This year’s cyber budgets for large organisations are falling short of expectations, according to a study by the intelligence and cyber security consultancy S-RM.
In 2023, the average cyber budgets grew to USD 27.10m, up 3.1 per cent from USD 26.30 million in 2022. S-RM’s research shows that senior IT professionals and their c-suites had anticipated a more substantial increase of 5pc, which would have seen budgets reach USD 27.6m.
The appetite for more budget comes after a year of rising operational costs – as a result of wider economic turbulence – and a growing cyber threat following rapid advancements in generative AI. Cyber security departments want more budget to upskill employees (42pc) and recruit additional skilled personnel (41pc) to accommodate this rising threat.
On average, cyber budgets make up a quarter (25pc) of an organisation’s overall IT budget, marking a 1pc decrease in share from 2022. This allocation varies across sectors, with Retail being the most generous (28pc) and Energy and Utilities allocating the least (18pc) towards tackling cyber threats.
Lack of budget was cited as a key challenge by three in ten (31pc) of organisations. To navigate this, cyber security teams have been prioritising spend in the most ‘value for money’ areas. For the third consecutive year, investment in cyber technology topped the list, though fewer organisations highlighted technology as good value for money in 2023 (49pc) than in 2022 (58pc).
This dip can be attributed to a growing awareness that alongside cyber technology, organisations need to invest in governance and personnel to enable and manage new tech. This is a view more seen among IT professionals charged with implementing cyber tech solutions, with only 43pc citing technology as ‘high value for money’ compared to 56pc of C-suite executives. The findings reflect a misalignment of expectations between the operators of cyber technologies, and those a step removed from their day-to-day applications. Organisations are adopting several other strategies to manage cyber security with restricted budgets:
- IT and security optimisation – Identifying cost reduction opportunities by making existing processes more efficient to allocate budget for more critical initiatives.
- Future-focused investment – Investing now in security initiatives for long-term cost savings.
- Outsourcing – Contracting out IT and security functions to Managed Service Security Providers (MSSPs) or virtual Chief Information Security Officers (vCISOs).
Jamie Smith, Board Director, and Head of Cyber Security at S-RM, said: “It’s reassuring that cyber security budgets are still rising in these challenging times, but this level of increase is simply not enough to tackle the growing cyber threat. This year’s increase has failed to meet the expectations of cyber teams and reveals that cyber security may be taking a back seat as its share of the overall IT budget declines.
“Navigating ongoing skill shortages and investing in training and development of teams comes at a cost, but cyber professionals are not receiving the budget they need to deliver on these critical initiatives. Organisations will have to continue being cautious with cyber security spend, identifying those ‘value for money’ areas that will enable them to manage emerging cyber threats with tightened purse strings.”
For more, access the full 2023 Cyber Security Insights Report on S-RM’s website: https://www.s-rminform.com/cyber-security-insights-report-2023
