Investigating industry norms of cyber security: a critical content analysis of PwC's annual reports

Cyber security norms and expectations do not remain static. For example, cyber security was traditionally perceived as a technical area (Eling et al., 2021), but its' scope has expanded to include non-technical, behavioural and/or human aspects (Furnell and Clarke, 2012; Dhillon and Backhouse, 2001). Understanding how these norms and expectations have changed can provide insight into the evolving nature of cyber security, helping with predictions of how cyber security may evolve and the resulting organisational behaviour. Namely, as these norms change, they affect how organisations implement and manage cyber security and related information; thus, organisational behaviour will not remain constant. In addition, matching these norms and expectations with current organisational cyber security maturity can elucidate whether current cyber security maturity is meeting current or historic norms. This is a crucial question as, fundamentally, it can be difficult to encourage the adoption and implementation of cyber security in organisations. Furthermore, encouraging an implementation that meets current norms can be difficult as any cyber security implementation is typically focused on historic norms. This focus can then limit the relevance of the cyber security implementation in combating current cyber attacks, negatively affecting the security of the organisation.

To illustrate how cyber security norms and expectations have evolved requires longitudinal data with an industry- or economy-wide focus. Collecting such data can be difficult as sharing such information requires trust between the collector and sharer of the information. As such, we rely on industry reports by trusted cyber security organisations, which have established positions of trust and credibility in cyber security. Further, recurring industry reports provide a way to illustrate and describe how cyber security norms, expectations and maturity have evolved over time. Such insight is particularly relevant in understanding the history of cyber security to then direct future cyber security research and efforts. Hence, in our study, we use PwC's Global Trust Insights report, which has been released annually since 1998. Using a combination of thematic and content analysis, we describe the different norms and expectations facing cyber security and the current performance, as measured by PwC, of organisations.

Our study contributes to research by illustrating the role and value of industry reports in elucidating the difference in perspectives of industry compared to research. This is critical in the context of cyber security where industry plays a significant role in shaping the expectations and practices of organisations regarding cyber security. Furthermore, describing how cyber security's norms and beliefs have changed over time provides future researchers with relevant insight to augment their own studies where they compare historical and current practices, e.g. is it that organisations were failing to implement best practice cyber security processes or that expectations at that time were much reduced? In addition, our study contributes to practice by demonstrating the importance of industry providing motivation for their continued involvement.

The remainder of this study describes the relevant literature and the method followed by presentation of the analysis of PwC's industry reports, discussion and resulting conclusions.

Despite cyber security's origins as a technical domain in the 1970s, its relevance to organisations has long been noted with Madnick (1978) referencing the need for an economic perspective for management. With the rise of cyber incidents that are perceived to threaten organisational reputations and growing societal expectations (Makridis, 2021; Boggini, 2024), organisational cyber security is becoming increasingly important.

Organisational cyber security is considered critical to equip organisations with the skills, knowledge and supporting mechanisms to enable cyber security maturity. As organisational cyber security is concerned with organisational behaviour in light of the cyber security threat environment, the approaches and foci in the industry and academic research can vary. According to Johnston (2022), typical themes apparent in academic research include governance and strategic decision-making, cybercriminals, cost and liability, acceptance for cyber security and incident response. From an industry perspective, discussions focus on preparing, detecting, responding and recovering from cyber incidents (National Institute of Standards and Technology, 2024).

Hence, these overlaps in foci demonstrate that, similar to other phenomena concerned with organisational behaviour, organisational cyber security as a phenomenon is the combined effort of academic research and industry. It is common to observe equal efforts from research and industry to solve or approach specific cyber security problems. For example, the concern of poor cyber hygiene practices has been the focus of industry efforts, such as the “Secure Our World” campaign by the Cybersecurity and Infrastructure Security Agency (2023). At the same time, the literature also explored the meaning of cyber hygiene, e.g. Vishwanath et al. (2020), Neigel et al. (2020) and Ncubukezi et al. (2020). The former study, Vishwanath et al. (2020), conceptualised cyber hygiene and developed a measure for it. Neigel et al. (2020) described how holistic cyber hygiene education could be delivered considering human factors. Ncubukezi et al. (2020) explored the state of cyber health in 30 small and medium-sized businesses. Notably, the industry efforts were focused on creating at-scale change in practice, whereas the above literature tended to focus on the meaning, delivery and components of cyber hygiene, and small-scale studies of the current state.

