As the digital landscape continues to evolve at an unprecedented speed, organisations are racing to keep pace with revamped cybersecurity strategies.
LogRhythm has released its “2024 State of the Security Team: Navigating Constant Change” report, based on research conducted by Dimensional Research, which finds that 95% percent of companies reported they’ve altered their cybersecurity strategies within the last 12 months.
The research examined several facets of cybersecurity, drawing on insights from a global survey of 1 176 security executives and professionals across five continents. It explored the resources available to security teams, budget allocation, confidence in handling breaches, accountability for breaches, reporting capabilities, and the effectiveness of security communication within businesses.
At the heart of these strategic shifts is the pivotal role of leadership within organisations. The perception of cybersecurity has changed from a purely technical issue to a central pillar of business strategy and corporate governance, with 78% stating that the cybersecurity leader or CEO – or both – are responsible for protecting against and responding to cyber incidents.
“The evolving role of cybersecurity leadership reflects a fundamental shift in how organisations view and manage cyber risk,” says Andrew Hollister, chief information security officer at LogRhythm. “Today’s threat environment demands a collaborative approach, with senior executives working hand-in-hand with security professionals to understand the risks, make well-informed, strategic decisions, and allocate the necessary resources to safeguard the organization and its clients.”
The report finds that the top factors driving changes to security strategy include:
* Keeping pace with the shifting regulatory landscape (98%);
* The need to meet customer expectations for data protection and privacy (89%); and
* The rise of AI-driven threats and solutions (65%).
However, amid the shifting tides, effective communication between security teams and non-security executives remains a significant gap. Almost half (44%) of non-security executives don’t understand the regulatory requirements that the company must adhere to.
In addition, 59% report difficulties explaining the necessity of specific security solutions to non-security stakeholders, indicating a pressing need for enhanced reporting mechanisms to navigate the complexities of decision-making in the modern security landscape.
As security evolves, 76% of respondents say they have experienced increases to their budget to better manage emerging threats and nearly eight in 10 say they now have the right resources to defend their company from cyberattacks. In addition, 79% percent of security professionals now rate their security defense as either good or excellent.
It remains to be seen whether this is overconfidence, especially since security teams aren’t reporting on key operational metrics that define whether their security investments and strategy changes have a measurable impact. The research found that fewer than half of security teams are reporting on time to respond (49%), time to detect (48%), and time to recover (45%).
Meanwhile, the majority (61%) of security teams are still using manual and time-intensive approaches to share security status information.