2019 Security Budgets - Forecast is Cloudy
January 14, 2019

Mark Moore
Threat Stack

Budget season is an important time of the year for businesses because it gives senior IT and security leaders time to reflect on what went right this year and what initiatives need to be given priority in the new year. Recent research from Threat Stack shows security budgets are expected to increase by 19 percent to an average of $773,412 over the next two years, but business leaders are still facing challenges determining where to allocate this budget in the face of rapidly evolving infrastructure.

With less than half of their infrastructure remaining on-premise (41 percent), businesses are increasingly making migrations to infrastructure-as-a-service (IaaS) (25 percent), platform-as-a-service (PaaS) (17 percent), and containers (10 percent). This is one of the primary reasons why respondents indicated that their top two budget investments in 2019 will be directed at cloud workload security and intrusion detection systems (IDS).

Here are some additional important insights from the report around security budgeting:

Short-Term IT and Security Approaches Impede Long-Term Scalability

A common complaint cited by enterprises large and small is significant friction between their security and DevOps teams. This isn't just a source of frustration — the end result of this misalignment is an IT and security strategy that senior-level decision-makers feel is not scalable. Indeed, many enterprises — 54 percent of respondents — believe their organization is at risk of outgrowing its security solutions. Businesses aren't being strategic with their IT strategy — 52 percent of respondents indicated that their organization's current security technology is not well enough coordinated to sustain future growth.

The Cybersecurity Skills Gap is a Major Concern

Organizations reported needing more budget to hire security team talent as 66 percent agreed that they need more staff capable of managing security projects. Often a lack of experience increases security risks to organizations that are transitioning infrastructure to the cloud, leaving a greater margin of error for attackers to exploit.

Friction Between Security and DevOps Teams

Previous research indicated that while DevSecOps is a stated goal at most organizations, it is far from a reality. In fact, the two areas appear to be at significant odds internally. A common complaint within organizations is that development is working contrary to security team goals: 91 percent of respondents believe that development teams introduce risk to the organization. And a significant portion (29 percent) of respondents believe that their organization prioritizes releasing code that “works” over code that is secure.

Security teams are carrying their own organizational baggage as well. Almost three-quarters of respondents (74 percent) agreed that the security team is under pressure to keep pace with development and operations, and 63 percent believe their security team slows down the speed of their business.

The Threats for Organizations Using Containers

The majority of practitioners in the trenches using containers (58 percent) reported that cloud infrastructure security was their greatest concern, followed by phishing attacks (40 percent), while their organization as a whole was most concerned about data breaches impacting intellectual property (51 percent) and breaches impacting customer PII (42 percent). This data shows that organizations have a more reactive mindset about security as a whole than security practitioners do and are more focused on the end (breaches) rather than the means (attack vectors). 

In other words, if organizations paid more attention to the concerns of day-to-day practitioners and implemented proactive security measures, their organizations' infrastructure misconfigurations and vulnerabilities which increase their risk of breach might be quickly addressed. The good news is, the majority of container security budgets are going toward cloud workload security, which suggests that spending is properly aligned with the risks that practitioners see every day.

Containers, DevSecOps, and the skills gap are buzzwords, but organizations must ensure that they are capable of aligning their people and technology to make the most of these investments. Short-term thinking can derail a cogent IT and security plan so it's important that IT and security leaders not only think of what areas they need to improve in 2019 but also beyond.

Mark Moore is Senior Software Security Engineer at Threat Stack
Share this

Industry News

January 14, 2021

Oracle is making its popular APEX low-code development platform available as a managed cloud service that developers can use to build data-driven enterprise applications quickly and easily.

January 14, 2021

Parasoft announced its C/C++test update to support IAR Systems' build tools for Linux for Arm.

January 14, 2021

Harness raised $115 million in financing, reaching a valuation of $1.7 billion in just three years after launching from stealth.

January 13, 2021

Slim.ai launched with its cloud-based DevOps automation platform built specifically for software developers.

January 13, 2021

WhiteSource announced new WhiteSource Advise support for JetBrains' PyCharm and WebStorm integrated development environments (IDEs).

January 12, 2021

Red Hat has added new features to Red Hat Runtimes.

January 11, 2021

KubeSphere announced its expanded relationship with AWS to offer KubeSphere as an AWS Quick Start.

January 07, 2021

Red Hat announced its intent to acquire StackRox

January 07, 2021

Cigniti Technologies announced a partnership with Sonatype to help enterprise customers innovate faster and easily mitigate security risk inherent in open source.

January 07, 2021

Lacework announced a $525 million growth round with a valuation of over $1 billion.

January 06, 2021

BMC announced several new capabilities and enhancements for the BMC Automated Mainframe Intelligence (AMI) and Compuware portfolios that enable BMC mainframe customers to protect uptime and availability, defend the mainframe against cybersecurity threats, and advance enterprise DevOps.

January 06, 2021

Sysdig has achieved Service Organization Control (SOC) 2 Type II compliance for the Sysdig Secure DevOps Platform.

January 05, 2021

Allegro AI announced a rebranding of its key product Allegro Trains as ClearML.

January 05, 2021

Acryl unveiled a pilot service for Jonathan, an integrated AI platform that can be used in a variety of industries with a spectrum of users from non-experts to professional developers.

January 05, 2021

Weaveworks announced a $36.65 million Series C funding round.