This article is part of our Essential Guide: An IT security strategy guide for CIOs

Cyber security budgets not rising in line with threats, say security pros

While it is good news that businesses are increasing investment, it is clear that spending on security is still not at a level that matches the changing threat landscape, says IISP

While cyber security budgets are growing, this increase is not in line with rising threats, according to a majority of security professionals.

Two-thirds of members polled by the Institute of Information Security Professionals (IISP) said security budgets have increased, while only 15% said budgets have stayed the same.

However, 60% of budgets are still not keeping pace with the rise in the level of threats, and only 7% of respondents reported that security budgets were rising faster than the level of threat.

With more than 2,500 members working in security across a wide range of industries and roles, the results of the IISP survey provide an accurate snapshot of the state of UK cyber security.

“In times of financial pressure or instability, as we have seen in recent years, security is often seen as a supporting function or an overhead,” said IISP director Piers Wilson.

“Security budgets are hard won because they are about protection against future issues, so are a good indication of the state of risk awareness in the wider business community,” he said.

Wilson said that while it is good news that businesses are increasing investment, it is clear that spending on security is still not at a level that matches the changing threat landscape.

It is good news that businesses are increasing investment, but it is clear that spending on security is still not at a level that matches the changing threat landscape

The survey also found that while there is still a cyber security skills shortage, the problem is not about a lack of people working in the discipline.

Respondents pointed to a shortfall in the level of skills and experience, making staff training, development and retention crucial to the future of the industry.

On a positive note, only 10% of respondents felt that the security industry’s ability to protect data is declining rather than improving, and 49% said incident response capabilities are improving.

Overall, the results of the IISP survey showed there are growing challenges from more types of attack, more sources of threats, greater reliance on increasingly complex IT systems, shortage of effective security staff and a regulatory environment that is both fluid and challenging.

However, the heightened awareness of security risks and the impacts of a breach are driving an increase in investment, skills, experience, education and professionalism, the survey found.

“While there is clearly much more to be done, the results of the survey are encouraging,” said Wilson. 

The IISP is a not-for-profit organisation dedicated to raising the standard of professionalism in information security and the industry as a whole. It does this through accrediting skills and competence, by sharing best practice and providing a network of support and guidance on individual skill development.

The IISP Skills Framework for measuring competency of information security professionals underpins certification schemes used by CESG, the UK government’s national technical authority for information assurance (IA).

These schemes include the Certified Professional Scheme (CCP), for which the IISP is the leading certifying body.

The skills framework is also used by private enterprises to benchmark and develop capability of their employees.

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.






  • How do I size a UPS unit?

    Your data center UPS sizing needs are dependent on a variety of factors. Develop configurations and determine the estimated UPS ...

  • How to enhance FTP server security

    If you still use FTP servers in your organization, use IP address whitelists, login restrictions and data encryption -- and just ...

  • 3 ways to approach cloud bursting

    With different cloud bursting techniques and tools from Amazon, Zerto, VMware and Oracle, admins can bolster cloud connections ...