Gartner, a world-leading research and advisory company, has forecasted worldwide security and risk management spending growth to slow but remain positive in 2020.
Worldwide spending on information security and risk management technology and services will continue to grow through 2020, although at a lower rate than previously forecast, according to Gartner.
Information security spending is expected to grow 2.4% to reach US$123.8 billion in 2020. This is down from the 8.7% growth Gartner projected in its December 2019 forecast update. The Coronavirus pandemic is driving short-term demand in areas such as cloud adoption, remote worker technologies and cost saving measures.
Nick Koutroumbas, Channel Account Manager EMEA at ZIX, believes we are starting to see the fallout and tail end of events unfold. “Our MSPs in the UK, from what I have observed, have adapted well to the situation, remote work and furloughs. Some have slimmed down their operations but kept business going at a higher pace than usual. The lack of commutes means there is more uptime for team members (on average) and this is also reflected with end-users working remotely.
“The key goal for MSPs is to retain customers, but this is sometimes out of their hands as the fallout affects every business sector and company differently,” said Koutroumbas. “A lot of short-term furlough licenses and adapting clients offers new budgetary limitations. MS free licenses help keep users working, but add-on cloud services are usually a budget item that is ‘optional’ now with most businesses. Our platform and support helped our MSPs to pivot on some of their end-users and retain the businesses to a degree (adjust licenses or restructure offerings). Also, our incentives programme has been helpful in giving MSPs some breathing room on major commitments.”
Koutroumbas said that investments into having more security has happened. “It was a push to get users as secure as possible, with remote offices being the new norm in a lot of cases.”
Koutroumbas said that the situation is still fluid and the next few months combined with the government responses will be good indicators of what else can/should be done. However, he believes that the majority of end-user businesses are still reeling and in uncertain waters for this year.
According to Anna Collard, MD at KnowBe4 Africa, The World Bank predicts a global GDP contraction of 5.2% in 2020. “Many organisations thus are focusing on cost savings and cancelling or postponing planned investments,” said Collard. “Facilities and general capex are most affected, but it has also had an impact on IT and technology spend. For example, organisations severely affected by the lockdown, such as those in the brick and mortar retail and hospitality industries, are cancelling or defaulting on some of their IT supplier’s contracts to pay staff salaries.”
Collard continues: “However, there is some silver lining. According to a June PWC survey across 989 CFOs from 23 countries, 52% of the respondents reported that they will make remote work a permanent option. CFOs in Africa (67%) are more likely than the global average to accelerate automation. A total of 75% of the CFOs surveyed say the increased flexibility and resiliency developed during the crisis will make their organisation stronger over the long term. Cybersecurity is one of the area’s least affected by cost saving exercises, noted at just 3% according to the report.”
Collard says she had the pleasure of speaking to Hosea, CISO at Stanbic Uganda, during a panel discussion at the Africa Cyber Security Culture conference. According to Hosea, the pandemic has helped leapfrog security investments that would have taken much longer to get management approval for prior to COVID-19. Many of the speakers and panellists shared this view – that the pandemic had a positive impact on both Digital Transformation and cybersecurity investment.
“A common thread throughout the conference and the result of research conducted by Orange Cyber Defense was that basic security failures such as poor patching, as well as not addressing people’s behaviour, are some of the root causes most often linked to security breaches,” said Collard. “People right now are more vulnerable, as they are in a state of heightened psychological stress. Security teams have less control over the systems they are supposed to protect, for example, personal devices and home Wi-Fi routers. Many had to rush into setting up remote work infrastructure without the necessary planning and testing. Security budgets had to be re-prioritised to improve the technologies and processes of their remote working infrastructures and to make these stable and secure for the long run.
“With budgets under greater pressure, CISOs need to construct resilient and data-driven cybersecurity programmes based on a deeper understanding of the risks their organisations are exposed to.
“According to ESI ThoughtLab’s report published in June 2020, successful CISOs and effective cybersecurity leaders rely heavily on advanced analytics, conduct frequent cyber-risk scenario analysis, invest more in security culture and end-user awareness training coupled with frequent phishing simulations, and make cybersecurity hygiene, such as patching, a top priority.”
Alain Sanchez, EMEA CISO, Senior Evangelist at Fortinet, says that even the most far-sighted of business leaders did not see the current remote working set up coming. “No contingency plan that I know of had forecasted that almost the entire workforce was grounded in just a couple of days. Even Telcos whose transport practices earned them the terminology of carrier-grade, were initially taken by surprise. But very rapidly, the importance of securing these traffics that were literally business critical, emerged as the immediate priority. Security could not be traded for connectivity and the irresponsible hackers that squeezed themselves into video conferences that did not implement the full authentication options, did in fact do the digital world a favour by accelerating a security wake-up call.”
The current situation urged emergency investment steps and Fortinet, for instance, saw its SD-WAN revenues growing significantly. “Already recognised by the Omdia report as the fastest growing vendor among all other SD-WAN vendors, Fortinet reported 305% year-over-year growth in the SD-WAN area,” said Sanchez. “This massive adoption of the holistic approach of cybersecurity incarnated by the Fortinet Security Fabric, says a lot about the maturity leap created by the recent crisis.” Sanchez says the times of disjointed and budget-consuming ‘best-of-breed’ are over and poses the question of whether the huge demand for broader, integrated and automated cybersecurity platforms is an indication of IT budget expansion.
“Too many products lead to too many alerts which puts a tremendous amount of stress on the cybersecurity staff. Investments are thus shifting towards solutions that not only enable visibility, reporting and analytics for all ‘on platform’ devices and endpoints, but also enable multi-vendor incident detection to finally lead to unified orchestration of the response across the entire infrastructure.
“Business leaders hate to be locked in, so they rather invest in open, standardised solutions that offer a wide range of documented APIs and connectors not only to ensure seamless integration, but also to maintain the freedom of choice of strategic vendors such as cloud providers and Managed Security Service Providers. The same is happening in the cybersecurity world, investments are going massively to platforms that make openness and standardisation a core value,” said Sanchez.