This variance in focus is reflective of the key differences between industry and academic research in organisational cyber security, and why both streams are needed for organisational cyber security research. Namely, industry research provides directly actionable insights for organisations derived from large-scale primary data collection leveraging their trusted relationships with customers and their brand reputation. These insights recognise the importance of cyber security but tend to focus on relatively isolated perspectives of cyber security, relative to academic research. These insights can provide clear generalisable overviews of appropriate cyber security practices and norms. In contrast, academic research tends to perceive cyber security in a causal model recognising the interdependencies between the characteristics of the organisation, human factors, technical aspects, environmental factors and cyber security (see Hsu et al. (2012), Hu et al. (2007), Ogbanufe et al. (2021)). Hence, organisational cyber security research can have significant diversity reflected by studies on cyber attacks (Roumani and Alraee, 2025), incident response (Auzina et al., 2023), behavioural aspects (Moustafa et al., 2021), employee compliance (Wang et al., 2015; Wong et al., 2022; Donalds and Osei-Bryson, 2020) and organisational structures and procedures (Daud et al., 2018). However, due to the difficulties of collecting data for academic research noted by Chowdhury et al. (2020) and Chidukwani et al. (2024), academic cyber security research tends to have smaller samples with an emphasis on qualitative data. Using qualitative data allows for insights into specific cases of organisational cyber security, allowing for exploration and investigation of outliers and unexpected behaviour. Hence, insights from academic research can then provide context for cyber security implementation in organisations but may not necessarily be as actionable as industry research, largely due to the smaller sample size.

Both perspectives are needed as cyber security in organisations is not currently, at the time of writing, a science. It does not exist in isolation. Furthermore, as Wilson and McDonald (2025) noted, there is no one way that cyber security can be implemented in an organisation as organisations are heterogeneous. However, relying solely on academic research, which acknowledges the heterogeneity of organisational cyber security research, is not ideal. Organisations need clear guidance on what to do in the present time in response to their threat environment. Guidance, which is multi-clause-complex to account for all the variance of organisations, is not necessarily useable. In fact, such guidance may be counterproductive, impeding cyber security implementation in organisations. Hence, industry research providing norms of effective cyber security for organisations is needed to translate current practices and research into actionable insights. In addition, though organisational cyber security implementation may be unique between organisations, the variances between organisations are fine-grained. Having fine-grained variance means that, on an individual organisational level, there may be key differences but, from an industry-wide perspective, these differences may be less notable. In other words, the outliers or unexpected behaviour explored in academic research may not necessarily need to always be encapsulated in guidance provided to organisations. Thus, industry research plays an important role in translation and enablement of organisational cyber security.

Despite the importance of industry research, their inclusion in research is less noticeable. Typically, industry research tends to be mentioned in the introduction to describe the research problem, or in the discussion section as part of extrapolation and justification of findings. For example, Lallie et al. (2021) noted the COVID-19 scams that arose during the pandemic, citing industry or non-academic sources. However, industry reports can offer additional contributions and insights relevant to research. For example, insights into the current industry perspective on different phenomena and how these perspectives may have changed over time. There is then relevance in incorporating industry research, to an extent, into our research.

To provide some exploratory evidence of the relevance of industry reports in academic research, we study and analyse the recurring PwC's Global Trust Insights report. This series of reports was selected for two reasons. Firstly, PwC is a reputed cyber security consulting organisation likely to have employed industry-appropriate research methods. Though these reports may not necessarily be required to meet the same level of rigour as some academic studies, it is expected that, due to the size and reputation of PwC, they are likely to have adopted some research rigour to ensure the generalisability and relevance of their findings. Secondly, these reports have been produced for over 20 years. Hence, the reports collectively document how perspectives on cyber security have changed and the state of cyber security over time. Such insights, considering the difficulty of obtaining longitudinal data in academic cyber security research, highlight a strength of industry research. While other industry organisations have produced similar reports, we rely on the PwC reports as they are publicly available, have been produced for the past 20 years and are considered to be part of the series of “Global Trust Insights”, meaning that there is some consistency in their intent. This is important to ensure that we can then compare different reports as they have the same intent.

