2019 Security Budgets - Forecast is Cloudy
January 14, 2019

Mark Moore
Threat Stack

Budget season is an important time of the year for businesses because it gives senior IT and security leaders time to reflect on what went right this year and what initiatives need to be given priority in the new year. Recent research from Threat Stack shows security budgets are expected to increase by 19 percent to an average of $773,412 over the next two years, but business leaders are still facing challenges determining where to allocate this budget in the face of rapidly evolving infrastructure.

With less than half of their infrastructure remaining on-premise (41 percent), businesses are increasingly making migrations to infrastructure-as-a-service (IaaS) (25 percent), platform-as-a-service (PaaS) (17 percent), and containers (10 percent). This is one of the primary reasons why respondents indicated that their top two budget investments in 2019 will be directed at cloud workload security and intrusion detection systems (IDS).

Here are some additional important insights from the report around security budgeting:

Short-Term IT and Security Approaches Impede Long-Term Scalability

A common complaint cited by enterprises large and small is significant friction between their security and DevOps teams. This isn't just a source of frustration — the end result of this misalignment is an IT and security strategy that senior-level decision-makers feel is not scalable. Indeed, many enterprises — 54 percent of respondents — believe their organization is at risk of outgrowing its security solutions. Businesses aren't being strategic with their IT strategy — 52 percent of respondents indicated that their organization's current security technology is not well enough coordinated to sustain future growth.

The Cybersecurity Skills Gap is a Major Concern

Organizations reported needing more budget to hire security team talent as 66 percent agreed that they need more staff capable of managing security projects. Often a lack of experience increases security risks to organizations that are transitioning infrastructure to the cloud, leaving a greater margin of error for attackers to exploit.

Friction Between Security and DevOps Teams

Previous research indicated that while DevSecOps is a stated goal at most organizations, it is far from a reality. In fact, the two areas appear to be at significant odds internally. A common complaint within organizations is that development is working contrary to security team goals: 91 percent of respondents believe that development teams introduce risk to the organization. And a significant portion (29 percent) of respondents believe that their organization prioritizes releasing code that “works” over code that is secure.

Security teams are carrying their own organizational baggage as well. Almost three-quarters of respondents (74 percent) agreed that the security team is under pressure to keep pace with development and operations, and 63 percent believe their security team slows down the speed of their business.

The Threats for Organizations Using Containers

The majority of practitioners in the trenches using containers (58 percent) reported that cloud infrastructure security was their greatest concern, followed by phishing attacks (40 percent), while their organization as a whole was most concerned about data breaches impacting intellectual property (51 percent) and breaches impacting customer PII (42 percent). This data shows that organizations have a more reactive mindset about security as a whole than security practitioners do and are more focused on the end (breaches) rather than the means (attack vectors). 

In other words, if organizations paid more attention to the concerns of day-to-day practitioners and implemented proactive security measures, their organizations' infrastructure misconfigurations and vulnerabilities which increase their risk of breach might be quickly addressed. The good news is, the majority of container security budgets are going toward cloud workload security, which suggests that spending is properly aligned with the risks that practitioners see every day.

Containers, DevSecOps, and the skills gap are buzzwords, but organizations must ensure that they are capable of aligning their people and technology to make the most of these investments. Short-term thinking can derail a cogent IT and security plan so it's important that IT and security leaders not only think of what areas they need to improve in 2019 but also beyond.

Mark Moore is Senior Software Security Engineer at Threat Stack
Share this

Industry News

March 18, 2024

Kubiya.ai announces the launch of its DevOps Digital Agents.

March 18, 2024

Aviatrix® introduced Aviatrix Distributed Cloud Firewall for Kubernetes, a distributed cloud networking and network security solution for containerized enterprise applications and workloads.

March 18, 2024

Stride announces the general availability of Stride Conductor, its new autonomous coding product that transforms the software development landscape.

March 14, 2024

CircleCI unveiled CircleCI releases, which enables developers to automate the release orchestration process directly from the CircleCI UI.

March 13, 2024

Fermyon™ Technologies announces Fermyon Platform for Kubernetes, a WebAssembly platform for Kubernetes.

March 13, 2024

Akuity announced a new offer targeted at Enterprises and businesses where security and compliance are key.

March 13, 2024

New Relic launched new capabilities for New Relic IAST (Interactive Application Security Testing), including proof-of-exploit reporting for application security testing.

March 12, 2024

OutSystems announced AI Agent Builder, a new solution in the OutSystems Developer Cloud platform that makes it easy for IT leaders to incorporate generative AI (GenAI) powered applications into their digital transformation strategy, as well as govern the use of AI to ensure standardization and security.

March 12, 2024

Mirantis announced significant updates to Lens Desktop that makes working with Kubernetes easier by simplifying operations, improving efficiency, and increasing productivity. Lens 2024 Early Access is now available to Lens users.

March 12, 2024

Codezero announced a $3.5 million seed-funding round led by Ballistic Ventures, the venture capital firm dedicated exclusively to funding entrepreneurs and innovations in cybersecurity.

March 11, 2024

Prismatic launched a code-native integration building experience.

March 07, 2024

Check Point® Software Technologies Ltd. announced its Check Point Infinity Platform has been ranked as the #1 Zero Trust Platform in the latest Miercom Zero Trust Platform Assessment.

March 07, 2024

Tricentis announced the launch and availability of SAP Test Automation by Tricentis as an SAP Solution Extension.

March 07, 2024

Netlify announced the general availability of the AI-enabled deploy assist.

March 07, 2024

DataStax announced a new integration with Airbyte that simplifies the process of building production-ready GenAI applications with structured and unstructured data.