A new survey of cyber leaders reveals that nearly half (44%) of cybersecurity professionals are struggling with regulatory compliance due to its painstaking complexity.

Infosecurity Europe’s survey of 200 IT security decision makers revealed their outlooks across 12 differed cyber regulations currently or soon to be enforced. The UK’s Data Protection Act, which is soon to be replaced by the Data Protection and Digital Information Bill, was considered to be ‘somewhat complex’ by leaders, as was the EU’s Cybersecurity Act.

Only the EU Cybersecurity Act and the US Sarbanes-Oxley Act (SOX) had 50% of cyber leaders saying they were compliant, showing that organisations had a long way to go to reach regulatory compliance.

Besides regulatory compliance, the study revealed several trends around AI, cyber budgets, and the evolving threat landscape, as well as the approach from board members.

AI: A Double-Edged Sword

Generative AI is continually seen on both sides of the cyber landscape: while it can be a brilliant tool in fighting fraud, detecting phishing scams, and fighting against threats, it can also be harnessed by cyber-criminals to improve the effectiveness of their schemes. This has lead to an all out arms race in cybersecurity, seeing which side can master AI first.

It is no surprise then, that 54% of respondents say they plan to implement AI into their cyber strategy in the next 12 months.

AI was met with optimism from respondents, with 42% saying that the tech will result in faster training, broader awareness, and better education. 44% think AI will give their workforce greater bandwidth to focus on future planning as a result of increasing automation.

Still, leaders are cautious, with half (50%) saying that legislative challenges and moral dilemmas may slow their adoption of AI.

Around half (48%) say that the use of AI will evolve dramatically over the next year.

Evolving Threat Landscape

Increased connectivity, more and more IoT devices, continuous cloud adoption, and the rise of AI have all contributed to a massive expansion of the threat landscape.

40% of leaders surveyed cited ransomware and AI generated attacks as causes to accelerated investment into cyber defences. 33% were also worried about social engineering, human error, and threats to the supply chain.

The report serves as a timely reminder that while new threats emerge, some established threats remain prominent,” Keith Martin, professor of information security at Royal Holloway.

“Ransomware remains the almost perfect crime, while social engineering remains a significant vector by which seemingly impenetrable security infrastructures can still be breached.

Budgets are Growing

As these fears stoke the fire, budgets appear to increase, as 69% of respondents say that they have seen or will see their cybersecurity budgets rise in 2024.

Some have even reported a surge in spending, with 15% saying that their budgets will or have grown by 50% or more. Most, however, show a smaller increase.

Recommended reading

• UK Gov Data Breaches Exposed 10K Customers’ Data, FOI Reveals
• Who Was Behind the Ministry of Defence Hack?
• UK Gov Cyber Breaches Survey 2024 | Key Stats and Data

For those increasing their budget, cloud security and incident response tend to see the biggest spending injection, with 47% noting that between one and 20% of additional funding will go to these areas.

46% said that up to a fifth of the budget will go to managed service provider outsourcing and antivirus, while 45% cited an increase in identity management.

This is followed by education and training, managed detection and patching with 43%, and AI and product consolidation at 41%. Two in five (40%) said that up to a fifth of their budget would go to email security and threat exposure.

Cybersecurity Culture

While threats and budgets are up, there appears to be a split on the best approach.

17% of leaders want to go all-in on AI and machine learning to automate everything, while 16% want to remove all current solutions and start from scratch.

Another 15% say that training and education would be the best method to mitigate the onslaught of cybersecurity incidents.

Whereas 13% look to outsourcing their operations to trusted cyber professionals as the best take.

This mixed bag of opinions can make it difficult to have cohesion even within a single organisation, with 27% saying there is a lack of communication between departments, unclear accountability, and issues with leadership.

Further, 36% say they struggle to have constructive conversations about cybersecurity at a board level. Around a third (30%) of cyber leaders say that it would take falling victim to a serious cyber incident for a board member to make the effort to become a cyber expert.