Survey: Changing Threat Landscape Drives Cybersecurity Spending Shifts – Source: securityboulevard.com

A survey of 840 cybersecurity leaders conducted by The Futurum Group finds that cybersecurity budgets will increase on average to 11% of the IT budget in 2025, with just under half (49%) planning either a major (10%), moderate (21%) or minor consolidation (18%) to streamline operations.

In contrast, just under a quarter (24%) are planning either a significant (3%), moderate (12%) or minor increase (16%) in the number of cybersecurity vendors relied on, while 19% intend to keep their existing number of vendors relied on the same.

Overall, the survey finds 80% of respondents work for organizations that experienced at least one significant cyber incident within the past 12 months, with cloud security incidents emerging as the most common (31%) followed by data breaches/exfiltration (28%) and ransomware attacks (26%).

The biggest impact of those breaches involved data loss or similar compromise (40%), followed closely by system or operational downtime (37%).

Unfortunately, the survey also makes it clear that cybersecurity remains as complex to manage as ever. For example, cloud security challenges are dominated by integration issues (37%), cost management (35%), and misconfigurations (35%), implementing consistent security controls across hybrid/multi-cloud environments (33%) and cloud data protection at scale (32%) are becoming any easier to overcome.

Meanwhile, the primary challenges in endpoint security revolve around balancing security and productivity (37%) and ensuring effective integration with network and cloud security (34%), followed by securing remote/unmanaged devices (32%), improving user experience (32%). managing diverse endpoint types (29%), responding quickly to advanced threats (29%) and managing legacy systems (27%).

Organizations are also prioritizing network security automation (55%) and network detection and response (51%), followed by network segmentation and microsegmentation (49%), zero trust network access (43%) and cloud network security controls (28%).

Finally, the survey finds that while application security has become a higher priority, in many cases more responsibility for it is being shifted toward application development teams.

Fernando Montenegro, vice president and practice lead for cybersecurity at The Futurum Group, said the survey makes it clear that priorities are evolving rapidly as the overall size of the attack surface that needs to be defended continues to rise. There is, as a result, a renewed focus on cyber resilience that requires a combination of technology coverage, business alignment, and a focus on continuous improvement.

Specifically, organizations are focused on enhancing threat detection capabilities (33%), adoption of quantitative risk assessment methodologies (32%), addressing evolving security needs (28%), improving threat response capabilities (27%), automation and containment of security sprawl (27%), enhancing third-party and supply chain risk monitoring (24%) and improving usability and ease of use (23%).

It’s not clear where all the funding for these initiatives might come from, but a previous report from The Futurum Group projects compound annual growth rate (CAGR) of 11.6% from 2024 to 2029 to reach $287.6 billion. The degree to which that increase represents a level of spending that is commensurate to the threats faced or simply profligate spending remains, of course, a subject of heated debate.

One way or another, however, a different approach to cybersecurity will be required as adversaries increasingly make use of artificial intelligence (AI) to launch increasingly more sophisticated attacks at what will soon likely reach unprecedented volumes. As that evolution continues to occur, the calculus for assessing the return on investment in cybersecurity is also likely to change as well.