Reports are collected through PwC's website with additional reports provided through contacting PwC. In total, 16 reports were collected with the list of reports analysed provided in Table 1.

To analyse these reports, we use a combination of thematic and content analysis. Thematic analysis allows researchers to identify patterns in data (Braun and Clarke, 2006) with an emphasis on qualitative data. Using thematic analysis is appropriate for this study as it allows for an overarching understanding of the approaches taken in the various PwC industry reports over time. Thus, our thematic analysis is developed inductively using social constructivism epistemology, namely, to recognise that the industry reports are a subjective perspective of cyber security informed by current societal cyber security beliefs.

We also use content analysis to account for the quantitative and statistical content of the reports. Content analysis allows for the analysis of quantitative and/or qualitative data using codes (Jaspal, 2020). We inductively develop these codes as we analyse the reports using several rounds focusing on patterns that arose relating to content, style and structure. Codes generated were refined further through subsequent iterations of the reports. Further discussion is provided in the next section.

Our analysis of the sixteen PwC annual cyber security reports spanned 2003 to 2025. The earlier reports, 2003–2008, were not available in official formats. Instead, they were made available or commented on via the CSO website (these reports available on the CSO website are cited as from the CSO website, but in-text citations refer to them as PwC to avoid confusion). Some of the later reports were country-specific versions whereas others were global versions. We note these differences in our subsequent analysis below describing the inductively derived codes.

We observed that from 2003–2008, the titles used for the reports tended to be the title of the project or survey with the year appended, e.g. “The Global State of Information Security (2005)” or “The Global State of Information Security (CSO, 2008)”. In contrast, perhaps reflecting an increasing strategic element to the report, the titles changed from the 2012 sample to become more strategic and compelling for the audience, e.g. the 2012 report was “How much do you value your information? Staying on top of ever-increasing security threats”. This trend continued to the latest report in the sample (2025): “Bridging the gaps to cyber resilience: The C-suite playbook”. There were some exceptions; the 2017 and 2022 versions had titles more typical of the earlier 2003–2008 reports in the sample. Regarding the 2022 report, this change in title may reflect the change in focus from information security to digital trust that occurred in the previous year for the report. The 2017 report title may reflect the introduction of region- or country-specific reports – the 2017 report is the Singapore highlights of the global report.

Naturally, as we are missing some of the reports from specific years, it is unclear whether changes occurred in 2012 or if they occurred in previous years, e.g. between 2009 and 2011.

Besides the title changes, we also observed that the sample size tended to decrease over time. Though not all reports stated their sample size, we observed that the sample size in 2005 was 8200 respondents, which decreased to 2024 to 3876 respondents. The sample characteristics have extended from solely information technology and security executives to a broader range of executives. However, the decreasing sample size may reflect the increasing number of similar surveys in industry, making it difficult to encourage people to participate in specific surveys.

The focus of the reports tended to be on broad organisational cyber security. Even though technical controls were recognised, there was more of a focus on the aspects that are relevant to cyber security executives and managers.

The length of reports also varied from 8 to 36 pages with no specific trend, i.e. an increase in pages over time. Rather, differences in report lengths seemed to be due more to the type of information or insights being produced and the design of the document, i.e. the inclusion of photos.

For the reports with images, i.e. from 2012 onwards in our sample, the title pages typically involved people with some form of technology. Exception included the 2016 report (“Turnaround and transformation in cybersecurity – key findings from the Global State of Information Security Survey, 2016”), 2017 report (“Global State of Information Security Survey, 2017 – Singapore”), 2020 report (“Digital Trust Insights Pulse Survey Findings, 2020”) and 2023 report (“A C-suite united on cyber-ready futures – findings from the 2023 Global Digital Trust Insights”). For the reports that tended to have images with people and some form of technology, the majority of photos tended to contain individuals who aligned with the typical image of cyber security consultants, that is, individuals fitting the depiction of those who identify as male.

A summary of these findings is provided in Table 2.

