Companies are spending large amounts on cybersecurity, yet cyber threats continue to persist and thrive. Security executives are under tremendous pressure, and companies are questioning the wisdom of their security budgets.
These views are still at the fringe of a US$800 billion industry that prefers to drum up the inevitability of cybersecurity purchases. Investing in security is crucial, a message that has reached boards and the c-suite. However, there is a problem. Companies are now locked in a spiral of spending that does not seem to deter criminals. What is going on?
A spiralling problem
Cybercrime continues to thrive. Deepfake scams are expanding, reports of digital fraud and theft pop up frequently, and ransomware remains a clear threat to all organisations. Yet, there is a collective shrug from experts who retort that digital crime is a reality in the modern world.
Is this the full picture? Is a spending arms race inevitable? Gerhard Swart, Chief Technology Officer (CTO) at cyber security company, Performanta, disagrees. “Everyone talks about how responsible companies should invest in cybersecurity, and if their security fails, they must be at fault. We’ve turned into an industry that blames the victims and then sells them more stuff. We just accept that cybercrime is like the weather. It’s inevitable, so it was your fault for not buying an umbrella. And if the storm whips away that umbrella, it’s your fault for not buying a better umbrella.”
Cybersecurity has a problem. Even though companies continue to spend large amounts on reducing their cyber risks, cybercrime is not receding. At a glance, the two seem to fuel each other. According to Statista, the global cybersecurity market grew from US$83.32 billion in 2016 to US$185.69 billion today, and yet cybercrime’s impact on economies ballooned from US$800 billion a decade ago to $9.22 trillion in 2024.
Whoever is losing money, it’s not the cybersecurity and cybercrime worlds.
The Spending Problem
Cybercriminals invent new attacks, and more criminals use off-the-shelf cybercrime tools to target victims. The cybersecurity industry has been prolific at combatting these threats. It has also helped business leaders grasp the importance of security investments.
“Today’s business decision-makers are more aware and invested in security,” says Swart. “This has been a big win for the good guys. But this awareness also stokes growing scepticism over security costs. As the market becomes savvier about security, they start asking some hard questions. For example, they want to know why they must keep spending and spending – at what point does it level out? They refuse to see cybersecurity as an infinite cost centre and are not buying the industry rhetoric that it’s a business investment.”
This disagreement is creating a split in the cybersecurity industry. The industry has been reframing security as a risk strategy. Now, there is an expectation to handle security as a proper risk, which is where viewpoints diverge.
“Cybersecurity companies will talk about risk mitigation, but then all they do is sell more stuff,” says Swart. “Got an email risk? Here’s a product. Got a data risk? Here’s a problem. Got remote worker risks? Here’s a product. Individually, these solutions do their job. But digital criminals exploit the gaps between products, so at some point it doesn’t matter how good a product is.”
The targeted risk strategy
As the market matures and accepts the risk narrative, it’s also starting to place its expectations there, says Swart. “Companies understand risk and risk mitigation. They know what results they want to see.”
As such, risk-led frameworks are starting to highlight effective cybersecurity. New models such as Gartner’s Continuous Threat Exposure Management (CTEM) are becoming the go-to of cybersecurity firms that respond to the market’s new demands. These frameworks focus on identifying key risks and aligning established security systems appropriately, often only incorporating new products when risk profiles require them.
“If you sell security, you need to take this approach,” says Swart. “Clients want to see much more value. You create that value by identifying their biggest risks then leveraging established and new products to tackle those risks. This stops them from overspending because they target their spend and they can convincingly link spend and risk mitigation.”
This relationship between risk and security is still young, however, clients are using risk narratives to reshape their views of security. They won’t buy umbrellas until they see a weather forecast that aligns with their priorities.
“What we’re seeing is a market learning fast,” says Swart. “The best security won’t be in products and services anymore but rather in showing a grasp of bespoke digital risks and how to tackle them.”