChatGPT is a language tool that is based on the concept of “generative pretraining”, a type of unsupervised machine learning technique that involves training a neural network to generate new data that is similar to a training set of existing data.

Machine learning enables computers to learn from large amounts of text data, such as web pages and books. This training data is used to generate new text with a similar style and content. The result: a powerful tool for businesses that rely on content marketing and sales to drive their digital commerce.

What are its current limitations?

The research interface for ChatGPT includes three major disclaimers, as follows verbatim:

May occasionally generate incorrect information
May occasionally produce harmful instructions or biased content
Limited knowledge of the world and events after 2021

How can I use ChatGPT for business?

Customer Support

ChatGPT and other chatbots offer immense potential for e-commerce. By leveraging browsing history, purchase records, and other metrics related to a user’s behavior, these chatbot technologies may soon become integral components of personalization engines for e-commerce sites.

Automate tasks and workflows

ChatGPT can manage time-consuming tasks like scheduling meetings, generating event reminders, and responding to emails and reviews.

Search Engine

Although ChatGPT isn’t specifically designed to be used as a search engine, it can be a good tool to start research on a project or generate ideas. It’s important to take into account that ChatGPT is limited to the information it has been trained on, unlike search engines like Google or Bing, which are specifically designed to crawl the web and index information.

Content creation

ChatGPT is a great tool for generating ideas and creating short-form content, including copy for social media posts. Ryan Reynolds, actor and owner of Mint Mobile, recently used ChatGPT to write a script for a commercial using just a few phrases. He called the outcome compelling and mildly terrifying.

Employee training

Employees can use natural language to engage with ChatGPT to get quickly educated on a product or service that they do not fully understand or to get guidance on a unique situation by simply providing some of the key issues they are facing.

What should we look out for next?

Open AI launched GPT-4 on 3/14, 2023. This next generation of GPT may be better at preventing hallucinations, the phenomenon of generating extremely authoritative-sounding misinformation at a rapid pace. The new GPT is a multimodal model and is able to accept both text and image inputs.

What actions do you recommend we take right now?

Optimize your in-house content creation with GPT-3. GPT-3 is designed to augment the content marketing industry and is good at writing compelling short-form ad copy, even though everything it writes will be derived from content already existing online.
Do not replace existing content teams with ChatGPT technology. Even though it can do incredible things, it is still in essence an elevated form of autocomplete.
Plan for the future of online customer service today. ChatGPT was designed to disrupt the customer service industry.
Realize that GPT-3 and ChatGPT cannot currently disrupt the digital personalization and paid search industries. ChatGPT is currently limited to the analysis of public web content published prior to 2021, but the possibility for disruption of the paid search industry certainly exists in the future.

Despite a seemingly never-ending list of headwinds, the CEO word of the year for 2023, according to IDC’s Study, is “growth.” Many CEOs are expressing an appetite to invest strategically prior to the economy stabilizing and, in some cases, capitalize on having the first mover advantage among their competitors. One CEO we spoke with during our interview series stated: “Investing when money is free and everything is growing is easy, but investing in times where stuff is really tough…you’re probably the only one, but once you get out… [once the economy recovers] you get a bigger market share.”  CEOs are confident that technology is a powerful tool to transform, scale, and optimize businesses. 87% of CEOs stated that they are looking to sustain or increase technology spending in 2023.  

Feedback from 395 CEOs across the globe will help technology vendors understand risks, spending priorities, expectations from the role of the CIO, and expectations from strategic technology partners. More will be discussed in an upcoming webinar.  

IDC’s study shows that there are 4 priorities for the forward-thinking CEO in 2023.  

Remain agile in the face of economic uncertainty by doubling down on digital business initiatives and strategies.  

When asked to identify the three risks that will have the greatest impact to their organization in 2023, CEO respondents pushed economic pressures to the top of the list. This included challenges from both persisting inflation and the looming threat of a potential recession. As many of us wait with bated breath for the soft-landing pledged by central banks, it is still unclear what mid- to long-term impact aggressive quantitative tightening will have on regional and global markets.  

This is perhaps why when asked the same question about risks in two years, the top answer from CEO respondents, economic pressures, does not change. CEOs are evidently buckling up for a turbulent economic time – one that is unlikely to go away overnight. In the face of this uncertainty, many CEOs are implementing agility in their organization’s IT budgeting process. Most CEO respondents have identified macroeconomic scenarios that would result in budget adjustments at some point this year.  

The exogenous nature of economic uncertainty also led many CEOs in our interview series to underscore the importance of focusing on factors within the organization’s control. While the economy is unpredictable, the case for digital business strategies is largely in the hands of the executive team. This was reflected in the second most prevalent risk highlighted by CEOs in the two-year time frame – digital business execution gaps. In other words, CEOs understand investment in digital business initiatives is necessary and that the roadblocks to operationalization severely threaten to impact the organization’s long-term viability. Technology investments are under close watch from the executive layer and the direct connection to measurable business outcomes is non-negotiable. In fact, two-thirds of CEO respondents articulated that a critical technology initiative in 2023 will be focusing on using technology to drive more revenue generating activities.  