All samples referenced cyber incidents and positioned cyber security as a response to cyber incidents. In some instances, specific examples were referenced, e.g. the 2008 report made available on the CSO website noted the TJX cyber attack (CSO, 2008). In addition, the 2018 report highlighted WannaCry, Equifax and Petya (PwC, 2018a, b, c). Generally, many of the reports tended to speak generally about cyber incidents.

Cyber criminals were also infrequently mentioned, besides a general reference to their impact on organisations – that cyber security is important because of cyber criminals. An exception is the 2018 report (PwC, 2018a, b, c, p. 8), which highlighted that “even the bad guys are seeing commercial opportunity grow. Cybercriminals have become so successful that they have started to expand using franchise models. Ransomware, data- theft, spyware, propagation networks and other infrastructure can be purchased on the Dark Web by anyone with an Internet connection and crypto currencies and hidden finance make tracking transactions difficult. We are now seeing Ransomware- as-a-Service, which allows anyone with a computer and Internet connection to use ransomware kits so long as they pay a fee to the original creator or seller”.

Across all reports generally, the importance of strategy and governance was highlighted. Even in the 2003 report, the need for strategy was referenced, e.g. “you're told that aligning security and business strategies is a top priority” (CSO, 2003, p. 3). Similarly, in later reports, the importance of strategy is also highlighted “to manage tomorrow's threats, investments alone are not sufficient — organisations should also elevate their approach to cyber strategy and leadership” (PwC, 2025, p. 19). This focus on alignment of security and business is also a continued theme throughout the sample. Potentially, the ongoing emphasis on strategy is not solely due to its perceived importance but also because there are observed deficiencies in cybersecurity: only 23% of the respondents indicated that they were planning to align business objectives with cyber security strategy (PwC, 2018a, b, c).

More recently, in the 2025 report (PwC, 2025, p. 18), cyber security strategy is highlighted as important as it allows the organisation to develop a competitive advantage: “Your cybersecurity isn't just safeguarding data, it's safeguarding your brand. In a competitive landscape, trust is everything. Strengthen your security measures now to help your organisation stand out as a leader in data integrity”. This quote illustrates that cyber security is being positioned as a competitive advantage similar to having productive employees and cost efficiencies, reflecting a change in how cyber security may be positioned.

The need to align their business and cyber security strategies is also extended to a general perspective around the importance of integration and/or a holistic approach. Largely, this integration focused on integrating the board or higher management with cyber security. For example, in the 2018 report it was noted that it is critical to communicate with the board about cyber security issues, such as providing information on metrics and strategies. Integration also recognised the need for cyber security executives to be aware of what is happening. This lack of awareness was emphasised as an issue by PwC (CSO, 2007, p. 6): “when close to a third of CSOs and CISOs, who presumably should have the most insight into security incidents, said they don't know how many incidents they've suffered or how these incidents occurred, that's even worse”. One solution suggested recently to this issue is the concept of a holistic approach; PwC (2025, p. 6) notes that understanding “the broader impacts of a breach – beyond financial harm – [can help] to build true resilience”.

In addition, the importance of information sharing and collaboration with external partners was also referenced (see 2016 report).

The importance of compliance was also highlighted. In earlier reports, it was recognised that compliance tended to be ambivalent. Specifically, the 2005 report by PwC made available via CIO (CIO, 2005) highlighted that 40% of respondents in the health care industry did not believe that the Health Insurance Portability and Accountability Act applied to them, which is surprising.

In later years, compliance was positioned as a driver for improved cyber security: the 2006 report published on CSO noted that “there's evidence that organizations that comply with security laws are more likely to be integrating and aligning security with their enterprise's business strategy and processes” (CIO, 2006, p. 3). However, legislation can also drive a checklist approach to cyber security, which may be less appropriate in some circumstances – “adhering to regulations and standards doesn't amount to thorough security policy” as noted by PwC but made available by CIO (CIO, 2005, p. 5).

The importance of legislation appears to be more marked in recent years, reflecting emerging legislation, such as the General Data Protection Regulation and equivalent data protection regulations in different countries. In particular, the emergence of these regulations and their referencing in these sampled reports indicates the very strong link between privacy and cyber security for organisations.

