New ReliaQuest Study: Organizations are Prioritizing Cybersecurity Initiatives but are Dragged Down by Lack of Fundamentals

Open XDR-as-a-Service leader ReliaQuest, in partnership with Ponemon Research, announced publication of a survey report detailing the needs and priorities of cybersecurity leaders in the United States and United Kingdom. The report, "Making Security Possible and Achieving a Risk-oriented Security Posture," shows that organizations are prioritizing strategic security programs but missing the foundational capabilities they need to make meaningful changes to their security posture. Among the roadblocks to achieving a risk-oriented posture are ineffective security metrics, operational inefficiencies, and the lack of full visibility across their dynamic IT environment.

"This research offers insights into the priorities of security leaders, the day-to-day struggles they face and their ambition to support the business through change," said Ashok Sankar, Vice President of Product and Solutions Marketing at ReliaQuest. "While it's positive to see more leaders engaging in strategic approaches to securing their organization, as they look to implement programs like Zero Trust ? which can be a multi-year journey ? it's important to keep their energy focused on the fundamentals of cybersecurity. Visibility, metrics and process aren't sexy, but they are the building blocks of a resilient security program."

Sankar added: "As organizations seek to digitally transform their business and adapt to hybrid work, it's critical that security teams are not only aligned on goals, but also have the proper resources to drive resilient security operations, setting the enterprise up for long-term success."

Key insights include:

Security leaders are committed to a stronger risk-based security posture

• 57% of respondents are prioritizing securely migrating applications to the cloud.
• Almost half (49%) of security leaders are enabling DevSecOps best practices.
• 48% of organizations surveyed are prioritizing implementing Zero Trust principles as part of their security strategy.

Security teams are not aligned on their security program or metrics

• The primary obstacle to implementing an IT security risk management program is a lack of standardized metrics to measure progress (64%), followed by the lack of a risk management strategy and decision-making structure (58%).
• 58% of respondents say that the lack of a well-defined security and risk management program is what makes their organization most vulnerable to attacks, but only 31% consider developing a risk-reduction program a top security priority.
• Only a third (37%) of those surveyed believe that their teams are tracking the right security metrics and that it is easy to communicate them to business executives and board members.
• Only about half (49%) rate developing business goal?oriented metrics as one of the top priorities for the next year.

Security teams are inhibited by process and operational inefficiencies

• 31% of respondents report their security staff spends at least 3 hours a day manually administering and managing (optimization, writing rules, integrating) tools.
• The majority (57%) of organizations have one staff member managing more than four tools in their organizations. Only 17% have one staff member assigned to manage a single tool.
• 52% agree that their team is spending too much time on data collection activities instead of threat detection and analysis.

Poor enterprise-wide visibility is the main culprit behind risk exposure

• Only 13% say they have more than 75% visibility across all security tools, including on-premises and the cloud. 69% believe they have less than 50% visibility across all security tools, including on-premises and the cloud.
• 56% believe they could achieve better threat detection and response efficiency with better visibility by integrating and providing a singular view across tools.
• 60% state their top challenge in implementing effective threat detection is a lack of integrated visibility into cloud and on-premises sources.
• Only about one-third (36%) say they are measuring visibility across the environment, including on-premises and the cloud.

The full report is available to download here.

Ponemon Research and ReliaQuest will host a webinar to review the findings in greater detail. To register for the online webinar, please visit this link here.

Methodology

More than 1,000 security leaders were surveyed in the United States (632) and United Kingdom (391) who are familiar with the organizations' security operations and strategy. Participants in this research are knowledgeable about their organizations' efforts in attaining a risk-oriented security posture. Most respondents are involved in implementing solutions (61 percent) followed by evaluating solutions (48 percent). The report presents the consolidated U.S. and U.K. research findings.

About ReliaQuest

ReliaQuest, the leader in Open XDR-as-a-Service, is the force multiplier for security operations teams. ReliaQuest GreyMatter is a cloud-native Open XDR platform that brings together telemetry from any security and business solution, whether on-premises or in one or multiple clouds, to unify detection, investigation, response, and resilience. ReliaQuest combines the power of technology and 24/7/365 security expertise to give organizations the visibility and coverage they require to make cybersecurity programs more effective.

Hundreds of Fortune 1000 organizations trust ReliaQuest GreyMatter to operationalize security investments, ensuring teams focus on the right problems while closing visibility and capability gaps to proactively manage risk and accelerate initiatives for the business. ReliaQuest is a private company headquartered in Tampa, Fla., with multiple global locations. For more information, visit www.reliaquest.com.