Near 100% security strategy revamps

LogRhythm has released its report, “2024 State of the Security Team: Navigating Constant Change” based on research conducted by Dimensional Research. The report dives deep into the evolving digital landscape, unveiling 95% percent of companies reported they’ve altered their cybersecurity strategies within the last twelve months. As businesses worldwide grapple with ever-changing cyberthreats and regulatory mandates, this report stands as a testament to the resilience of security teams, providing insights into the challenging terrain of modern cybersecurity.

The research examined several facets of cybersecurity, drawing on insights from a global survey of 1,176 security executives and professionals across five continents. It explored the resources available to security teams, budget allocation, confidence in handling breaches, accountability for breaches, reporting capabilities, and the effectiveness of security communication within businesses.

Industry Headwinds Driving Changes Can’t Be Ignored by Executive Leadership

At the heart of these strategic shifts is the pivotal role of leadership within organizations. The perception of cybersecurity has changed from a purely technical issue to a central pillar of business strategy and corporate governance, with 78% stating that the cybersecurity leader or CEO—or both—are responsible for protecting against and responding to cyber incidents.

“The evolving role of cybersecurity leadership reflects a fundamental shift in how organizations view and manage cyber risk,” said Andrew Hollister, Chief Information Security Officer at LogRhythm. “Today's threat environment demands a collaborative approach, with senior executives working hand-in-hand with security professionals to understand the risks, make well-informed, strategic decisions, and allocate the necessary resources to safeguard the organization and its clients.”

The top factors driving changes to security strategy include:

Keeping pace with the shifting regulatory landscape (98%)

The need to meet customer expectations for data protection and privacy (89%)

The rise of AI-driven threats and solutions (65%)

However, amid the shifting tides, effective communication between security teams and non-security executives remains a significant gap. Almost half (44%) of non-security executives don’t understand the regulatory requirements that the company must adhere to. Additionally, 59% report difficulties explaining the necessity of specific security solutions to non-security stakeholders, indicating a pressing need for enhanced reporting mechanisms to navigate the complexities of decision-making in the modern security landscape.

Budgets are Increasing, But Metrics to Measure Impact are Lacking

Amid the security evolution, 76% percent say they have experienced increases to their budget to better manage emerging threats and nearly 8 in 10 say they now have the right resources to defend their company from cyberattacks. Continuing positive news, 79% percent of security professionals now rate their security defense as either good or excellent.

It remains to be seen whether this is overconfidence, especially since security teams aren’t reporting on key operational metrics that define whether their security investments and strategy changes have a measurable impact. The research found that less than half of security teams are reporting on time to respond (49%), time to detect (48%), and time to recover (45%).

Even more concerning, the majority (61%) of security teams are still using manual and time-intensive approaches to share security status information. Security teams need to be armed with enhanced case management metrics and advanced analytics to make informed decisions quickly.