Obtaining budget approval for cybersecurity initiatives is a challenge that many CISOs and enterprise architects face. Decision-makers need clear, practical justifications that explain the value of these investments in terms of reducing risks, ensuring compliance, and future-proofing the organization. Below, we outline four actionable executive summaries that security leaders can use to support budget requests for key cybersecurity goals: enhancing VPN security, ensuring compliance with DORA, implementing passkeys for critical applications, and meeting NIS2 requirements.
1. How to justify investments in VPN security
Why are VPNs a target for attackers?
Virtual Private Networks (VPNs) are a critical component of remote work and secure access, but they are increasingly being exploited. Vulnerabilities in widely used systems like Fortinet and Ivanti highlight risks such as stolen credentials, weak encryption, and exposed login portals. These risks put sensitive data and business operations at stake.
What steps can improve VPN security?
Organizations can enhance VPN security by:
- Upgrading to stronger authentication: Implement multi-factor authentication (MFA) methods such as biometrics or FIDO2 passwordless technology to prevent unauthorized access, even if credentials are compromised.
- Hiding VPN login points: Deploy Full Site Protection (FSP) to shield VPN login pages from external threats and block access attempts by unauthorized users.
- Adopting secure standards: Transition to modern protocols like FIDO2 and SAML for more robust and flexible authentication.
What actions should be prioritized?
- Allocate funding to implement stronger authentication and deploy Full Site Protection.
- Collaborate with vendors to ensure new security measures integrate seamlessly with existing VPN infrastructure.
- Future-proof the organization’s VPN defenses by adopting modern security technologies.
2. How to build a case for DORA compliance
Why does DORA compliance matter?
The Digital Operational Resilience Act (DORA) establishes mandatory requirements for ICT risk management, incident response, and oversight of third-party risks for financial entities operating in the EU. Organizations that fail to comply by the January 2025 deadline face penalties and increased exposure to security vulnerabilities.
How can organizations meet DORA requirements?
Key measures include:
- Strengthening ICT risk management: Regular risk assessments, enhanced data protection, and security updates ensure operational resilience.
- Improving incident response and testing: Establish incident response plans and conduct operational resilience testing to address vulnerabilities effectively.
- Auditing third-party risks: Assess vendors and enforce contractual safeguards to ensure they meet DORA compliance requirements.
What should security leaders do now?
- Conduct a gap analysis to evaluate current ICT governance and identify areas requiring improvement.
- Develop and implement enhanced incident response protocols and testing procedures.
- Audit third-party agreements to confirm compliance with DORA standards.
Preparing now will ensure the organization meets the compliance deadline and reduces risk exposure.
3. How to justify adopting passkeys for critical applications
Why are passwords a weak point?
Passwords remain one of the most exploited security vulnerabilities, with phishing, brute force attacks, and credential theft leading to unauthorized access and data breaches. Critical business applications are particularly vulnerable, as they hold sensitive data and often lack sufficient protection against modern threats.
How can passkeys solve this problem?
Passkeys provide a highly secure, passwordless alternative to traditional authentication. Organizations can:
- Adopt FIDO2-based passkeys: Cryptographic keys tied to user devices, combined with biometric authentication, eliminate the risks associated with passwords.
- Simplify deployment: Use solutions like Secfense’s User Access Security Broker to implement passkeys across applications without requiring changes to existing infrastructure.
- Improve compliance: Address regulatory requirements, including GDPR, DORA, and NIS2, by eliminating password-related vulnerabilities.
What are the next steps?
- Perform a risk assessment of current authentication practices and identify gaps.
- Secure funding to deploy passkey technology organization-wide.
- Partner with experienced vendors to facilitate rapid and efficient implementation.
- Train employees to ensure they are comfortable with new authentication methods.
4. How to secure funding for NIS2 compliance
What risks does non-compliance with NIS2 present?
The NIS2 Directive applies to essential and important entities in the EU, mandating higher cybersecurity standards. Failure to comply by the October 2024 deadline can result in significant fines and heightened vulnerability to cyberattacks.
What measures ensure compliance with NIS2?
Organizations must prioritize the following:
- Comprehensive risk assessments: Identify and mitigate threats with updated security policies.
- Effective incident response and reporting: Create response plans and ensure timely reporting to authorities in compliance with NIS2 requirements.
- Supply chain security: Reduce vulnerabilities by ensuring third-party providers adhere to strong cybersecurity practices.
- Employee training: Regular training helps build awareness and accountability across the organization.
What should security leaders focus on?
- Allocate resources to implement the necessary cybersecurity measures and compliance initiatives.
- Engage cybersecurity experts to assess current systems and create a compliance roadmap.
- Begin implementation with a focus on critical areas to meet the compliance deadline.
- Establish monitoring and updating mechanisms to maintain compliance as threats evolve.
Why cybersecurity investments should be a top priority
Security leaders have a responsibility to safeguard their organizations against growing threats and ensure compliance with evolving regulations. Each of the executive summaries above provides actionable strategies to justify investments in VPN security, DORA compliance, passwordless authentication, and NIS2 compliance.
By acting now, organizations can mitigate risks, strengthen defenses, and avoid penalties tied to regulatory non-compliance.
How Secfense can support your goals
Secfense helps organizations modernize their authentication infrastructure by introducing FIDO2 passkeys and passwordless solutions. Our solutions integrate seamlessly into existing systems, enabling organizations to reduce risks, meet compliance requirements, and transition to stronger, future-ready authentication methods.
Take the next step
- Contact Secfense: Talk to an expert about how our authentication solutions can help secure your organization. Get in touch.
- Watch our webinar: Learn how passkeys eliminate password-related vulnerabilities and help meet compliance requirements. Access the webinar here.
