How Organizations are Failing to Prioritize Cybersecurity Investments

Boston Security Budgets Experience Slower Growth Amid Economic Uncertainty

A Decrease in Security Budget Growth

The 2023 Security Budget Benchmark Report, released by IANS Research and Artico Search, reveals that security budgets across industries are experiencing slower growth compared to previous years. The report analyzed data from 550 Chief Information Security Officers (CISOs) and other security executives.

In the current budget cycle, the average security budget increase reported by respondents was 6%, a significant decrease from the 17% increase seen in the prior budget cycle. This decline marks a 65% reduction in growth. Technology firms experienced the most prominent decline, dropping from +30% growth in 2021-2022 to +5% this year. More than 33% of organizations froze or cut their cybersecurity budgets.

Nick Kakolowski, Senior Research Director of IANS, expressed concern about the incremental growth being insufficient in the face of increasing security challenges. He highlighted that some CISOs faced difficulties in obtaining the necessary resources, with budget freezes being reported. With recent high-profile data breaches at Clorox, MGM, and Caesars, Kakolowski emphasized the need to closely monitor how companies approach budgeting for 2024. According to the research, organizations that adjust spending in response to major industry disruptions see an average budget increase of 27%.

Security Budgets as a Share of IT Budgets

Although security budgets are experiencing slower growth, security spending as a share of Information Technology (IT) budgets is increasing. Since 2020, security spending relative to IT spending has risen from 8.6% to 11.6%. Technology firms reported the largest proportional spending at 19%. This suggests that the impact on security spending is moderate compared to IT spending.

Industry-Specific Trends

The report identified various trends across industries. The technology and retail sectors had the largest share of organizations with declining security budgets. In contrast, the consumer goods and services sector, as well as legal firms, had the highest percentage of budgets remaining flat year-over-year. The business services sector saw an increase in budgets in more than three-fourths of companies.

An interesting finding is that firms funded by venture capital (VC) or private equity (PE) firms consistently maintain higher security budgets compared to publicly listed companies, not-for-profit organizations, and other forms of private enterprises. VC-backed firms have an average security budget percentage of nearly 30%, which is more than twice the overall percentage.

Factors Driving Budget Increases

The survey revealed that 63% of respondents received a budget increase. In 20% of cases, the increase was a routine annual adjustment, resulting in an average budget increase of 7%. Increased risk and digital transformation emerged as new reasons for budget increases, cited by 17% and 15% of respondents, respectively.

Staffing and Compensation as Key Budget Categories

The largest category in security budgets is staff and compensation, accounting for 38% of the overall budget. The move towards cloud-based architectures is impacting staffing allocations, with companies fully in the cloud allocating 47% of their budget to staff, compared to 35% for companies fully on-premise.

Recruiting professionals with highly sought-after cloud skills is a challenge and often comes at a high cost. Steve Martano, a partner and executive recruiter at Artico Search, explained that the shift to cloud technologies necessitates hiring cloud architects, cloud engineers, and cloud compliance professionals at a rapid pace, driving up the cost of talent in these areas.

The Philosophical Discussion

These findings raise important philosophical questions about the intersection of economic uncertainty, prioritization, and the failure to allocate sufficient resources to cybersecurity. Despite facing ever-evolving threats, security teams are grappling with slower budget growth. This situation can have significant implications for organizations and society as a whole.

The decline in security budget growth comes at a time when cyber threats are becoming more advanced and pervasive. The recent high-profile breaches at Clorox, MGM, and Caesars serve as stark reminders of the potential consequences of inadequate cybersecurity measures. Organizations must recognize the importance of investing in robust security measures to protect sensitive data and mitigate the potential damage from cyberattacks.

Furthermore, the increase in security spending as a share of IT budgets indicates that organizations are realizing the importance of prioritizing security. However, the magnitude of this increase may not be sufficient to address the rapidly expanding scope of security challenges. As technology evolves and organizations undergo digital transformations, security teams must continuously adapt and ensure they have the necessary resources to protect against emerging threats.

The discrepancy between budget freezes or cuts in some organizations and the rising importance of cybersecurity raises questions about the prioritization of resources. While economic uncertainty and cost considerations may influence budget decisions, organizations must strike a balance between short-term financial concerns and long-term security risks. Failing to allocate adequate resources to cybersecurity can expose organizations to significant financial, reputational, and operational disruptions.

Editorial: Addressing the Cybersecurity Budget Challenge

The findings of the 2023 Security Budget Benchmark Report highlight the need for organizations to reevaluate their approach to cybersecurity budgeting. It is crucial for companies to align their budget strategies with the increasing scope and complexity of cyber threats. This requires a comprehensive and proactive approach that considers the following key steps:

1. Assessment of Security Needs

Organizations should conduct a thorough assessment of their security needs, taking into account industry-specific risks and regulatory requirements. This assessment will help identify any gaps in current security measures and provide a clear understanding of the resources required to mitigate risks effectively.

2. Collaboration between Security and Finance Teams

Close collaboration between security and finance teams is essential to ensure that cybersecurity is given appropriate consideration in budget planning. By working together, these teams can provide accurate cost estimations and advocate for the necessary resources to address security challenges.

3. Continuous Education and Training

Investing in continuous education and training for security personnel is crucial to keep pace with rapidly evolving threats. By equipping their teams with the latest knowledge and skills, organizations can enhance their ability to detect, prevent, and respond to cyber incidents effectively.

4. Leveraging Technology and Automation

Organizations should explore technology and automation solutions to optimize their cybersecurity operations. Embracing technologies such as artificial intelligence and machine learning can enhance efficiency, allowing security teams to focus on strategic initiatives rather than routine tasks.

5. Prioritization of Investment in Security

As the findings of the report indicate, organizations should prioritize investment in cybersecurity, especially during times of economic uncertainty. Failing to allocate sufficient resources to cybersecurity can have severe consequences, including financial losses, reputational damage, and regulatory compliance issues.

Conclusion

The 2023 Security Budget Benchmark Report illuminates a concerning trend of slower growth in security budgets. In the face of ever-evolving threats, organizations must recognize the importance of prioritizing cybersecurity and allocating the necessary resources. Close collaboration between security and finance teams, continuous education and training, and the adoption of technology solutions can help organizations navigate this challenging landscape.

Making strategic investments in cybersecurity is not only a matter of financial prudence, but also an ethical responsibility to protect sensitive data and safeguard against potential cyberattacks. By prioritizing security, organizations can mitigate risks, ensure business continuity, and maintain the trust of their stakeholders.