BitSight Reveals Critical Gaps & New Cybersecurity Priorities For Organisations

Uploaded on 2025-08-01 in NEWS-Cybersecurity News, FREE TO VIEW, TECHNOLOGY--Resilience

According to aa new report from BitSight, cybersecurity has solidified its presence as a critical issue on the boardroom agenda.

The report is titled 2025 State of Cyber Risk and Exposure and draws on a survey of 1,000 IT security leaders across six countries, reveals that 9% of board meeting time is now dedicated to the risks and opportunities related to technology - a figure not far behind time spent on traditional oversight (58%) and external global risks (10%).

Yet, while the issue commands attention, there remains a disconnect between the language of cyber risk professionals and the needs of executive stakeholders.

A key concern is the tendency for security teams to present overly technical data, which dilutes the impact of their messaging in a setting where time is both finite and highly contested.

Poor Visibility: The Silent Killer of Risk Communication

BitSight’s report highlights poor security visibility as a silent but powerful barrier to effective cyber risk communication -especially for those already struggling to engage the board. While only third on the list of reported challenges, cited by 32% of respondents, BitSight argues that it is, in fact, the most critical issue.

Why? Because it’s within the control of risk managers. The tools, telemetry, and intelligence systems organisations deploy directly affect their ability to monitor and interpret cyber threats. When visibility is lacking, even the most well-intentioned communication efforts will fail to provide the board with clarity or confidence.

Visibility Is The Key To Better Board Communication

The findings show a clear correlation between visibility and communication success. Organisations that continuously monitor cyber risk and contextualise findings within the business environment are **2.5 times more likely** to report effective communication with their board. Among those with high visibility, **72%** report excellence in communication, compared to just 28% overall.

This trend is particularly significant in the wake of evolving regulatory demands and increasing scrutiny from insurers and investors, all of whom are demanding more sophisticated, timely, and transparent reporting.

A Critical Inflection Point For Cybersecurity Strategy

The 2025 report’s central message is clear: cybersecurity has reached a critical juncture. AI-driven threats, rapid digitisation, and expanding attack surfaces demand a fundamental shift in how organisations understand and manage cyber risk. Data alone is no longer enoughcyber risk intelligence is what matters now.

BitSight urges organisations to go beyond simple telemetry and instead focus on *interpreting* the data—aligning it with business objectives, threat landscapes, and operational realities to enable meaningful, strategic action.

Building The Foundation: Asset Discovery & Continuous Monitoring

BitSight identifies comprehensive asset discovery and ontinuous monitoring as foundational pillars of cyber maturity. Organisations that achieve high levels of asset visibility are far more likely to communicate effectively at the board level.

However, the survey reveals a concerning gap: **fewer than one in five organisations** actively map threats across their environment and correlate them with diverse risk factors. This indicates a widespread lack of mature, automated asset management processes.

Without this foundation, organisations are effectively flying blind -leaving themselves exposed not just to cyber attacks, but also to reputational and regulatory fallout from ineffective governance.

Enriching Security Data With Business Context

The report also stresses the importance of **contextualising security data**. Raw metrics and technical findings must be transformed into actionable insights that align with business goals and the real-world threat landscape.

Shockingly, only 29% of organisations have a formal cyber risk programme that is well-aligned with their business objectives. Even fewer - just 17% - can reliably map threats to specific assets.

This lack of integration between security and business strategy continues to undermine risk prioritisation efforts, leading to wasted resources and undetected vulnerabilities.

Supply Chain Blind Spots Threaten Exposure Management

BitSight draws attention to an often-overlooked issue: the digital supply chain. Although most organisations assess third-party vendors for cyber risk, only about one-third engage in continuous monitoring of those relationships.

This represents a major exposure area. Mature organisations with well-aligned cyber risk programmes are 4.5 times more likely to maintain continuous oversight of third-party networks—underscoring the importance of extending visibility beyond internal infrastructure.

As attacks increasingly propagate through indirect channels - via suppliers, vendors, and partners - failing to monitor these relationships in real-time is a critical oversight.

Communication Is The Endgame

At the heart of all of BitSight’s recommendations lies a simple truth: effective cyber risk communication is the ultimate goal. Boards, insurers, and regulators are demanding clearer, more contextualised insights - especially as regulatory frameworks become more prescriptive.

Those organisations that invest in visibility, intelligence, and business-aligned strategies are not just more secure - they’re also better equipped to justify their security investments and meet evolving external demands.

The report warns that failing to evolve in this direction leaves organisations vulnerable on multiple fronts: operational, reputational, and financial.

Turning Insight Into Action

As cybersecurity threats continue to escalate in scope and sophistication, BitSight’s 2025 report serves as both a warning and a guide. Visibility, context, and communication are no longer optional—they are **non-negotiable components** of effective cyber risk management.

Organisations that heed this call will not only improve their defensive posture but also enhance trust with their stakeholders, drive accountability, and demonstrate resilience in a rapidly evolving digital world.

The message for BitSightis clear. It’s time to turn data into intelligence - and intelligence into action.

Image:

You Might Also Read:

Cyber Resilience Must Start With Visibility:

If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.