Raise the profile of the CIO to a strategic decision-maker 

The role of the CIO must also expand to reflect the strong emphasis on using technology to drive revenue generating activities. In 2023, most CEOs expect the CIO to focus on achieving better business outcomes, improving business agility, and leading DX to create new revenue streams. This does not mean that the CIO should forgo the responsibilities of managing cost and risk. Rather, what it does reflect is that CEOs want CIOs to step beyond an operational focus and help drive measurable business outcomes – whether the target is a financial or quantifiable benefit.    

This elevation of the role of the CIO can be observed in organizational reporting lines. In the 2023 study, well over half of CEOs indicated that their organization’s CIO reports directly to them. In the past, many CIOs reported to their organization’s CFO, hindering a direct connection with the CEO. As organizations become increasingly digitally focused, technology permeates every functional area. It’s in the best interest of the CIO to take this opportunity to collaborate across the C-Suite and orchestrate the use of technology across end-to-end business processes.  

Balance business growth and technology efficiency  

According to IDC’s study, CEOs are prioritizing technology spending on security and compliance, infrastructure and operations, and workplace solutions. While it is undeniable that technology investments are vital to growing a digital business, 2023 will not follow the same lavish spending on technology seen during 2021. 

The downside risk of a major security breach materializing can threaten business critical operations, and the negative press associated with such an event is too great for CEOs to ease up on security and compliance spending in 2023. This spending priority aligns well with the CIO sentiment.   

The interest in infrastructure and operations includes cloud spending, which has been a key foundation to enabling digital business. Whether an organization is developing a mobile application or ecommerce site, or the using SaaS products to standardize, automate, and/or expedite business processes, infrastructure and operations is behind the scenes making these things possible.  

There is however, increasing concern over cloud technology costs. Like many of us are overwhelmed with the cost of subscriptions and utilities in our own personal household budgets, so are the CIOs when planning for and paying the bills for their organization’s cloud consumption. While CEOs are focusing on growth, CIOs have expressed focusing on efficiency.   

A focus on growth and efficiency provides a much-needed balance in the C-Suite. Growing without regard for cost is unsustainable. At the same time, there is a limit to how much you can optimize. Both strategic growth and cost optimization are required for a healthy business.  

Build organizational resiliency with a focus on people and skills   

Over half of CEOs believe that diversity, equity, and inclusion need major improvements, or a complete overhaul at their organization. Mohamad Ali, CEO of IDG discussed in one of our interviews why Diversity Equity and Inclusion is really important. He emphasized that when trying to solve hard problems, the best solutions are often at the intersection of various disciplines. A diverse workforce has a great advantage by offering different perspectives, which is critical for innovation.  

In addition to lived experience that informs perspectives, which in turn drive innovation, the lack of digital skills across the organization, such as software engineers, data scientists, machine learning and AI specialists, were highlighted as the second most pressing challenge for the C-Suite, relating to digital business initiatives. While automation can help augment the work of existing employees, the digital skills gap has been top of mind for many business leaders. In 2023, 39% of CEO respondents indicate that spending will increase on attracting and retaining the best talent and skills.  

The forward-looking CEO knows that people are their organization’s biggest asset. They focus on what they can control by establishing strong executive sponsorship for digital business strategies, while adapting to economic uncertainty, and they move forward seeking opportunities to generate profitable growth.  

In our January leadership strategy blog we shared our top four opportunities to create leverage for real changes with limited investment. One of them was to create a good portfolio insight. In this blog we want to dig a little deeper in how you can create that insight and what it can bring to you.

Segment your portfolio

To direct your IT spending wisely you should segment your portfolio over two (main) angles:

Business Value
Technical Value

By doing this you get four quadrants that allow you to prioritize your portfolio in an objective and defensible manner. This will give you an ideal starting point for explaining the changes that need to be made in the way your application landscape is developed and maintained. As an added dimension you can use the size of the circle to indicate functional or technical size of the application or the number of users or maintenance staff to get a better feeling which application needs the most attention.

Segment your portfolio into four quadrants

When you have segmented your portfolio into four quadrants, these are the logical steps you can take:

Applications in the upper right quadrant have a high business value and a high technical value. These applications are fit for purpose and deserve the budget and attention to keep them there.
Applications in the upper left quadrant have a high business value, but a low technical value. Here you should focus on how to get these applications to a better technical health to make them really fit for purpose.
Applications in the lower right quadrant are okay from a technical perspective, but have low business value. When you don’t want to rationalize them, try to keep the technical health in order with the lowest level of maintenance.
Applications in the lower left quadrant have both a low business value and a low technical value. These are the ideal candidates to review for rationalization or a minimization of development and maintenance effort.

How to get the information you need

To analyze your portfolio, we use data on the business value and technical value of your portfolio. When business data is not available, we can do a survey campaign to assess the business value of your applications. Every application owner is asked to complete a short survey about the application, its usage and the importance to your company.