The mention of employees in the reports has increased over the years. Initially, employees were referenced as potential attackers. For example, in the 2007 report published on CSO, it was noted that “this year marks the first time “employees” beat out “hackers” as the most likely source of a security incident. Executives in the security field, with the most visibility into incidents, were even more likely to name employees as the source” (CSO, 2007, p. 4). More recently, from 2017, employees were also recognised as providing key talent critical for protecting the organisation. In particular, it is suggested in the 2023 report that cyber security executives should consider “which skills you really need in your cyber programme, update how you recruit for those, and give your cyber talent incentives and growth paths that are reasons to stay” (PwC, 2023, p. 28).

Across all reports, the importance of risk management was emphasised. It was suggested in numerous reports that organisations need to be making decisions considering the risks. For example, the 2006 report made available on CIO noted that “companies continue to do business with insecure organizations” with the implication that this may not be an appropriate risk-management-driven decision (CIO, 2006, p. 2). In later reports, such as the 2025 report (PwC, 2025), there is an emphasis on risk quantification and measurement reflecting how increased amounts of data has driven the need for stronger measurements across organisations.

With the increase in the amount of data held by organisations, we also observed that there was difficulty for organisations in converting data into intelligence while avoiding data overload (PwC, 2005). This may involve using data analytics. Interestingly, the intelligence can drive investment: the 2016 report noted “it appears to be influencing where organisations are placing their bets, at a time when funding to support the function is not as freely available as it was before 2010” (PwC, 2012, p. 13).

Though not mentioned prior to 2012, many of the reports referenced emerging technology. In some instances, the references cited the potential innovation enabled through organisations adopting emerging technology, such as cloud computing and, more recently, artificial intelligence. However, in some instances, reference was made to the potential risks that may arise from emerging technology. For example, the 2014 report highlighted that “So it is a bit surprising to learn that many organizations have not seriously addressed the security implications of cloud services. For instance, among survey respondents that use cloud services, only 18% say they have policies governing the use of cloud” (PwC, 2014, p. 11).

It was noticeable in the reports the emphasis placed on leadership, particular C-level executives. For example, the 2006 PwC report highlighted that 64% of sampled organisations did not have cyber security C-level executives (CIO, 2006). Consequently, this meant that cyber security may not be included or considered at a strategic level. This issue around having C-level executives for cyber security is still apparent in more recent reports. PwC (2025) reiterated the importance of ensuring that there is a C-level executive, such as a CISO, at the board. This emphasis may reflect that the target audience for many of these reports tends to be those in the C-suite.

Later reports also discussed what characterises effective leaders for cyber security. For example, the 2016 report noted that “Today's CISO or CSO should be a senior business manager who has expertise not only in cybersecurity but also risk management, corporate governance and overall business objectives. [They] should have access to key executives to provide insight into business risks and should be able to competently articulate risk-based cybersecurity issues to the C-suite and Board” (PwC, 2016, p. 18). In addition, the 2025 report clarifies the different roles that different cyber security leaders can have by specifying the different actions that CISOs, CIOs, CTOs, CFOs, CEOs and the Board can take across their entire report. For example, regarding emerging technology, it is suggested that CISOs can drive standardised and ensure access controls are implemented, CIOs can create AI impact assessments for executives and Chief Data Officers can ensure that data governance protocols are adhered to and updated to suit emerging technology (PwC, 2025).

Across the reports, there was conflicting evidence produced about the state of budgets. In some instances, it was highlighted that budgets were increasing (CIO, 2006; CSO, 2008). However, in other reports, it was highlighted that budgets may not be sufficient, e.g. PwC (2012, p. 1) noted that there was a “reluctance to commit scarce funds to the information security mission, even at the risk of degradation in security-related capabilities”. In addition, the 2014 report noted that spending on cyber security tended to represent about 3.8% of the total spending on information technology (PwC, 2014). However, more recently, there is evidence that budgets are increasing, reflecting regulatory focus on cyber security and the evolving threat environment (PwC, 2024, 2025).

Despite discussions around budget levels, there was an indication that knowing where to direct spending was also an issue. More recently, it was suggested that spending should be directed by the need to build trust or competitive advantage. For example, the 2017 report highlighted that “businesses are exploring new opportunities to create value and competitive advantages by integrating cybersecurity with digital business strategies” (PwC, 2017, p. 7). Similarly, in the 2025 report, it was recognised that spending can vary but that it is essential that spending is used to build trust.

