2019 Security Budgets - Forecast is Cloudy
January 14, 2019

Mark Moore
Threat Stack

Budget season is an important time of the year for businesses because it gives senior IT and security leaders time to reflect on what went right this year and what initiatives need to be given priority in the new year. Recent research from Threat Stack shows security budgets are expected to increase by 19 percent to an average of $773,412 over the next two years, but business leaders are still facing challenges determining where to allocate this budget in the face of rapidly evolving infrastructure.

With less than half of their infrastructure remaining on-premise (41 percent), businesses are increasingly making migrations to infrastructure-as-a-service (IaaS) (25 percent), platform-as-a-service (PaaS) (17 percent), and containers (10 percent). This is one of the primary reasons why respondents indicated that their top two budget investments in 2019 will be directed at cloud workload security and intrusion detection systems (IDS).

Here are some additional important insights from the report around security budgeting:

Short-Term IT and Security Approaches Impede Long-Term Scalability

A common complaint cited by enterprises large and small is significant friction between their security and DevOps teams. This isn't just a source of frustration — the end result of this misalignment is an IT and security strategy that senior-level decision-makers feel is not scalable. Indeed, many enterprises — 54 percent of respondents — believe their organization is at risk of outgrowing its security solutions. Businesses aren't being strategic with their IT strategy — 52 percent of respondents indicated that their organization's current security technology is not well enough coordinated to sustain future growth.

The Cybersecurity Skills Gap is a Major Concern

Organizations reported needing more budget to hire security team talent as 66 percent agreed that they need more staff capable of managing security projects. Often a lack of experience increases security risks to organizations that are transitioning infrastructure to the cloud, leaving a greater margin of error for attackers to exploit.

Friction Between Security and DevOps Teams

Previous research indicated that while DevSecOps is a stated goal at most organizations, it is far from a reality. In fact, the two areas appear to be at significant odds internally. A common complaint within organizations is that development is working contrary to security team goals: 91 percent of respondents believe that development teams introduce risk to the organization. And a significant portion (29 percent) of respondents believe that their organization prioritizes releasing code that “works” over code that is secure.

Security teams are carrying their own organizational baggage as well. Almost three-quarters of respondents (74 percent) agreed that the security team is under pressure to keep pace with development and operations, and 63 percent believe their security team slows down the speed of their business.

The Threats for Organizations Using Containers

The majority of practitioners in the trenches using containers (58 percent) reported that cloud infrastructure security was their greatest concern, followed by phishing attacks (40 percent), while their organization as a whole was most concerned about data breaches impacting intellectual property (51 percent) and breaches impacting customer PII (42 percent). This data shows that organizations have a more reactive mindset about security as a whole than security practitioners do and are more focused on the end (breaches) rather than the means (attack vectors). 

In other words, if organizations paid more attention to the concerns of day-to-day practitioners and implemented proactive security measures, their organizations' infrastructure misconfigurations and vulnerabilities which increase their risk of breach might be quickly addressed. The good news is, the majority of container security budgets are going toward cloud workload security, which suggests that spending is properly aligned with the risks that practitioners see every day.

Containers, DevSecOps, and the skills gap are buzzwords, but organizations must ensure that they are capable of aligning their people and technology to make the most of these investments. Short-term thinking can derail a cogent IT and security plan so it's important that IT and security leaders not only think of what areas they need to improve in 2019 but also beyond.

Mark Moore is Senior Software Security Engineer at Threat Stack
Share this

Industry News

September 21, 2023

Red Hat and Oracle announced the expansion of their alliance to offer customers a greater choice in deploying applications on Oracle Cloud Infrastructure (OCI). As part of the expanded collaboration, Red Hat OpenShift, the industry’s leading hybrid cloud application platform powered by Kubernetes for architecting, building, and deploying cloud-native applications, will be supported and certified to run on OCI.

September 21, 2023

Harness announced the availability of Gitness™, a freely available, fully open source Git platform that brings a new era of collaboration, speed, security, and intelligence to software development.

September 20, 2023

Oracle announced new application development capabilities to enable developers to rapidly build and deploy applications on Oracle Cloud Infrastructure (OCI).

September 20, 2023

Sonar announced zero-configuration, automatic analysis for programming languages C and C++ within SonarCloud.

September 20, 2023

DataStax announced a new JSON API for Astra DB – the database-as-a-service built on the open source Apache Cassandra® – delivering on one of the most highly requested user features, and providing a seamless experience for Javascript developers building AI applications.

September 19, 2023

Oracle announced the availability of Java 21.

September 19, 2023

Mirantis launched Lens AppIQ, available directly in Lens Desktop and as (Software as a Service) SaaS.

September 19, 2023

Buildkite announced the company has entered into a definitive agreement to acquire Packagecloud, a cloud-based software package management platform, in an all stock deal.

September 19, 2023

CrowdStrike has agreed to acquire Bionic, a provider of Application Security Posture Management (ASPM).

September 18, 2023

Perforce Software announces BlazeMeter's Test Data Pro, the latest addition to its continuous testing platform.

September 18, 2023

CloudBees announced a new cloud native DevSecOps platform that places platform engineers and developer experience front and center.

September 18, 2023

Akuity announced a new open source tool, Kargo, to implement change promotions across many application life cycle stages using GitOps principles.

September 14, 2023

CloudBees announced significant performance and scalability breakthroughs for Jenkins® with new updates to its CloudBees Continuous Integration (CI) software.