Wavestone, in collaboration with Société Générale, has launched an initiative aimed at promoting innovation in the cybersecurity space, raising some interesting questions about the role of innovation, not just in the very fast-moving, high-tech cybersecurity market, but in consulting more broadly.

Clients think innovation is important: in fact, it’s the quality they consider most important in a consulting firm, according to our research. At the same time, they often struggle to define what it means to be innovative and fully admit that they can’t point to individual consulting firms that are generally more innovative than others. Individual consultants, and sometimes entire project teams are recognised as taking an innovative approach, but clients remain sceptical of the extent to which this translates to an innovative culture across the firm as a whole.

The picture in cybersecurity is complicated by two factors. First, this is a very fast-moving market in which the pace of change isn’t driven by supply-side innovation, but by the demand-side: every successful new cyber attack will have defeated existing barriers and therefore demands a new response. It’s as though, on a battlefield, every time you’ve developed a new form of protective armour, your enemy comes up with a way to penetrate it.

The second factor is confidentiality. Although it would make sense for organisations that are under attack to share this information, there’s an understandable reluctance to suffer the reputational damage that’s likely to follow. Organisations are exchanging information, but it’s taking a huge collective effort of will to break the habits of confidentiality. In fact, the situation is the mirror image of what we usually see in business: instead of organisations wanting the market to recognise their ability to innovate, but not replicate it, in cybersecurity, you don’t want others to think you’re vulnerable, but you do need them to learn from your mistakes if only so that you can learn from theirs.

That creates a huge opportunity for consulting firms. They’re unlikely to be the organisations that develop the innovative responses (technology firms and clients will do that), but they can act as a vital channel, identifying new threats, talking dispassionately and confidently about the problems nobody else wants to talk about, and communicating new strategies for dealing with them.