When technical data is not available, we select tooling for you that can analyze the technical value in your own environment which helps you to gain the insight in the technical value of your applications. This tooling is non-intrusive in the sense that the tool results don’t contain any direct insight in the software that you are using gain your competitive advantage.

Take a closer look

Especially in the yellow quadrants you might want to take a closer look at the technical value of your applications. The selected tooling gives you the opportunity to look at certain aspects that can guide you to take more detailed action. For instance:

Agility
Security
Resilience
Cloud readiness
Open Source vulnerabilities
Use of Personally Identifiable information (GDPR risks)

We can also help you take a closer look at the business value by segmenting applications into categories of similar functionalities to see if you have options to de-duplicate some business functionalities.

Within weeks we can give you the portfolio insight you need to make guided decisions on how to spend your budget most wisely to avoid unnecessary risk or to use your IT resources optimally to support the business.

Make better decisions, faster with IDC Metri’s data driven insights in our IT Intelligence portfolio.

ESG has become more than a buzzword: it is now an imperative for any organization to infuse sustainability into every part of their organization. Vague promises and “checking off boxes” are no longer enough to meet stakeholder expectations and to take adequate action on the most pressing environmental and social global issues. There is plenty of empirical evidence that operationalizing on organizations’ most material issues can not only enhance their risk profiles and lower their cost of capital, but also increase their operational efficiency, improve innovation potential, and help attract and retain new talent. In short, raise organizations’ enterprise value. Doing good for the planet and society and doing well financially do not have to be an “either/or.” In fact, for the most sustainably advanced organizations, they go hand in hand. 

The Foundation of ESG Value Creation 

IDC assesses organizations’ sustainability-related maturity across four dimensions: sustainable business and IT strategy, technology use, organizational adjustments, and the operationalization of these strategies. All four are critical in themselves but even more powerful when addressed together, as their combined power is required to allow organizations and industries to truly transform themselves toward more sustainable business models. We currently see organizations spread out across various maturity levels. Apart from the few most advanced organizations, most companies are currently somewhere between setting their sustainability targets and identifying material issues, getting their ESG reporting right, and (at least from an aspirational perspective) moving from reporting to considering ESG information in their operational decision making. According to IDC’s survey data, nearly 30% of organizations worldwide have embedded sustainability into their business model and overall strategy.  Improvements in operational efficiency, improved brand perception/customer loyalty, and improved employee engagement have been named the most frequent benefits in value creation as a result of ESG initiatives. 

The Growing Importance of Social Sustainability Topics 

While addressing climate change through decarbonization and energy efficiency measures remains one of the top priorities for organizations’ sustainability initiatives, the scope of topics addressed is broadening. Many organizations realize that their industry specific, material ESG issues can be very multi-faceted and complex, and they often time include several environmental issues (e.g., circularity, biodiversity impact, water efficiency, etc.) and social sustainability topics (DE&I, human rights management, community impact, etc.).

Recent IDC survey data shows that social topics in particular are growing rapidly in importance. This includes human capital topics, such as DE&I and employee safety, but also social capital topics that extend across value/supply chains, such as community impact, customer well-being, modern slavery, and child labor. Tracking some of these issues has been difficult due to a lack of visibility and accountability; and making lasting improvements can be even harder. But with the help of new technologies, such as advanced supply chain software, tackling these issues will be more feasible and enable organizations to address their ESG issues more comprehensively. 

Leveraging IT for Sustainable Transformation 

This brings us to the final section of this series overview: the role that IT plays in enabling sustainable transformation. While corporate sustainability strategies are typically formulated at the executive level, involving IT early in the strategy formulation process, and developing an IT strategy that supports the corporate mission is critical. Data is at the heart of any sustainability initiative. Once sustainability goals and objectives are established, organizations need access to data to baseline performance in key sustainability areas, develop metrics to monitor and manage ongoing performance, and report corporate sustainability metrics to internal and external stakeholders.   

While reporting and compliance mandates drive much of the need for sustainability data today, operationalizing this data and embedding it in ongoing business operations will ultimately enable organizations to drive business value beyond reporting and compliance purposes. For many organizations, however, collecting the data needed to support sustainability initiatives, and ensuring the quality of the data represents significant challenges. By engaging IT early in an organization’s sustainability journey, an effective data management strategy can be developed that allows companies to analyze sustainability data and produce actionable insight for key decision makers.  

As forward-looking organizations start viewing sustainability as a lever for driving business value, there will be a range of use cases in various functional areas of the business that will rely heavily on digital technologies. A few examples of technologies used for sustainability purposes include: blockchain technology for tracking and tracing components and materials across the value/supply chain, digital twin technology for sustainable product design, and AR/VR for predictive product support. As an organization’s sustainability ambitions evolve over time, so will their need for IT to support those ambitions.  

This IDC Blog post is the first in a series of sustainability research content which will explore how organizations can create business value through ESG, the rise of social sustainability, and the need for IT to enable sustainable transformation. For an overview of IDC’s sustainability/ESG research, our global analyst team, and more complimentary content, please visit IDC’s sustainability research showcase.