Inside the IT Security Budget Paradox

Security spending

Inside the IT Security Budget Paradox

Despite a major increase in high-profile IT security breaches, the amount of time and money most organizations are allocating to security remains stagnant.

Where Control of the IT Security Budget Lies

Respondents reported the CIO/CTO have control most often, at 37%, followed by business unit leaders, at 22%. Only 19% cited the IT security leader.

Who Decides How Much to Invest in IT Security?

CIOs/CTOs again top the list (33%), followed by business unit leaders (31%) and the CFO at 13%. Only 10% cited the IT security leader.

IT Security as a Priority

Only 24% of respondents strongly agreed that their organization views security as one of the top two strategic priorities.

IT Security Budget Plans

Nearly half (46%) said the IT security budgets increased in the past two years. In the next two years, 50% said it will increase. However, the same percentage of respondents (50 %) said their budgets are either flat (46%) or would actually decrease (4%).

Percentage of IT Budget Allocated to Security

On average, 8.2% of the IT budget, or $9.14 million, is allocated to security annually, and 9.2% of the IT security budget is allocated for activities related to new technologies (approximately $840,000).

How IT Security Budget Is Determined

Senior management determines the budget 39%, versus 32% who rely on an actual assessment. Most of the budget is used for staffing, according to 32% of respondents, followed by technologies and their maintenance (25%). Only 19% is allocated to managed or outsourced services.

IT Security Budgeting Process

Only 43% of respondents said their organizations’ IT security budgets are adequate. More than half (53%) said the process is too complex.

IT Security Budgets in Terms of Compliance Mandates

More than half (58%) said they do not have sufficient resources to achieve compliance with security standards and laws.

An Absence of CXO Security Involvement

Nearly a third of respondents do not agree (34%) or are unsure (17%) that C-level executives are briefed on security priorities and investments in technology and personnel. Only 21% of respondents said the IT security budget is on the board’s agenda.

The Great IT Security Disconnect

Corporate leaders are more likely to view third-party mistakes or flubs, including those cloud providers made, as a serious threat (49%). The staff considers insecure Web applications (57%) and negligent insiders (56%) more serious threats.

IT Security Goals

The staff sees the minimization of downtime as the primary security objective (83%), while corporate leaders (72%) cite overall organizations’ security posture. Only 8% of both groups believe providing cyber-security training for all employees should be a top security objective.

Most Vulnerable Elements of IT

Nearly two-thirds (62%) said data in applications is most vulnerable, followed by third parties, such as cloud providers (57%) and mobile devices (44%).

Satisfaction With IT Security Investments

On average, 37% of all investments in enabling security technologies did not meet expectations. What’s more, 44% said they lack in-house expertise, followed by 32% citing vendor support issues. Another 32% pointed to higher-than-expected installation costs.

IT Security Technologies Deployed

Most often deployed are anti-virus software (68%), followed by security incident and event management systems (SIEM) (63%) and identity and access management systems (57%).

Top Planned Beneficial IT Security Investments

Technologies that are both earmarked for purchase and economically beneficial are SIEM (53% and 63%) and encryption (52% and 45%).

Questionable IT Security Investments

84% said they are investing in intrusion-detection or intrusion-prevention systems. However, only 41% said it is a top-performing technology in terms of the economic benefits. Similarly, 72% said they are purchasing identity and access management systems, but only 57% said it is economically beneficial.

Maturity of IT Security Strategy

Only 18% of respondents said their companies’ IT security program activities are fully deployed. A full 22% admitted to still being in an early stage.