Technology
Why The Pret Index Matters to Cybersecurity Asset Management
Published by Jessica Weisman-Pitts
Posted on December 13, 2021
6 min readLast updated: January 28, 2026
Global Banking & Finance Review®
Company
Published by Jessica Weisman-Pitts
Posted on December 13, 2021
6 min readLast updated: January 28, 2026
The Pret Index shows a return to offices, highlighting cybersecurity asset management's importance as hybrid work models pose new risks.
By Ian Jennings, co-founder of BlueFort Security
Latest figures from Bloomberg’s Pret Index, a weekly indicator of the return to offices, train stations and pre-pandemic shopping habits, reveals that bankers in London are returning to the office at a rate that has outstripped their counterparts in Paris and New York. Spending at Pret a Manger’s stores in the City of London and Canary Wharf surged to 86 percent of pre-pandemic levels last week, the highest since the start of the crisis.
However, many firms are still trying to square the circle of data security with staff who want to work in a more flexible way. Deutsche Bank has said it will let people continue working from home two to three days a week once the coronavirus pandemic is no longer deemed a threat, while UBS Group said at least two-thirds of staff in the investment bank should be able to do some of their work from home.
It’s widely acknowledged that this hybrid working model has been – and continues to be – beneficial for many of us. But this new arrangement presents a significant data security challenge for financial firms, especially as many turned to cloud-based services to enable employees to continue working during the enforced ‘Work At Home’ order. For many CISOs the scope of these cloud-based services were (and still are) outside of their organisation’s visibility. The unintended consequence they now face is one of heightened risk from cyber criminals looking to exploit an extended, yet unprotected, threat surface.
In highly regulated industries the importance of mitigating this new threat surface just clocked ‘critical’ on IT and security teams’ scale of things to address. In October the UK’s Financial Conduct Authority updated its guidance regarding working from home warning that it has “powers to visit any location where work is performed, business is carried out and employees are based (including residential addresses) for any regulatory purposes”. The FCA has said that firms must prove that they have the systems and controls, including the necessary IT functionality and these systems are robust. They must also be able to prove they have considered any data, cyber and security risks, particularly as staff may transport confidential material and laptops more frequently in a hybrid arrangement.
You can’t protect what you don’t know
This old(ish) cyber security maxim profoundly illustrates one of the biggest problems facing cyber security professionals today: how can I defend my organisation from attackers when I no longer know what my cyber estate looks like? To illustrate the point, a recent study found that 30% of CISOs admitted that since March 2020 they’ve lost track of movers, joiners and leavers, and 29% stated they are missing corporate devices. This is a direct result of the enforced work from home order.
The key issue for CISOs and their security teams is simple: you can’t protect what you don’t know is there. If you want to apply effective security controls, knowing what assets you have within your environment is fundamental. It’s far easier to protect things that you know about.
Cybersecurity Asset Management Explained
Cybersecurity is all about IT assets. When companies are hacked, it is through their IT assets; their networks, hardware, and software are the points of entry for cyber attackers.
Poor asset management practices dramatically increase the chances that threat actors will be able to achieve their objectives, whether that’s to steal sensitive data, disrupt business operations, or otherwise put the organisation at risk. Asset management is essential to being able to address such risks efficiently and consistently.
Cybersecurity asset management is the process of identifying, on a continuous, real-time basis, the IT assets that your organisation owns and the potential security risks or gaps that affect each one. From a cybersecurity perspective, assets are best described as something that must be configured or managed to achieve security outcomes or something that may be impacted as a result of a cyber incident (usually the things you are trying to protect).
Generally speaking a cybersecurity asset management strategy has four key elements:
Approaching cybersecurity asset management
Because IT resources and security risks come in so many forms, cybersecurity asset management is a process that involves a variety of activities. Hardware, software, virtual infrastructure, information, and online accounts must all be considered.
The diversity of asset types and their sheer volume, even in small organisations, can make asset management a challenging task. Here are the key areas that should be addressed, broken down into relatively bite-size tasks:
Whether at work or going about our daily lives, we’re generally drawn to the things that look to be the most exciting. In cybersecurity, threat-hunting or red-teaming sounds, on the face of it, more exciting than asset management. But asset management is a critical foundational activity for all security programs, including those who spend their days spotting intrusions and fighting malware.
For asset management to deliver its full potential, it needs to be automated and easy to implement. Many organisations already have in place some of the automated resource discovery and threat identification tools that can help get things back on track. And get back on track they must, because any organisation that relies on software and hardware to power its operations – which virtually every business does today – is putting themselves at risk if they don’t.
The article discusses the importance of cybersecurity asset management in the context of hybrid working models and the Pret Index.
The Pret Index indicates a return to office work, which impacts cybersecurity strategies in hybrid work environments.
Hybrid work models increase data security risks due to cloud-based services and extended threat surfaces.
Explore more articles in the Technology category
