EN

NL

Yuri Bobbert, PhD

Function Professor information systems management

Email yuri.bobbert@uantwerpen.be

Discover our publications

Expertise

Cybersecurity
Business information security
Information Systems Management

Yuri Bobbert has a double PhD at Radboud University and Antwerp University in the field of IT performance measurement, as a result of that research work, he co-developed multiple technologies and did +100 publications on this topic.

Yuri is the former global Group CSO of NN – Group (listed at AEX) and UWV (Government). He led the merge of NN Group and DeltaLloyds IT Security, Risk & Compliance function. Prior to his CSO roles Bobbert served for +10 year as CEO of B-ABLE, an IT consulting firm.

Yuri has been teaching at Antwerp Management School since 2011.

He is the author of the books:

Strategic Approaches to Digital Platform Security Assurance
Leading in Digital Security
Cybersecurity in 60 minutes
Critical Success Factors for Business Information Security
'Exploring Capabilities and Skills for Digital Value Creation” about the role of Softskills

Programs

Master Class Cyber Security Architecture & Technologies

Master Class Cyber Security Management

Discover our programs

Recent publications

Performance Management in Information Security

Organizations often struggle with effective cybersecurity performance management due to the lack of standardized metrics, siloed security practices, and difficulty quantifying cybersecurity initiatives' value. Many businesses fail to tie cybersecurity performance directly to organizational goals, leading to gaps in resource allocation, risk mitigation, and strategic planning. This results in poor visibility into the effectiveness of cybersecurity measures and an inability to adapt quickly to emerging threats.

Yuri Bobbert, PhD

NIS2

The NIS2 – What Boards Must Do

The NIS2 – a European directive that follows in the footsteps of NIS1 – requires full implementation by member states on October 17, 2024. This means that member states will have had time between January 16, 2023 and October 17, 2024, to translate the law into more specific rules and instructions in order to comply effectively. It's worth noting that certain countries and industries have already anticipated this shift and have started adapting to it. In this article, I describe three stances vital to boards or anybody having a steak in the company. And the primary obligations you must consider.

Yuri Bobbert, PhD

Digital risks 1

The need for Digital Due Diligence; How to prevent a pig in a poke

The heightened scrutiny of cybersecurity underscores the critical need for careful digital due diligence on digital assets and comprehensive risk assessments in mergers and acquisitions.

Yuri Bobbert, PhD

Trends cyber security 1

Influential trends for emerging roles in digital security - 2023 and beyond

Looking at cyberdata collected in recent times reveals intriguing insights that may affect our future view on digital security education as a prime defense mechanism for dealing with future threats. In this article, we first observe the cumulative change in cyber threat actors followed by summarizing our analysis of more than 20 years of cyberdata, based on the VERIS Community Database in order to distill key trends by extrapolating trends toward the future. When examining these findings, we then used our own expertise and observations to suggest future roles that might dominate the field of cybersecurity.

Yuri Bobbert, PhD

Cybersecurity management

How Small and Medium Enterprises approach cybersecurity

At Antwerp Management School's Master in IT Risk & Cyber Security Management we noticed that SMEs are struggling to adequately address cybersecurity risks and are taking a slightly different approach than large(r) organizations. So we decided to have a closer look at the typical SME cybersecurity risks and approaches. This not only resulted in extensive research, but also in the development of the SMB Cybersecurity Canvas by Vincent van Dijk.

Yuri Bobbert, PhD

Strategy & Innovation

Always verify

Never trust and always verify - the increasing number of cyber threats & risks

The increased digitization of the world we live and work in, has given rise to an increasing number of cyber threats and IT-risks. Over the past few years, we’ve seen a huge surge in the number, the intensity, and the sophistication of the attacks. But it’s not all doom and gloom. With proper technical solutions such as firewalls, antivirus programs , back-ups and a no-trust attitude, companies can better defend themselves.

Yuri Bobbert, PhD

Buds and fails

Why FUD fails and BAD prevails in Digital Security

Many cyber security specialists or security software sales representatives want to convince people to act or buy certain products by frightening them with statements like: “If you don’t do (or buy) this, you will be hacked.” Sadly, this way of communicating is still an often-used approach in Information Security to get the message across or motivate people to “buy” their products or service. We call this the FUD approach. FUD stands for Fear, Uncertainty, and Doubt and was introduced in the late eighties. As of 1991, the expression became fashionable for any form of disinformation used against the competition. FUD is a simple but effective strategy that supplies the audience with negative, fake, or false information to influence their behavior and decisions. FUD is so effective because adverse events have a more significant impact on our brain and associated attitudes than positive ones. In psychology, this is called negative bias. Negative bias can have an effect on behavior as well as your decisions. This is also why the news often spreads negative news because negative news draws greater attention and therefore sells. Although this might be effective in the short term to get things done, this won’t be a very successful approach in the long term. In this blog I'd like to explain you why.

