While cybersecurity budgets are growing, the increase is not in line with rising threats.

Two-thirds of members polled by the Institute of Information Security Professionals (IISP) said security budgets have increased, while only 15% said budgets have stayed the same.

However, 60% of budgets are still not keeping pace with the rise in the level of threats, and only 7% of respondents reported that security budgets were rising faster than the level of threat.

“In times of financial pressure or instability, as we have seen in recent years, security is often seen as a supporting function or an overhead,” said IISP director Piers Wilson. "Security budgets are hard won because they are about protection against future issues, so are a good indication of the state of risk awareness in the wider business community.” 

The report is based on answers of more than 2,500 members of the Institute, working in security across various industries, including a significant proportion at Senior/Lead/CISO level.

“In times of financial pressure or instability as we have seen in recent years, security is often seen as a supporting function or an overhead,” said Piers Wilson, Director at IISP. “Security budgets are hard won because they are about protection against future issues, so are a good indication of the state of risk awareness in the wider business community. While it is good news that businesses are increasing investment, it is clear that spending on security is still not at a level that matches the changing threat landscape.”

The survey also found that while there is still a cybersecurity skills shortage, the problem is due to a shortfall in the level of skills and experience, making staff training, development and retention crucial to the future of the industry.

Only 10% of respondents felt that the security industry’s ability to protect data is declining rather than improving, and 49% said incident response capabilities are improving.

Overall, the results of the  survey showed there are growing challenges from more types of attack, more sources of threats, greater reliance on increasingly complex IT systems, shortage of effective security staff and a regulatory environment that is both fluid and challenging.

“While there is clearly much more to be done, the results of the survey are encouraging,” said Wilson. 

The survey is at http://iisp.informz.net/IISP/data/images/WhitePaperWebsite.pdf