Despite 95% of CIOs anticipating an increase in IT security threats over the next three years, 35% of organisations do not employ a cybersecurity specialist, a Gartner survey has revealed.
Gartner’s 2018 CIO Agenda Survey also discovered that organisations undergoing digital transformation are struggling to find people with the IT skills they need. Digital security staffing shortages are considered to be the top inhibitor to innovation.
Many cybercriminals not only operate in ways that companies struggle to anticipate, but also seem to adapt quickly to changing environments, according to Rob McMillan, research director at Gartner.
He said: “In a twisted way, many cybercriminals are digital pioneers, finding ways to leverage big data and web-scale techniques to stage attacks and steal data.
“CIOs can’t protect their organisations from everything, so they need to create a sustainable set of controls that balances their need to protect their business with their need to run it.”
Out of the 3,160 CIOs surveyed, 36% said that they are planning to hire a security specialist in the near future. Gartner estimates that 60% of security budgets will be in support of detection and response capabilities by 2020.
McMillan said: “Taking a risk-based approach is imperative to set a target level of cybersecurity readiness.
“Raising budgets alone doesn’t create an improved risk posture. Security investments must be prioritised by business outcomes to ensure the right amount is spent on the right things.”
According to Gartner’s survey, many CIOs believe growth and market share are the top-ranked business priorities for 2018. Growth often means more diverse supplier networks – different ways of working, funding models and patterns of technology investing – as well as different products, services and channels to support.
McMillan added: “The bad news is that cybersecurity threats will affect more enterprises in more diverse ways that are difficult to anticipate.
“While the expectation of a more dangerous environment is hardly news to the informed CIO, these growth factors will introduce new attack vectors and new risks that they’re not accustomed to addressing.
“Finding talented, driven people to handle the organisation’s cybersecurity responsibilities is an endless function.”