Companies love to talk cybersecurity. As noted by Help Net Security, 82 percent of cyber and information security professionals said C-suite executives were “concerned or very concerned” about their overall InfoSec posture.

The problem? It’s all talk. Just 14 percent of CISOs report directly to the CEO, and many don’t have a seat at the boardroom table, meaning IT security concerns end up as secondhand information delivered to a roomful of executives who aren’t entirely sure what steps are necessary to shore up corporate defense.

This begs a critical question, one made increasingly relevant as data breaches become a daily occurrence: Can companies jump the cybersecurity action gap?

Chatty Cathy

The first step in moving from articulation to action? Empower InfoSec professionals to share threat intelligence and innovate network defense.

But this may be easier said than done. As eWEEK pointed out, this year’s RSA Conference saw more than 33,000 security professionals descend upon San Francisco. While InfoSec pros are indeed flocking to security conferences, which is necessary to engage community members and share data, they’re often doing one of two things: talking or listening. Action isn’t high on the list. Meanwhile, malware-makers are busy churning out thousands of new programs each day and throwing them at corporate defenses to see what sticks.

Of course, some of this conversation is necessary. C-suite members need to understand the InfoSec viewpoint and its line-of-business value. Additionally, many companies are actively engaged in the long, talk-heavy process of recruiting new and talented cybersecurity pros — a difficult task with companies worldwide facing a shortage of security experts.

Positive Change for Cybersecurity

It’s not entirely hopeless. According to CSO Online, two-thirds of companies undergoing a merger now bring in IT security pros to make sure everything is on the up-and-up. The driving force here seems to be a few harsh lessons learned from enterprises acquiring other companies only to learn after the fact that their new asset lacks decent network security and was the victim of a significant data breach.

It makes sense; when big money is on the line, CEOs and other executives want to make sure they’re not buying a lemon or getting stuck with someone else’s problems. As a result, InfoSec pros are tapped for their advice and asked to recommend the best course of action.

In day-to-day operations, however, this is a harder pill to swallow. CISOs will never say security is good enough; there’s always room to grow, which means there’s always a need for bigger budgets and more freedom. Jumping the gap requires a two-pronged effort. First, CISOs need to develop better boardroom habits and security suggestions must be delivered to them as easily quantified, actionable items. C-suites, meanwhile, need to get off the fence.

If cybersecurity is a priority, it needs a seat at the table and a mandate for legwork once the meeting is over. Malware-makers aren’t hunkering down for day-long meetings — they’re churning out new code and hoping for the best. While corporate response must be informed by intelligent conversation, it’s time to consider a new proportion that’s in line with InfoSec merger participation: one-third elocution, two-thirds execution.