CIO 2023 Priorities: Cybersecurity

Those threats have escalated in recent years, along with their business risk. The FBI’s Internet Crime Complaint Center said it received a record 847,376 complaints around cyberattacks in 2021, with potential losses exceeding $6.9 billion.

“Cybersecurity has remained a high priority and that will not change in the year ahead,” said Chevron Corp. CIO Bill Braun. “The integrity and security of our IT systems is critical to our operations, especially as our dependency on IT and our use of internet-of-things grows.”

That dependency on IT has helped make cybersecurity an increasingly collaborative effort, with CIOs working more closely with chief information security officers. This has raised questions over roles and responsibilities.

Some CIOs are focusing on shoring up their software and hybrid work environments, and others are implementing a so-called “zero-trust” approach in protecting networks and fending off cyberattacks, where any user, device, or application is viewed as a potential threat.

John Roese, global chief technology officer of Dell Technologies Inc., said the personal-computer maker is prioritizing the security of its software supply chain and beginning a “seismic shift” to adopting a zero-trust architecture in 2023.

“If we get to a zero-trust architecture based on a robust hardware and software supply chain, we’ve achieved a radical positive shift in the balance of power between bad actors and enterprises,” Mr. Roese said.

Sharon Mandell, CIO of networking products company Juniper Networks Inc., said as the zero-trust approach becomes more popular, employee buy-in will become crucial in 2023.

“We’ll see more CIOs trying to make this journey as cost-efficient as possible by ramping up efforts to educate the biggest security vulnerability they have—the human element,” Ms. Mandell said. “Creating a more aware workforce against social engineering tactics, phishing and other digital scams will pay the biggest dividends.”

At Cisco Systems Inc., CIO Fletcher Previn said the company is focusing on addressing cyber threats for a remote and in-office workforce, where “we might have video games and smart thermostats on the same network segment as an employee’s remote workplace.”

That means the networking-equipment maker is adopting a zero-trust architecture, as well as practices like two-factor authentication, investing in network automation, and application scanning, Mr. Previn said.

“The threat landscape has become more challenging and our networks more porous,” Mr. Previn said. “All it takes is one slip-up or letting your guard down for a minute for an adversary to get in.”

Write to Belle Lin at belle.lin@wsj.com