As the cyber landscape continues to shapeshift at speed, there is a concerning disconnect between security capabilities and confidence levels that could be leaving many enterprises exposed.
This is happening at a time when the stakes are getting higher. For example, financial institutions are currently preparing for the EU’s Digital Operational Resilience Act (DORA). This regulation mandates robust ICT risk management and comprehensive security monitoring – yet many organisations are relying on a patchwork of tools that may leave them exposed to increasingly sophisticated attack methods like AI deep fakes and spearphishing.
But this challenge extends far beyond finance; every sector faces mounting pressure to demonstrate both security effectiveness and regulatory compliance.
Our latest data shows that organisations have accumulated an average of 19 security solutions per team – however, 41% still report a lack of technology as their biggest challenge in maintaining a robust security posture.
This disconnect points to a deeper problem. In short, there needs to be greater acknowledgement that strong cybersecurity is not about having more tools, but having the right ones.
Most concerning is that while 93% of IT decision-makers feel confident they have the necessary tools to maintain visibility across their infrastructure, 95% admit they haven’t been able to easily access specific digital assets in the last year. This false confidence is creating dangerous blind spots that leave organisations vulnerable to both security breaches and compliance failures.
Understanding the challenge
The modern enterprise infrastructure has become a labyrinth of critical assets, connections and endpoints. To offer some perspective, the average IT team now manages 31 endpoints per person across their organisation. In a 1,000-person company, that’s over 30,000 devices requiring constant monitoring and protection. This complexity is compounded by the rapid adoption of cloud services, hybrid working models and an expanding array of connected devices.
The larger the organisation, the bigger the issue. According to our data, companies with more than 1,250 employees show the least confidence in their existing tools (88%) and struggle the most with accessing critical assets (97%). These larger enterprises often grapple with a mix of legacy, bespoke and modern systems, resulting in the lowest visibility rates (79%) compared to smaller businesses.
The disparity in confidence levels between technical and compliance teams is especially telling. While 94% of information security directors express confidence in their system visibility, only 66% of compliance directors share that optimism. This gap highlights a critical misalignment between technical capabilities and compliance requirements – a gap that could prove costly as regulatory frameworks become more demanding.
Breaking the reactive cycle
The traditional approach of rapidly investing in new security solutions whenever new threats emerge has created an unwieldy tech stack that generates more problems than it solves.
Organisations are trapped in a reactive cycle. Almost four in 10 firms (39%) report a lack of actionable data despite their numerous tools, while 37% cite budget constraints as a major challenge. This reactionary stance not only strains resources but also creates dangerous gaps in security coverage.
System monitoring tools are emerging as potential solutions to these challenges. Continuous monitoring tools create cohesion amongst teams pulling all disparate tools into a single view point. By providing real-time visibility and assessment of security measures, these tools allow teams to proactively identify and remediate control failures before they escalate into security incidents. Given that 82% of organisations agree that greater visibility over digital assets would significantly improve their security posture, it is an approach well worth adopting.
It’s promising that 72% of IT teams have had their IT budget increased in the past three years, but businesses need to break free from the typical cycle of throwing money at a problem and hoping something sticks. At the same time, teams will have to battle boards over more tooling and convince them they are not plugging gaps but increasing their visibility.
Indeed, businesses are suffering from a blind spot that’s leaving them exposed. Misplaced confidence in existing security tools means these businesses are susceptible to data breaches and non-compliance fallout with potentially crippling financial and reputational consequences. The disconnect between confidence and tangible output signifies a need for a paradigm shift.
Moving forward
However, such a shift requires not just new tools, but a fundamental change in how we approach security monitoring and compliance.
For security teams, the benefits are clear. Our research shows that 38% believe automation will accelerate document creation, while 37% see it improving board pack preparation and 36% anticipate more time for strategic security assessments. More importantly, 35% expect reduced human error and enhanced data accuracy. The time saved through automation – up to 60 hours annually per team member on board reporting alone – can be redirected toward strategic security initiatives.
As regulatory requirements continue to evolve across industries, including the upcoming DORA regulation, organisations can’t afford to maintain the status quo. The gap between perceived and actual security capabilities represents a significant risk, one that could lead to both security breaches and compliance failures.
The message is clear. It is time for businesses to move beyond the false confidence in their swollen security stack and focus on achieving genuine visibility and control across their entire infrastructure.
About the Author
Martin Greenfield is the CEO of Continuous Controls Monitoring solutions provider, Quod Orbis. He has over two decades in the cyber security space. With his team, Martin helps deliver complete cyber controls visibility for our clients via a single pane of glass, through Quod Orbis’ Continuous Controls Monitoring (CCM) platform. Their clients can see and understand their security and risk posture in real time, which in turn drives their risk investment decisions at the enterprise level.
