Enhancing supply chain cybersecurity resilience through positive storytelling and clear communication

Author: Liva Emmatty, Communications Lead at CBN

Recent disruptions caused by global IT outages have shed light on how a lack of IT supply chain diversification fundamentally undermines resilience by concentrating risk. Over the last few months, many organisations have been considering the makeup of their supply chains, and the strength of their incident management and response plans, accordingly.

As one of Clarity’s cybersecurity communications leaders, I work frequently with thought leaders and media navigating this environment in real time. As the communications lead for the Cybersecurity Business Network (CBN), a free community founded and managed by Clarity to provide a collective voice for UK’s cybersecurity companies, I have an additional, unique opportunity to consistently interact with cybersecurity experts. In the last month, I have also spoken with several cybersecurity leaders and teams at the International Cyber Expo, and during CBN’s webinar on how companies can bolster IT supply chains.

In this article, I will outline the communication challenges faced by cybersecurity leaders and organizations in this context, and the value powerful storytelling and clear communications can bring to cyber firms looking to boost reputations when trust is low.

To find out more information about Clarity and the ways in which we serve as a voice for UK cybersecurity companies, please visit Clarity’s website here: https://clarity.global/

Tackling supply chain obstacles that hinder business resilience

Many larger organizations have invested significantly in their cybersecurity practices, so some cybercriminals are focusing on weaker targets and entry points, like smaller businesses across the supply chain. Smaller organizations often don’t have the security and compliance expertise that larger companies do, alongside often having tighter budgets to fortify their systems. 

The cybersecurity communications landscape doesn’t currently set these organizations up for success. A fear based narrative puts many off investing in the key technology they need to protect themselves, and means many put off building an ability to quickly respond to cyber-threats. 

Cybersecurity communications challenges

Based on my recent conversations with the cybersecurity community, the key communications challenges the sector is currently battling are:

  1. A negative narrative – The overall cybersecurity narrative has often revolved around negative messaging, creating an environment of fear, anxiety, and stress. This can make many people shut down completely, meaning they don’t recognize the importance of addressing their cyber vulnerabilities effectively. While traditionally negative stories were focussed on cyberattacks, today this narrative also covers cyber firms ‘letting businesses and people down’ which has shaken brand trust and loyalty.   
  2. Lack of awareness – Many smaller organizations underestimate the risk of becoming a target, and may not take cybersecurity seriously until they have been compromised. They need to understand that investing in cybersecurity is essential to safeguarding their operations, reputation, and sensitive data.
  3. Lack of understanding – The technical and specialized language used in cybersecurity can feel like jargon to those outside the sector, creating significant barriers to entry for many professionals. This might make them feel alienated or overwhelmed, meaning they automatically switch off unless there’s a simpler explanation.

How clear, positive communications helps businesses navigate the supply chain cybersecurity storm

Positive and clear communications build trust, support organizations to better anticipate potential cyberattacks, and foster a collaborative environment within the organization and in wider society. Key actions to take include:

  1. Positive and simple narratives: We need to change the messaging around cybersecurity, because the current approach is not working. Instead of tapping into fear and anxiety, companies need to highlight benefits of good cybersecurity practice like improved cyber resilience, better customer experience and building a trustworthy environment. This way we can transform a daunting necessity into an enabler of success, growth and opportunity. 
  1. Educational campaigns: Sharing educational content pieces on social media platforms, brand websites, and webinars that highlight the gaps in the supply chain cybersecurity, and ways for the entire community to mitigate risks, will drive positive awareness. Storytelling and practical insights can be crucial to empower smaller businesses to adopt robust practices. 
  1. Have a say in policy discussions: The recent global outage led to debates about the resilience of the UK’s networks, and the government proposed the new Cyber Security and Resilience Bill which will be introduced to ensure the security of critical infrastructure and digital services. While the sector will be watching closely for direction on how society will be better protected, the cybersecurity community has a responsibility to participate in the discussion and ask questions. For example,  cybersecurity firms can delve into the concentration of risk: 62% of the global external attack surface is covered by just 15 companies. What is the long-term viability of reliance on so few suppliers? 
  1. Transparency and visibility: Timely, accurate and clear communications increase transparency across the supply chain, ensuring all stakeholders are well informed and understand the current state and potential risks. This facilitates better decision making, fosters trust, and ensures a better management of issues before they escalate into a full-blown crisis. Open communication also enables companies to better align their objectives with suppliers and customers, supporting a resilient supply chain.
  1. Crisis management and recovery: During disruptions, effective communication channels are essential for coordinating crisis management efforts and recovery plans. This can help mitigate the crisis’ impact by ensuring swift decision making and resource allocation. Having clear and consistent messaging is imperative to maintain employee morale, maintain trust publicly, and ensure everyone has access to real-time updates and guidance to navigate the crisis.

Planning for 2025

As we approach year end, it’s time to reflect on key learnings and plan ahead. Have you thought about prioritising communications between your internal and external stakeholders? What are the key communication challenges you’re facing, and what support do you need to reach your objectives? Are you willing to lead the positive cybersecurity communications drive?

