The issue is compounded by the fact that security is still not high enough up the list of priorities for business leaders. Despite well-known organizations frequently hitting the headlines for data breaches (in 2018 alone we’ve had Ticketmaster, Quora, British Airways, Under Armour and plenty more) and a ‘when not if’ warning being peddled by the security industry for years, many businesses still haven't got to grips with just how critical proper security is. The fact that reviewing security may not have been part of the acquisition process of Starwood by Marriott – and if it was, not well enough – is further evidence of this apparent blindness to the impact of poor security.
So, what’s going wrong? A research report from security company Bromium earlier this year suggested that the average large enterprise spends $16.7 million per annum on security, with the vast majority found to be on ‘the human cost of maintaining cyber security systems’. While most firms clearly aren’t 2,000 people sized enterprises, the research provides a good indication that spending on security isn’t the issue. Instead, it’s people.