# To Build Effective Cyber Resilience, Invest in Trust

> Cybersecurity leaders must prioritize social capital over compliance to reduce incidents and costs.
- Title: To Build Effective Cyber Resilience, Invest in Trust
- Summary: Cybersecurity leaders must prioritize social capital over compliance to reduce incidents and costs. Organizations with strong internal trust and…
- Keywords: cybersecurity, social capital, compliance, ai security, incident costs, business units, ciso, security incidents, business, management, Build, Effective
- Source: Harvard Business Review — https://hbr.org/2026/10/to-build-effective-cyber-resilience-invest-in-trust
- Published: 2026-10-26T12:05:35+00:00
- Read time: 1 min
- Topics: cybersecurity, social capital, compliance, ai security, incident costs, business units, ciso, security incidents, business, management
## Cybersecurity Spending vs. Benefits
Executives can quantify cybersecurity compliance spending but struggle to measure benefits.
## Human Element in Breaches
62% of breaches last year involved a human element, consistent with the past three years.
## Compliance Budgets Rising
Compliance budgets have grown despite no significant reduction in cyber incidents.
## AI Makes Cyber Risk Riskier
AI systems require organizations to rethink how they manage cyber risk.
## Social Capital for Cybersecurity
Social capital, the connections, trust, and shared understanding that support cooperation, is critical for cybersecurity.
## CISO Panel Members
Bridget Karlin, Mike Higgins, Christopher Porter, and Michelle Farr led the research panel.
## Finding 1: Compliance Ceiling
Compliance efforts show diminishing returns after initial investments.
## Finding 2: Social Capital Benefits
Firms with high social capital report 70% fewer incidents and 97% lower incident costs.
## Finding 3: Complex Organizations
Large organizations see bigger payoffs from social capital investments.
## CISO Panel Insights
Security leaders must build trust to reduce incident escalation.

> Incidents rarely escalate because controls were absent. Escalation occurs because signals arrived late, incomplete, or distorted by fear. Trust and shared responsibility correct that failure mode.
## Psychological Safety
Psychological safety reduces hiding risks from security threats.

> I want to promote the idea that If you see something, say something. When social capital is low, people will tend to hide risks. They do so for the sake of completing a deliverable.
## Balanced Social Capital
Balanced social capital between business and security units maximizes security outcomes.
## CISO as Partner
CISOs aligned with business goals are seen as partners, not enforcers.

> A compliance-driven CISO is still seen by the business as a 'punisher' or detriment to business objectives. A CISO aligned with the business, socially connected to the business, and known for driving business objectives is seen as a partner and someone who will find solutions to enable the business.
## Social Capital Actions
Leaders should reward relationship-building and measure social capital activities.
## Measuring Social Capital
Track indicators like early product design meetings and incident reporting.
## Key takeaway

Organizations with strong internal trust and collaboration see 70% fewer cyber incidents and 97% lower costs than those relying on compliance alone.