Most mid-market companies view their current spending on security as a sound business investment, but a large minority sees it as an expense that must be minimized, according to The Conference Board's latest report on corporate security practices, sponsored by the Department of Homeland Security.
The cross-country survey shows that 61 percent endorse the business case argument that security provides value for their firms and a positive return on investment, but 39 percent say that security is simply a cost that must be tightly controlled. Strongest support for security spending is in the so-called "critical industries" "transportation, energy and utilities, financial services, media and telecommunications, information technology, and healthcare. Increases in security spending are lowest among the smallest companies.
Most surveyed companies, however, report little increase in security spending since 9/11. In fact, fully 45 percent say they have not increased their spending since the terrorist attacks in 2001 and 1 percent say they have actually cut back on security spending.
Could Smaller U.S. Firms Survive a Major Attack?
"The most alarming finding is that only 28 percent of mid-market companies have an off-site center for emergency operations. This suggests that many smaller American firms would have difficulty conducting their business in the event of a prolonged power outage or closure of their primary facility," says Tom Cavanagh, The Conference Board's corporate security expert and author of the report.
To realize the benefits of cloud-native software, an application must actually be cloud-native—designed to run in the cloud, interacting with disaggregated cloud services, fully manageable as code—to deliver the expected benefits.
By combining resources and expertise, the AI-Enabled ICT Workforce Consortium will offer a blueprint for how industries can adapt to an AI-dominated future.
IT leaders should heed the guidance of cybersecurity insurance providers who think businesses should prioritize security education, incident preparedness, regular internal audits, and ongoing vulnerability scanning and patching.
