Key Takeaways

Overall, organizations do not think they can afford the security they need, no matter what size they are or how much they’re currently spending.

Organizations in the middle with 1,000 to 9,999 employees are struggling the most to adequately secure their environments.

There is no single answer when it comes to which security products an organization should be using, or how much should be spent on security. It depends largely on the size and type of organization, the criticality of its assets, and what it can actually afford. This makes it more difficult for enterprises to figure out what their security programs should include.

Increased spending does not always translate into greater security capability/ confidence. Other factors must be considered, such as expertise and influence.

Organizations should be sure that their internal staff continues to build expertise in both security overall and in their specific environment and risk profile. There are some aspects of security that only insiders are equipped to handle.

Capability plays an important role in the security bottom line. Factors such as whether or not a security team has control over certain resources can greatly impact its ability to execute on a defense strategy – even with the required budget and expertise on hand.

The bigger the organization, the easier it is to influence third parties that affect its security posture. Smaller organizations may need to leverage the power of associations to get the same influence and economies of scale.

“The more products you have, the more work you’re trying to do to connect all of that information together. When you think about security, you have to take a holistic approach, not just a pillar-by-pillar strategy… With automation built in, you can start to take action without having to grow your team significantly.”

Marisa Chancellor, Senior Director, Information Security, Cisco