Gartner’s 2022 Top Security and Risk Management Trends - Consolidating what began in 2021

In March 2022, Gartner published its Top Security and Risk Management Trends for 2022. This article sheds light on the important trends and highlights the changes to 2021.

A change process in cybersecurity starting in 2021

Let's start with a short look at 2021. In the height of the Pandemic, the Global Economy accelerated its migration to end-to-end digital processes. Opening corporate boundaries and decentralized digital structures increased the cybersecurity risk landscape. A strong rise of cyber attacks and fraud starting 2020 led to a strategic turnaround. The establishment of cybersecurity meshes, pushed by cyber-savvy boards, became the leading trends. 

A cybersecurity mesh is a highly complex, modular and decentralized conceptual approach to security architecture.

To manage complexity, increase agility and to avoid open flanks, there has been a trend of vendor consolidation towards strong providers with integrated full-line portfolios that can be held accountable. Inside corporate structures, but also to cater for the emerging Internet of Things (IoT), cybersecurity was improved through sophisticated structures of identity management for humans and machines, including secure authentication and authorization processes. This made work possible from anywhere. Therefore, breach and attack simulation became standard processes in many companies, while privacy and data security were protected by privacy-enhancing computation techniques.

Consolidation of the process in 2022

In this article we compare Gartner’s findings on trends in Security and Risk Management in 2021 and 2022. Gartner revisited the subject from a more holistic cybersecurity perspective in April 2022. The trends remained the same, the order has been slightly reshuffled. For the sake of better comparability, we use in this article the Security and Risk Management Perspective. We can interpret the trends in 2022 as consolidation of what started in 2021.

Top Security and Risk Management Trends

Companies are not a monolithic structure anymore. The post-COVID world of end-to-end digitization accelerated by the materialization of the IoT led to decentralized, interconnected structures with big attack surfaces (trend 1) and increased supply chain risks (trend 2). Decentralized structures also led to more surface for intruders to exploit once they got hold of identities. 

This increased risk exposure incited the emergence of new services on top of the cybersecurity infrastructure, including digital risk protection services and attack surface management.

The implementation of Identity Threat Detection and Response structures and teams (trend 3) brings a completely new concept into the top three ranks of security and risk management trends. It is interesting to see that in Gartner’s April ranking, it was moved up to position 2.

In previous years, focus was set on proactive structures to make intrusion and fraud impossible. However, reality has shown that 100% protection is not realistic. With the establishment of computer security incident response teams (CSIRT), a team of experts is set in charge of assessment, management and proactive prevention of cybersecurity-related emergencies. Intelligence is gathered through cyclic processes of surveillance, analysis, detection, elimination and the implementation of lessons learnt. CSIRTs rely on a variety of data coming from various tools, which are aggregated by Security Orchestration, Automation and Response Infrastructure (SOAR).

This increased attack surface and decentralization directly triggered two related trends with respect to corporate structures and processes:

• the distribution of decisions (trend 4),
• holistic security behavior programs in (trend 5).

Just like the emerging digital risk protection services and attack surface management services, the distribution of decisions and holistic security behavior programs (such as the emerging digital risk protection services and attack surface management services) reinforce a more expert based decision making closer to the problems. It is a direct reaction to the increasing complexity of the IT landscape and the requirement for cybersecurity meshes.

The process of vendor consolidation (trend 6) which was one of the top 3 trends in the previous year is still ongoing. They will enable companies to manage complexity and interdependence by providing integrated cybersecurity landscapes (security meshes). Interestingly, Gartner’s revisit of the subject in April brought the trend up again to position 4.

Utimaco provides an integrated portfolio of cybersecurity solutions in one hand, allowing for the protection of the expanded attack surface and the digital supply chain risks with a single end-to-end cybersecurity mesh. User-friendly interfaces and audit logs provide identity threat detection and response teams with valuable information. Remote, secure and role-based access and reporting support the emerging decentralized structures of management by experts. Industry-grade certification allows for compliant process implementation in the majority of security-sensitive industries.