Strengthening Cybersecurity with GenAI
Jurgen Kutscher, VP at Mandiant Consulting, Google Cloud, and BCG’s Colin Troha explore how cybersecurity defenders can use GenAI to stay ahead of threat actors.
Companies that get cybersecurity right treat it not as an add-on but as something shaped by—and aligned with—business strategy. BCG helps companies focus on digital risk management and cyber risk capabilities that matter most.
Colin Troha
Cybersecurity and IT risk management are not technology projects. They are business projects with strong tech components. Companies that understand this don’t pursue wide-ranging—and often impossible to implement—cyber roadmaps. They focus on the IT risks and capabilities most relevant to their business strategy.
This perspective shapes our unique approach to cybersecurity and cyber risk. And it’s why a big part of our work is about enablement: building a foundation for continual improvement. So even when we step out of the picture, companies can keep their cybersecurity strategy and their business strategy aligned.
We look at cybersecurity through a business lens. Our IT and cyber risk consulting teams help companies identify the digital risks they can and can’t accept. This lets us develop business-driven and risk-aligned capability roadmaps. Companies then focus their efforts—and investments—where they matter most.
The process plays out in several phases:
Our cybersecurity consulting team combines business expertise, a strategic mindset, and deep knowledge of cybersecurity strategy and technologies. We leverage proprietary tools, such as Cyber Doppler, which helps companies quantify their cybersecurity risk management strategies and model different responses.
Many companies face a common dilemma: their cybersecurity spending often isn’t as efficient or effective as it could be. Through cyber risk analytics—including our Cyber Doppler tool—we helped our client, a leading global bank, calculate its risk exposure for different scenarios and business units and understand the impact of various cyber activities. This let the company optimize its cyber portfolio and reallocate spending to activities that had the highest impact on risk exposure. The bank reduced its cyber projects by 35% while eliminating or reallocating 15% of its cybersecurity spending—all while improving the organization’s cyber readiness.
Hoping to expand its footprint in health care, our client knew it had to first shore up its cyber defenses. A recent malware attack had caused a significant financial loss, and vulnerabilities remained. Drawing on our technical and project management expertise, we conducted multiple cybersecurity assessments and identified both weak points and costly redundancies. We prioritized areas to focus on, and we steered more than 30 cyber defense projects for the client. Just as importantly, we developed long- and short-term roadmaps so that the company could enhance its cyber capabilities quickly—and continually improve.
Jurgen Kutscher, VP at Mandiant Consulting, Google Cloud, and BCG’s Colin Troha explore how cybersecurity defenders can use GenAI to stay ahead of threat actors.
The opportunities presented by generative AI are significant, but leaders need to focus equally on the risks. What is a responsible C-suite member supposed to do?
Many companies today are tightening or even reducing cybersecurity budgets. Implementing a comprehensive cost resilience process can maintain—and often improve—an organization’s risk profile.