Yuri Bobbert, PhD

The evolving role of the CISO in the public sector

The evolving role of the CISO in the public sector

Over the last seven years, the role of Chief Information Security Officer (CISO) has gained significant importance within local governments, because local governments that want to be in line with the Baseline Information Security Government urgently need such a CISO. About 50% of the job vacancies on LinkedIn are meant for local governments. But the role of CISO has drastically changed in recent years. The latest figures indicate that an astonishing 22% of the IT budget is allocated to cyber and information security. Our own experience is that dialogues with C-level executives nowadays revolve around questions such as: Are we doing the right thing, and are we doing this right? How do we measure and monitor our return on security investments (ROSI)? And where do we get the ‘biggest bang for the buck’?

Yuri Bobbert, PhD

Security assurance 1

Strategic Approaches to Digital Platform Security Assurance

Nowadays, it is impossible to imagine a business without technology. Most industries are becoming "smarter" and more tech-driven. We live in the era of the "platform society." For example, Coursera has become the world's most prominent online educator, collaborating with over 200 leading universities and companies. Platforms are becoming increasingly powerful and concentrate on collecting more and more data to cross- or upsell services. Ranging from small individual tech initiatives to complete business models with intertwined supply chains and "Platform" based business models. New ways of working, such as Agile and DevOps, are introduced, leading to opportunities and unknown risks.

Yuri Bobbert, PhD

Banner Cyber Security Architecture 1

Get the biggest bang for your security buck

Over the last seven years, our role as Chief Information Security Officer (CISO) has drastically changed. According to our Microsoft Outlook Analytics client, more than fifty percent of our mail is spam from cyber security suppliers, trying to grab our attention by selling fear, uncertainty and doubt (FUD). Over the last decade, we’ve seen this industry explode with self-proclaimed “cyber pros” and fuzzy vendors in the cyber domain. Is this because industry strategy agencies like IDC, Gartner, and Forrester predict that security spending keeps on increasing? Or is it because the cyber consumer just follows the herd? The latest figures indicate that an astonishing 22% of the IT budget is allocated to cyber and information security. Our own experience is that dialogues with C-level execs nowadays ask: Are we doing the right stuff, and are we doing this stuff right? How do we measure and monitor our return on security investments (ROSI)? And, where do we get the ‘biggest bang for the buck’. It’s a dialogue that very few suppliers actively participate in, while interacting with their CISO customers.

Yuri Bobbert, PhD

Digitale markt citroenen 1

Is digital security a market for lemons?

Although information security has a long history, it wasn’t really top of mind of senior management, board or other employees until late 2010. A “security professional” became a real job and market demand has grown ever since. Awareness about security risks increased significantly. The thriving forces for this were major security breaches such as Snowden, NotPetja and WannaCry shocking the world, but also regulators demanding companies to protect their critical assets, including non-tangible ones such as data. As a result of this, we can now state it has the board's attention by default.

Yuri Bobbert, PhD

Archetypes CISO

Which of these 4 CISO archetypes do you deserve and match with?

Why do CISOs have such a low retention in firms and leave after 1-2 years? Is this because recruiters and HR professionals find it hard to discover what is actually needed and “copy paste” function profiles with the exact same requirements, rather than looking at the real need in the organization: M&A strategy, family business, scale-up phase, consolidation, preparing for sales of the company, cultural differences etc.? The CISO role is an embryonic role compared to the CFO, and not one hundred percent clear about exact expectations.

Yuri Bobbert, PhD

Digital risks 1

Digital risks to business, what do they cost?

Analyzing Business Information Security for a data breach use case; In a digital business world that is highly distributed via an eco-system, ensuring your digital assurance becomes vital. Everything needs to work continuously and Confidentiality, Integrity and Auditability have to be assured, especially when your business is regulated and should demonstrate to be “in control”. Nevertheless, how do we do that when business models can be attacked by hackers? Hackers using heavily automated attack methods and work in a distributed evasive platform-model that disguises their identity and criminal organization. Therefore, hackers form a threat to your business. Varying from State sponsored hackers to scriptkiddies all finding sophisticated ways to hammer on your front porch of your business. To you an IP address means your API store or critical business process; for a hacker it is just an IP number attack, they don't care and don't know the impact.

Yuri Bobbert, PhD

Roles information security

Future roles in information security

We want to feel safe in this brave (and scary) new world we’re creating of machines, robots and artificial intelligence. Technological & political trends will definitely influence our profession. This new world will call for new jobs with new skillsets that address the future challenges ahead. Not only the role of CEO and CFO will change due to tech dominance in business also the role of the security officers and risk and security leaders will change. Zukin et all (2018) state “A broader skillset, including communication, change management, and leadership, is required in order to respond quickly and collaboratively to evolving cyber threats” (1)

Yuri Bobbert, PhD

Yuri bobbert

How to keep your business safe in a digital world?

In our society more and more devices are connected to the internet. These so called Internet of things (IoT) devices are everywhere and most of the time equipped with software. Root cause analysis of cyber-attacks reveal poor-coded software in these devices. And yes, hackers use vulnerable software to misuse these devices for hacks or attacks that have severe impact on organizations and society.

Yuri Bobbert, PhD