November 20, 2014 By Jaikumar Vijayan 3 min read

A majority of information technology (IT) managers remain surprisingly confident in their company’s ability to deal with emerging enterprise threats, according to two recent surveys.

In one survey, fielded by Enterprise Management Associates on behalf of software vendor SolarWinds, 84 percent of 312 IT managers surveyed said they considered their organizations to be “very secure” against cyberthreats. This despite the fact that almost the same number said their companies had experienced a significant enterprise security incident within the past year.

Fifteen percent described their controls as “extraordinarily secure” and felt confident placing their companies among the top 10th percentile of organizations with the best enterprise security controls. Thirty-seven percent felt their controls were superior enough to put them in the 20th to 11th percentile.

Extreme Confidence

A similar survey of 250 IT security professionals by ThreatTrack Security revealed the same optimism among technology managers for 2015. Though close to 7 in 10 of those who responded to the survey expected their companies to be targeted by cyberattackers in the next year, a full 94 percent were confident that their ability to deflect such attacks would improve, as well.

In companies with a chief information security officer, the optimism was even greater, with 96 percent expressing confidence about their ability to prevent a data breach at their companies.

“Enterprise security staffers are so confident that 81 percent of survey respondents said they would ‘personally guarantee that their company’s customer data will be safe in 2015,'” ThreatTrack said in a prepared statement announcing the results of its survey.

Misplaced Optimism?

To some, the rosy outlook held by IT managers might appear incongruous in light of all the data breaches that have occurred over the past 12 months, including those at Target, Home Depot, JPMorgan Chase, Community Health Systems, Dairy Queen and UPS Stores.

The breaches have been truly remarkable both in scope and in the level of sophistication used by attackers to steal data. Hundreds of millions of personal and financial records have been compromised in these breaches, and companies are being forced to spend huge amounts of money to address the issues that led to such compromises.

That so many IT managers remain so confident in the face of all that has been going on in recent months suggests a troubling sense of complacency, said Mav Turner, director of SolarWinds security, in a recent interview.

One of the reasons could be that companies are spending more on information security these days; therefore, they assume they are better prepared to deal with threats, Turner said.

Increasing Security Investments

For example, 74 percent of those who participated in the SolarWinds survey said their security budgets had increased over the past year — in some cases by as much as 25 percent. Information security budgets, as a percentage of overall IT budgets, have also steadily ticked upward recently. Close to 9 out of 10 IT managers surveyed felt they had the security resources required to adequately defend their companies against cyberthreats.

Such trends are encouraging, but it’s a mistake for companies to assume they are secure simply because they are spending more on security.

“The overall message we have gotten out of this survey is that companies are putting budget behind security, and they think that is good enough,” Turner said.

What appears to be lacking are best practices and measures for tracking and managing the effectiveness of the security controls that are being implemented, he said. For instance, nearly 40 percent of IT managers in the SolarWinds survey said their organizations either had no defined security best practices or did not follow them. Turner believes this apparent lack of attention to such issues could undermine some of the benefits of new security investments and leave companies more exposed to threats than many security professionals might imagine.

More from

How prepared are you for your first Gen AI disruption?

5 min read - Generative artificial intelligence (Gen AI) and its use by businesses to enhance operations and profits are the focus of innovation in virtually every sector and industry. Gartner predicts that global spending on AI software will surge from $124 billion in 2022 to $297 billion by 2027. Businesses are upskilling their teams and hiring costly experts to implement new use cases, new ways to leverage data and new ways to use open-source tooling and resources. What they have failed to look…

Cybersecurity crisis communication: What to do

4 min read - Cybersecurity experts tell organizations that the question is not if they will become the target of a cyberattack but when. Often, the focus of response preparedness is on the technical aspects — how to stop the breach from continuing, recovering data and getting the business back online. While these tasks are critical, many organizations overlook a key part of response preparedness: crisis communication.Because a brand’s reputation often takes a significant hit, a cyberattack can significantly affect the company’s future success…

Brands are changing cybersecurity strategies due to AI threats

3 min read -  Over the past 18 months, AI has changed how we do many things in our work and professional lives — from helping us write emails to affecting how we approach cybersecurity. A recent Voice of SecOps 2024 study found that AI was a huge reason for many shifts in cybersecurity over the past 12 months. Interestingly, AI was both the cause of new issues as well as quickly becoming a common solution for those very same challenges.The study was conducted…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today