Despite those differences, there are several common attributes of different offerings from different firms, which tend to be:

Comprehensive:Previous investments in cybersecurity products, policies and processes have in many cases been "implemented in a disjointed fashion without an overall coordinated cybersecurity program," notes Kennedy Consulting Research & Advisory Senior Analyst Erin Hichman. To successfully anticipate, detect and resiliently respond to cyber breaches, she adds, companies need a new mindset – one that favors a "comprehensive cybersecurity program that encompasses prevention, detection, response and remediation that aligns with a company's risk profile."

Multi-disciplinary:A comprehensive cybersecurity program touches numerous business functions and requires many different types of expertise. BDO's Shaghaghi describes one of his practice's key roles as "orchestrating" different forms of expertise, including the firms' internal data privacy legal experts, regulatory experts, IT audit experts, risk experts and more. Burg notes that the PwC legal team works closely with his cybersecurity team to "bring in more skills and more perspectives as we help implement, design and operate security programs."

Risk-based:"At the end of the day, it comes down to risks and controls," asserts Grant Thornton's Lee. "Companies that aren't using a risk-based approach are probably placing false reliance on things like the blinking black box that's going to go solve all your problems – or the assessment that isn't the same as a secure posture, but that sounds good because it reads like a familiar compliance report." He notes that some of the most prominent cyber breaches, particularly in the retail industry, occurred in areas of companies that were deemed "compliant" with relevant security standards. "Compliance with a standard is not the same as being secure," he adds.

Tailored:Lee also points out that there are material differences in cyber risk profiles between an insurance company and a bank even though each organization operates in the financial services industry. Allan agrees noting that there are also important differences in cyber-risk management approaches among companies in the same industry. "If I'm doing cyber threat intelligence for a big German car manufacturer, can I immediately translate that to a big US car manufacturer? The answer is no," Allan says. "Although a lot of the work is similar, the specific threats and vulnerabilities are slightly different." Lee says that savvy consultants bring a set of cross-industry best practices, which qualify as a "mandatory minimum;" consulting work beyond that tends to be highly customized to each client.

Given this need to customize, some cybersecurity consulting leaders emphasize the importance of a couple of surprising qualities as the demand for their services soars: self-knowledge and patience. Lee says it is crucial to remember what his firm does and does not do. If a happy client asks Grant Thornton to provide managed security, "We would immediately and candidly say, No, but here are three names that we'd recommend," Lee notes.

Gone Phishing: Cybersecurity's Big Catch

Related Stories

Recommended For You