We also identified other codes that were less frequently observed in the sample. For example, SMEs were not a common consideration in the reports. The 2018 report included an entire subsection on SMEs, though this may be because it was focusing on Australia where SMEs represent a large percentage of the economy (Statistics Australia, n.d.). Their subsection identified that SMEs are recognising and implementing cyber security. In saying that, SMEs were considered to be those with $25 million to $499 million of revenue, which may not necessarily be a comparable definition of SMEs considering broader industry and literature definitions, e.g. Statistics Australia (n.d.). Nevertheless, their findings indicated that SMEs are more aware of cyber security because of recent cyber attacks, legislation and pressure from larger organisations in their supply chain (PwC, 2018a, b, c).

Interestingly, physical security was less mentioned in the reports. An exception was PwC (2006, p. 3), which states that “one of the biggest changes from last year is that more companies are integrating physical and information security. The percentage of organizations that reported having some form of integration between physical and information security has grown rapidly, to 75% in 2006 from 29% in 2003. A similar spike occurred in the percentage of respondents saying their physical and information security chiefs report to the same executive leader”. The PwC (CSO, 2008, 2007; PwC, 2019) report also noted that it was important, though the latter report focused on IoT. Such a limited focus on physical security indicates that it is perhaps not perceived as a significant issue for organisations anymore with the rise of cloud computing and other digital tools shifting cyber security to being more of a digital issue.

We also observed that the type of language used also changed across the sample of reports, reflecting a change in how cyber security is conceptualised and the position that PwC takes considering the cyber security industry. In earlier reports, they tend to use “we” giving the reports an approachable tone. As an example, PwC (2008, p. 1) noted that “in this, our sixth year of conducting the “Global State of Information Security” survey with PricewaterhouseCoopers, we got an earful about the challenges, worries and wins in security technology, process and personnel”. Later reports, i.e. after 2014, tend to avoid using “we” and become more objective and formal in their language.

Furthermore, instead of a purely data-focused report, there are more insights provided through quotes from experts in earlier reports. In contrast, later reports focus on the data with limited use of quotes. There is also a focus on practical and actionable advice, demonstrated by “call to actions” and “wake up calls” pop outs.

In addition to the language used, we also observed a change in how cyber security was positioned. Earlier reports treated cyber security as a problem recognising that it was a key unique issue. For example, PwC (2005, p. 2) noted that cyber security is “a thankless, impossible business”. Similarly, the 2007 report highlights the anxiety that cyber security employees are feeling (PwC, 2007). In contrast, later reports treat cyber security as a per-business issue that still needs attention, though this attention is different than what other business issues may need: “that strategy [regarding withholding investment during economic downturns] doesn't work for information security” (PwC, 2012, p. 5). In addition, later reports treat cyber security as normal; there is reduced rhetoric aiming to sympathise with the audience, implying that cyber security is now an ordinary component of business activities.

Besides the language changes, we identified a common symbol used throughout reports: the concept of a leading organisation. By a leading organisation, this refers to a role model organisation that has implemented best practice cyber security, as present in a number of the reports. For example, the 2005 report references the idea that a leading organisation, which they note as being in the financial services industry, is “a best practices group that, while still struggling to put out fires, has devoted more time, resources and strategic thinking to its information security posture than the average respondent” (PwC, 2005, p. 3). Since this 2005 report, leading organisations also went further than best practice to having a passion for cyber security, going further than compliance. As an example, in 2012, these leading organisations were considered to be “front-runners” who drive their spending by their customer and client needs and are “passionate about protecting data” (PwC, 2012, p. 7). Similarly, in the 2014 report, it was stated that their defined leaders “are enhancing their capabilities to do just that by implementing policies that elevate security to a top business imperative— not just an IT challenge” (PwC, 2014, p. 12). This passion and enhancement is also recognised in top performers highlighted in the 2024 report but in the manner of good stewardship (PwC, 2024).

Besides the themes identified in the previous section, there were also overall patterns identified that illustrated the cyber security norms and expectations held across the sample, which we describe below.

