printer friendly version

Is cybersecurity broken?

Companies are spending large amounts on cybersecurity, yet cyber threats continue to persist and thrive. Security executives are under tremendous pressure, and companies are questioning the wisdom of their security budgets.

These views are still at the fringe of a US$800 billion industry that prefers to drum up the inevitability of cybersecurity purchases. Investing in security is crucial, a message that has reached boards and the C-suite. However, there is a problem. Companies are now locked in a spiral of spending that does not seem to deter criminals. What is going on?

A spiralling problem

Cybercrime continues to thrive. Deepfake scams are expanding, reports of digital fraud and theft pop up frequently, and ransomware remains a clear threat to all organisations. Yet, there is a collective shrug from experts who retort that digital crime is a reality in the modern world.

Is this the full picture? Is a spending arms race inevitable? Gerhard Swart, Chief Technology Officer (CTO) at cybersecurity company, Performanta, disagrees. "Everyone talks about how responsible companies should invest in cybersecurity; if their security fails, they must be at fault. We have turned into an industry that blames the victims and then sells them more stuff. We just accept that cybercrime is like the weather. It is inevitable, so it was your fault for not buying an umbrella, and if the storm whips away that umbrella, it is your fault for not buying a better umbrella."

Cybersecurity has a problem. Even though companies continue to spend large amounts on reducing their cyber risks, cybercrime is not receding. At a glance, the two seem to fuel each other. According to Statista, the global cybersecurity market grew from US$83,2 billion in 2016 to US$185,69 billion today, and yet cybercrime's impact on economies ballooned from US$800 billion a decade ago to $9,22 trillion in 2024.

Whoever is losing money, it is not the cybersecurity and cybercrime worlds.

The spending problem

Cybercriminals invent new attacks, and more criminals use off-the-shelf cybercrime tools to target victims. The cybersecurity industry has been prolific at combatting these threats. It has also helped business leaders grasp the importance of security investments.

"Today's business decision-makers are more aware and invested in security," says Swart. "This has been a big win for the good guys, but this awareness also stokes growing scepticism over security costs. As the market becomes savvier about security, they start asking some hard questions. For example, they want to know why they must keep spending and spending – at what point does it level out? They refuse to see cybersecurity as an infinite cost centre and are not buying the industry rhetoric that it is a business investment."

This disagreement is creating a split in the cybersecurity industry. The industry has been reframing security as a risk strategy. Now, there is an expectation to handle security as a proper risk, which is where viewpoints diverge.

"Cybersecurity companies will talk about risk mitigation, but then all they do is sell more stuff," says Swart. "Got an email risk? Here is a product. Got a data risk? Here is a problem. Got remote worker risks? Here is a product. Individually, these solutions do their job, but digital criminals exploit the gaps between products, so at some point it does not matter how good a product is."

The targeted risk strategy

As the market matures and accepts the risk narrative, it is also starting to place its expectations there, says Swart. "Companies understand risk and risk mitigation. They know what results they want to see."

As such, risk-led frameworks are starting to highlight effective cybersecurity. New models such as Gartner's Continuous Threat Exposure Management (CTEM) are becoming the go-to of cybersecurity firms that respond to the market's new demands. These frameworks focus on identifying key risks and aligning established security systems appropriately, often only incorporating new products when risk profiles require them.

"If you sell security, you need to take this approach," says Swart. "Clients want to see much more value. You create that value by identifying their biggest risks then leveraging established and new products to tackle those risks. This stops them from overspending because they target their spend and they can convincingly link spend and risk mitigation."

This relationship between risk and security will not buy umbrellas until they see a weather forecast that aligns with their priorities.

"What we are seeing is a market learning fast," says Swart. "The best security will not be in products and services anymore, but rather in showing a grasp of bespoke digital risks and how to tackle them."

Share this article:

Further reading: