With information security functions not fully meeting the needs in 83 percent of organizations, 93 percent of companies globally are maintaining or increasing their investment in cyber-security to combat the ever increasing threat from cyber-attacks, according to a new survey released by EY.

The study found:

  • The information security function fully meets needs in only 17 percent of organizations;
  • Ninety-three per cent of companies maintained or increased their security budget over the last 12 months – yet budget constraints were still the biggest obstacle to delivering value;
  • Organizations must be forward-looking and prepare for emerging technologies; and
  • Talent shortage is hindering the fight against cyber-attacks – especially in Europe.

EY's 16th annual Global Information Security Survey 2013 tracked the level of awareness and action by companies in response to cyber threats and canvased the opinion of over 1,900 senior executives globally. This year's results showed that as companies continue to invest heavily to protect themselves against cyber-attacks, the number of security breaches is on the rise and it is no longer a question of if, but when, a company will be the target of an attack.

Thirty-one percent of respondents reported the number of security incidents within their organization has increased by at least five percent over the last 12 months. Many have realized the extent and depth of the threat posed to them, resulting in information security now being “owned” at the highest level within 70 percent of the organizations surveyed.

Paul van Kessel, EY global risk leader, commented, “This year's survey shows that organizations are moving in the right direction, but more still needs to be done – urgently. There are promising signs that the issue is now gaining traction at the highest levels. In 2012, none of the information security professionals surveyed reported to senior executives – in 2013 this jumped to 35 percent.”

Ken Allan, EY global information security leader, added, “Cyber-crime is the greatest threat for organizations' survival today. While budget allocations toward security innovation are inching their way up, enabling organizations to channel more resources toward innovating solutions that can protect them against the great unknown – the future – many information security professionals continue to feel that their budgets are insufficient to address mounting cyber risks.”

Despite half of the respondents planning to increase their budget by five percent or more in the next 12 months, 65 percent cited an insufficient budget as their number one challenge to operating at the levels the business expects; among organizations with revenues of US$10 million or less, this figure rose to 71 percent.

Of the budgets planned for the next 12 months, 14 percent is ear-marked for security innovation and emerging technologies.

Mr. Allan stated, “Organizations need to be more forward-looking. Moreover, if organizations are putting all their energy into addressing current technology issues, how will they protect themselves against technologies that are just around the corner or are about to appear on the horizon? If organizations still don't have a high level of confidence after four years of mobile device use in the workplace, how will they face the challenge of managing and defending against personal and hosted clouds for example?”

Although information security is focusing on the right priorities, in many instances, the function does not have the skilled resources or executive awareness and support needed to address them, EY said.

In particular, the gap is widening between supply and demand, creating a sellers' market, with 50 percent of respondents citing a lack of skilled resources as a barrier to value creation. Similarly, where only 20 percent of previous survey participants indicated a lack of executive awareness or support, 31 percent now cited it as an issue.

Mr. Allan commented, “A lack of skilled talent is a global issue. It is particularly acute in Europe, where governments and companies are fiercely competing to recruit the brightest talent to their teams from a very small pool. As a result, while organizations feel they are addressing the right priorities, many indicate that they do not have the skilled resources to support their needs.”

Looking ahead, Mr. Kessel concluded, “Organizations must undertake more proactive thinking, with tone-from-the-top support. Greater emphasis on improving employee awareness, increasing budgets and devoting more resources to innovating security solutions is needed. The pace of technology evolution will only accelerate – as will the cyber risks and by not considering risks until they arise gives cyber attackers the advantage, jeopardizing an organization's survival.”