As an overall comment, interestingly, we did not observe a substantial difference between the reports in terms of their focus; rather, we observed a sharpening of focus on strategy and data-driven insights. This is surprising in the context that cyber security is typically positioned as a constantly changing domain due to an evolving threat environment and defence mechanisms, e.g. the shift towards AI-enhanced cyber security controls. Potentially, this limited difference across the reports over time may indicate that cyber security in a broad sense has not advanced considerably. Instead, minor changes regarding how cyber security is implemented, i.e. the evolving defence mechanisms, and what it addresses, i.e. the evolving threat environment, have occurred but, as a whole, concept, it has not changed.

The first norm that we identified is that cyber security is a strategic issue. Across all the reports, the importance of strategy was emphasised. In particular, it was suggested that having cyber security at a strategic level helps ensure the alignment of cyber security with the business. It is not unexpected that this norm exists; it is apparent in the literature, e.g. James (2018) and Hepfer and Powell (2020), that strategy is considered critical. Similarly, in many cyber security frameworks, there is a recent growth of recognition of the importance of strategy. For example, the recent NIST Cybersecurity Framework 2.0 (2024) included a separate body of controls for governance, which was not present to that extent in the previous version released in 2018.

Despite the recent importance of strategy, it is still a relatively new concept in cyber security in research and practice. Hence, it is surprising that even in early reports from PwC that cyber security strategy was a focus. For instance, the PwC (2003) report highlights that the lack of strategy is an issue affecting cyber security effectiveness. This trend of emphasising strategy continues across the reports with the 2025 report suggesting that businesses should have strategies for cyber security that even include cyber investment (Pwc, 2025). Considering that PwC reports have been continually encouraging a focus on cyber strategy, yet it is still emerging in frameworks, which are another component derived from industry, it appears that there is a heterogeneity in focus within the cyber security industry. Namely, those in business as cyber security executives, i.e. the typical audience for PwC reports, are focused on strategy, whereas those who focus on frameworks, which provide a way to implement and measure cyber security, are less focused on strategy. One could suppose that this difference in focus is because those who look at and develop frameworks are typically more operational in focus and, perhaps, even more technical in focus. This supposition is largely derived from the reality that frameworks and standards for cyber security are developed by practitioners in the industry. This does not necessarily include cyber security executives. Hence, it is possible that if the developers of frameworks are not working as cyber security executives, the value of strategy to them may be limited. As a lack of strategy does not preclude implementation, it is reasonable that framework and standard developers may be less concerned with cyber security strategy historically.

Irrespective of where this variance in focus emerges from, it is still of interest as it demonstrates that cyber security from an industry perspective has multiple heterogeneous but linked emphases in play. There has been a push from reports, such as the PwC sample, to focus on cyber security strategy. One would consider that this is then the norm: cyber security is a strategic issue. Yet, at the same time, there has been emphasis placed on other areas by other stakeholders, indicating that this norm may not be as common as expected. Our evidence in the context of the industry suggests that, though we typically treat the cyber security industry as homogeneous in research, there is a greater variance than expected in what they perceive cyber security to be. Potentially, the limited recognition of strategy by other cyber security practitioners until recently may explain why PwC continues to suggest it is important and under-utilised.

The second norm we identified was developed over time in the reports: cyber security is a business issue. By this, we mean that cyber security has become commonplace for businesses so that instead of being treated like a unique and rarely occurring event, it is now treated in a similar way to any other business issue, e.g. sustainability. This is reflected in recent reports where the rhetoric shifts from being less sympathetic and emotive to more objective in tone. In other words, the rhetoric becomes more business-like over time. This change in tone may reflect that cyber security is now seen as a normal issue to be considered, indicating that it is now both normal and expected for organisations to be implementing cyber security. Consequently, there may be little excuse for organisations that fail to implement cyber security.

Thirdly, we identified that cyber security requires good leadership. In particular, it is suggested that having a good leader is critical for an organisation's cyber security success. This is unsurprising considering that there is substantial literature on the importance of leadership, e.g. Triplett (2022) and Feng et al. (2019). Fundamentally, it is suggested that a good leader can enable the cyber security of the organisation through providing motivation and an example to follow. Hence, it is then expected that most organisations have some form of leadership implemented.

