Australian and NZ security leaders want better innovation

A new study from Vectra has found that 85% of security leaders in Australia and New Zealand think traditional approaches don't protect against modern threats, and only 40% are confident their security tools would defend themselves against sophisticated attacks.

Vectra's Security Leaders Research Report found legacy thinking has security leaders and businesses investing in solutions that rely on outdated approaches and the debate between detection versus prevention solutions is coming to a head.

The report, part of a larger global study of 1800 security decision-makers conducted by Sapio Research, shares insights from 200 IT decision-makers working at organisations with more than 500 employees in the Australia and New Zealand region.

Other key findings from the study include:

• More than half of security decision-makers (58% ANZ, 79% global) reported they purchased a security solution that has failed on at least one occasion.
• More than half (60% ANZ, 64% global) are worried their tools have missed something, and 57% feel it's possible, or likely they've been breached while being unaware of it happening
• 86% believe cybersecurity decisions made by the C-Suite are influenced by relationships with legacy vendors (83% global), and 45% (54% global) said they are a decade behind on security discussions
• 75% stated they've experienced a significant security event that required an incident response effort, with alerts from security tools the most common way incidents are discovered.

Vectra director of security engineering APJ Chris Fisher says new technology is coming into the market, but effectively protecting against threats requires a mindset shift.

"We need to sit back and say, what do we need to be doing differently? We need to consider how we can push the boundary and take us one step ahead of where attackers are at," he says.

"Now we can begin to look at detection and response, and the likes of machine learning to help drive mundane tasks and better understand attacker behaviour, which is far more beneficial than understanding the attacker themselves. From here we can move into testing, seeing what works in our environment, and building up that layered defence.

Vectra says overall, security leaders are resigned to the fact that attackers are now one step ahead. It says most respondents are aware their security tools are failing them, or are ineffective, leading to ongoing worry about missing threats or attacks until it's too late.

Vectra says legacy thinking, ineffective investment into solutions and lack of awareness of boards are all challenges, but it says changes are taking place as the nature and reality of threats becomes more apparent.

The survey found that in ANZ, recent high-profile attacks have meant 88% of boards are starting to take proper notice of cybersecurity.

However, the study also shows that traditional top-down ways of thinking and corporate culture can also have a negative impact. In fact, 86% believe that existing relationships with legacy vendors influence the cybersecurity decisions their boards make, and 45% say their board is a decade behind when it comes to discussions on security.

Fisher says legacy choices are the safe choice, and with a traditional viewpoint, it makes sense because boards are generally risk-averse.

"Unfortunately, this is no longer a stance that makes sense with the threats we're facing today. No one likes hearing 'We're going to get breached' but these honest conversations are the ones we need to be having so we can be prepared, and we can come to grips with the challenges and how we can meet them," says Fisher.

"Security leaders must take on the role of raising awareness, not only within their teams but at a board level. The decisions and thinking at the top will set the overall tone and direction, so this is a crucial piece of any security strategy.