Why is security spend declining while awareness and incidents increase?

According to a recent report by PwC surveying more than 9,000 IT execs and company directors, there has been a significant reduction in security spending annually in 2014. What makes the results of this survey so shocking is the fact there has been an increase in reported security incidents of 48% to nearly 43 million, which equates to nearly 120,000 daily.

It’s worth noting that the figures will be lower than the number of incidents occurring in reality, as it is believed that a huge number of breaches and cyber attacks go unreported.

The regular attacks are now becoming more costly to deal with too. PwC’s report highlighted how cybersecurity attacks now cost a business, on average, £1.7m – over 33% more than in 2013.

There was also an increase in the number of businesses reporting costs, as a result of attacks, of over £12 million, a rise of 92%.

Falling figures

Despite the higher risk of attack and the increased costs, security spend seems to be reducing. PwC claimed that, internationally, spend has reduced by 4%, and the percentage of IT spend allocated to security has remained static for the previous five years.

With the obvious risk to businesses, why is security spend in decline?

Many existing corporate structures have CISOs, or chief information security officers, reporting to the CIO/IT director. This could lead to a lack of understanding about security risks, and is maybe one reason security spend is reducing. Experts believe that the attacks are a risk issue in their own right and not an issue for IT. Similarly, these experts believe the security of information should be seen as an independent area of management with its own budgetary responsibility. With security clearly being an issue for discussion at the board level, it seems not all executives have had the message. With the CISO reporting to an intermediary executive, it is easy for the board to lose sight of the importance of security.

Whilst security spending has reduced, awareness amongst employees has seen some investment, as the amount of training for employees about cyber security has increased. This may be another reason investment has reduced, as companies are led to believe the improvement in staff awareness will help stave off attacks.

A 2012 spending drive

Many businesses invested heavily in security two years ago. During 2012, there was an increase in security spend of 40%, which may mean businesses are reticent about further increases in security budgets as the economy is still slow in recovery.

Larger companies are in a better position to cope with issues, with some larger businesses identifying over 43% more attacks than last year. Many smaller firms are identifying 5% fewer attacks than the previous year.

Smaller companies might be complacent in their approach, considering themselves too small or unimportant to attract cyber attackers – a dangerous assumption that is likely to be contributing to the reduced security spend year-on-year that has been seen.

With attacks increasing and the sophistication of attackers ever growing, it seems there has never been a worse time to reduce security spend or become complacent. Indeed, companies face threats from external sources and, increasingly, from insiders. The security of information clearly needs to be higher on the corporate agenda.