A majority of information technology (IT) managers remain surprisingly confident in their company’s ability to deal with emerging enterprise threats, according to two recent surveys.

In one survey, fielded by Enterprise Management Associates on behalf of software vendor SolarWinds, 84 percent of 312 IT managers surveyed said they considered their organizations to be “very secure” against cyberthreats. This despite the fact that almost the same number said their companies had experienced a significant enterprise security incident within the past year.

Fifteen percent described their controls as “extraordinarily secure” and felt confident placing their companies among the top 10th percentile of organizations with the best enterprise security controls. Thirty-seven percent felt their controls were superior enough to put them in the 20th to 11th percentile.

Extreme Confidence

A similar survey of 250 IT security professionals by ThreatTrack Security revealed the same optimism among technology managers for 2015. Though close to 7 in 10 of those who responded to the survey expected their companies to be targeted by cyberattackers in the next year, a full 94 percent were confident that their ability to deflect such attacks would improve, as well.

In companies with a chief information security officer, the optimism was even greater, with 96 percent expressing confidence about their ability to prevent a data breach at their companies.

“Enterprise security staffers are so confident that 81 percent of survey respondents said they would ‘personally guarantee that their company’s customer data will be safe in 2015,'” ThreatTrack said in a prepared statement announcing the results of its survey.

Misplaced Optimism?

To some, the rosy outlook held by IT managers might appear incongruous in light of all the data breaches that have occurred over the past 12 months, including those at Target, Home Depot, JPMorgan Chase, Community Health Systems, Dairy Queen and UPS Stores.

The breaches have been truly remarkable both in scope and in the level of sophistication used by attackers to steal data. Hundreds of millions of personal and financial records have been compromised in these breaches, and companies are being forced to spend huge amounts of money to address the issues that led to such compromises.

That so many IT managers remain so confident in the face of all that has been going on in recent months suggests a troubling sense of complacency, said Mav Turner, director of SolarWinds security, in a recent interview.

One of the reasons could be that companies are spending more on information security these days; therefore, they assume they are better prepared to deal with threats, Turner said.

Increasing Security Investments

For example, 74 percent of those who participated in the SolarWinds survey said their security budgets had increased over the past year — in some cases by as much as 25 percent. Information security budgets, as a percentage of overall IT budgets, have also steadily ticked upward recently. Close to 9 out of 10 IT managers surveyed felt they had the security resources required to adequately defend their companies against cyberthreats.

Such trends are encouraging, but it’s a mistake for companies to assume they are secure simply because they are spending more on security.

“The overall message we have gotten out of this survey is that companies are putting budget behind security, and they think that is good enough,” Turner said.

What appears to be lacking are best practices and measures for tracking and managing the effectiveness of the security controls that are being implemented, he said. For instance, nearly 40 percent of IT managers in the SolarWinds survey said their organizations either had no defined security best practices or did not follow them. Turner believes this apparent lack of attention to such issues could undermine some of the benefits of new security investments and leave companies more exposed to threats than many security professionals might imagine.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…