At Clarity, we specialize in supporting cybersecurity organizations to reach, inform, and educate their audiences using intelligence-led, measurable marketing and communications.

Want to find out more about how Clarity can support your cybersecurity business to grow and reach audiences with meaningful communications and smart marketing? Contact us here.For those interested in becoming a member of the CBN for free, or learning more about how you can contribute to and benefit from this initiative, please visit https://cb-network.org/

Key insights from the Supply Chain Resilience Webinar 

The Cybersecurity Business Network (CBN) was delighted to host a webinar on supply chain resilience. Developed in response to the recent global IT outage, which exposed how reliance on only a few key suppliers can weaken critical systems, the webinar explored how businesses and policymakers can address the growing issue of how a lack of diversification in IT supply chains can increase the risk of major outages. The webinar brought together experts from cybersecurity, healthcare and academia to discuss ways to strengthen supply chain resilience and manage these risks. Below are some key takeaways from the event. 

Dr. Melanie Garson, Cyber and Tech Geopolitics Lead at the Tony Blair Institute, opened the discussion by examining the global geopolitical landscape’s impact on supply chains. She emphasised the rising uncertainty and the interconnectedness of these risks, describing the current state as “a geopolitical state of upheaval.” According to Garson, the world’s IT supply chains are more vulnerable than ever due to increased global tensions and organisations must better anticipate the disruptions arising from cyberattacks and broader geopolitical events.

Simon Newman, Director of the Cyber Resilience Centre for London, reinforced this perspective by highlighting how attackers are now focusing on smaller, more vulnerable entities in supply chains. Newman also stressed the importance of enhanced collaboration across sectors, including law enforcement, to address these increasing vulnerabilities.

“As larger organisations have boosted their cybersecurity significantly, criminals are now targeting weaker entry points”, he explained, noting that smaller organisations often lack the resources to defend themselves effectively.

Simon Newman, Director of the Cyber Resilience Centre for London,

The healthcare sector’s supply chain vulnerabilities were a particular focus, with Rachel Dean, Head of Cybersecurity at NHS Supply Chain, providing insights. Dean emphasised that a successful cyberattack on the NHS’s supply chain could directly affect patient care.

“A successful cyberattack and the resulting inability to deliver operations impacts directly on the NHS’s ability to deliver patient care, which can have critical outcomes,” she warned.

Rachel Dean, Head of Cybersecurity at NHS Supply Chain

With a supply chain of over 6,000 suppliers, Dean explained the significant challenges in ensuring that each supplier meets necessary cybersecurity standards while avoiding creating barriers for smaller, critical suppliers.

On the regulatory side, Tim Rawlins, Director and Senior Advisor at NCC Group, discussed how regulations are evolving to address supply chain vulnerabilities.

“Regulators are increasingly focusing on requiring organisations to escrow software from their suppliers to reduce risk.”

Tim Rawlins, Director and Senior Advisor at NCC Group

While regulation is a key driver of improvement, Rawlins stressed that organisations themselves must take proactive steps to manage third-party risks and understand how disruptions in one part of the supply chain can have wide-reaching consequences.

Digital Dawn: Cyber Security Policy in the Wake of Political Change

An NCC Group cyber policy report providing a strategic guide for political and business decision makers worldwide.

Our report emphasizes just how important it is for
incoming governments to stay focused on cyber
security and resilience amidst the many competing
priorities they will face…. It’s clear that governments taking
appropriate action to keep their citizens safe will be
critical to maintaining trust in public institutions and
unleashing the huge potential of the digital economy.

Mike Maddison
CEO at NCC Group

In this bumper election year, the report offers new and existing governments a deeper understanding of how their counterparts in other areas of the world are tackling similar cyber security issues.

The findings explore:

Drawing from NCC Group’s insights and new research, which included commissioning polling from J.L. Partners to examine public opinion on cyber security issues and conducting interviews with key people from across the global cyber policy ecosystem, the report urges policymakers to establish long-term digital resilience.

NCC Group identifies five key policy areas it believes new and existing governments must prioritize to achieve this in practice:

1. 21st-century cyber laws that define responsibilities, harmonise rules, and are underpinned with proper enforcement.

2. Digital safety nets for small and medium-sized businesses and organisations, embedding security in the digital products and services they rely on.

3. Fortifying government defences by investing in public sector cyber resilience, building trust in government services, and leading by example.

4. Forging a cyber resilient population – promoting cyber literacy, developing cyber professionals, and updating cyber laws.

5. Long-term, evidence-driven policymaking structures.

We are proud of NCC Group’s latest contribution to the cyber policy debate. Cyber security is a matter of national and global importance and we are passionate about ensuring that cross-party consensus does not lead to complacency in this bumper election year and beyond. We look forward to working with incoming governments in the UK, and worldwide, to implement ambitious but actionable policies that will take national, organisational and individual cyber security to the next level.

Kat Sommer
Group Head of Government Affairs & Analysts Relations, NCC Group
CBN Advisory Board

Some of our key takeaways from the report include

Digital Dawn: Cyber Security Policy in the Wake of Political Change

Read the full report here