We also identified a fourth norm in that cyber security is a benchmarkable concept with an ideal organisation existing. Across the reports, we identified that there was typically an ideal organisation in the minds of the PwC report authors. This organisation represented best practice cyber security, as referred to in some PwC reports as a leading organisation. A leading organisation was defined as having all of the suggested practices discussed and measured in the PwC report implemented. The measurement of these practices through the surveys in the PwC reports indicates that even if a leading organisation was not explicitly mentioned, the leading organisation was still referenced implicitly. This implicit reference largely occurs as the presence of suggested practices measured in the PwC reports indicates that PwC considers that these practices are best practice and should be implemented. Hence, any organisation that implements these practices would be considered a leading organisation.

Positioning reports around the idea of a leading organisation explicitly or implicitly encourages benchmarking by other organisations, which can be motivating. In addition, having a leading organisation in mind proposes that cyber security is a benchmarkable concept with an end in sight, i.e. once an organisation achieves a leading organisation status that is sufficient. This conceptualisation of cyber security is not unusual; much of the literature is concerned with developing measures for cyber security, e.g. Tsen (2023). However, such a conceptualisation is interesting considering that cyber security was created to manage cyber incidents; therefore, it is implied through these best practices that it will improve an organisation's ability to manage cyber incidents. This is not necessarily the case with research indicating that cyber incidents are inevitable (Björck et al., 2015); hence, a benchmarkable conceptualisation where there is a recognition of a perceived end-goal in place may not necessarily be appropriate.

Finally, we observed that there were some norms and expectations that arose more from what was not said than was stated in the reports. For instance, the focus of the reports primarily on larger businesses implicitly indicates that cyber security is considered more relevant to larger businesses. This implicit focus is reiterated by the fact that the only mention of SMEs was in context to external pressures, which included larger organisations and regulations (Pwc, 2018a, b, c).

In addition, employees tended not to be mentioned in earlier reports, except for cyber security personnel. Despite the human factor being acknowledged as a critical factor impacting the effectiveness of cyber security (Bowen et al., 2011; Nifakos et al., 2021), there is relatively little mention of employees in the early reports beyond being a potential threat, e.g. PwC (2007). In more recent reports, employees are mentioned as being useful talent (Pwc, 2023), but their mention is still minimal considering the criticality of the human factor identified in other literature and industry, e.g. Bélanger et al. (2022). This may indicate that for a strategy-focused report as highlighted earlier, employees are simply another resource as part of the strategy. The potential impact of their vulnerability is then another risk to manage but not notable in itself to be commented on.

Our analysis of the reports identified that the cyber security norms and expectations do change over time, though the overall focus of these reports does not appear to change as much. Thus, indicating that cyber security as a whole may not have changed significantly over time. In addition, we identified that the PwC reports have been emphasising strategy and leadership since their early years of publication, which contrasts with the relatively recent addition of strategy to broader cyber security. Our study is limited by the narrow focus on PwC reports, meaning there is the possibility of selection bias; future research could address this issue by considering additional consulting reports.

Though our study is limited by the PwC reports that were available and the historic evidence of cyber security at the time of those reports to corroborate the insights from PwC with the trends in industry at the time, our study contributes to the broader theoretical understanding of cyber security, illustrating that though norms and expectations have changed, the nature of cyber security has not. As such, it is reasonable to expect that cyber security as an entire field may evolve slowly, though the tools and the threats may evolve at a faster rate. This slower evolution may reflect the now accepted business nature of cyber security, illustrated in the PwC reports, though future work could further explore this. Furthermore, a research implication of our study is that it demonstrates the value of industry reports in research by providing a context of cyber security useful in any analysis of historic cyber security in organisations, improving any insights from such analysis. Hence, future studies could use these industry reports in supplementing their analysis. This study also contributes to practice by synthesising these reports to identify patterns and trends that can direct guidance and advice provided to organisations. For instance, cyber security strategy is crucial. Furthermore, our analysis indicates the critical role that industry organisations, such as PwC, provide with industry reports; namely, they provide a unique perspective on cyber security, reflected by PwC's focus on strategy despite the advice provided by the cyber security industry at the time.

The author would like to acknowledge the reviewers and editors of the journal for their insightful feedback.