Introduction

New research from The Futurum Group indicates:

• More than half of organizations plan to add a new cybersecurity vendor, and 45% plan to add a new cybersecurity product category, in 2024.
• Nearly 80% of organizations planning to add new cybersecurity vendors intend to do so to enhance their existing cybersecurity environment, with the ability to better address the evolving threat landscape being a dominant concern.
• More than 90% of organizations need to deploy cybersecurity tools, software, and services faster when compared with 3 years ago—with more than half needing to move 50% faster or more.

Hot on the heels of RSA Conference (RSAC) 2024, the world’s preeminent security conference that reportedly attracted nearly 45,000 attendees and 600 exhibitors, The Futurum Group completes fielding of its inaugural Cybersecurity Decision Maker IQ data. From across the globe, The Futurum Group surveyed 841 decision makers and individuals who influence the purchase of cybersecurity products and services within their enterprise. The targeted respondents were IT managers or individuals working in the office of the CISO or the CIO. This research covers seven product categories including Data Protection, Data Security Posture Management, Identity and Authentication, Network Security, Cloud Network Security, Security Information and Event Management (SIEM), and Extended Detection and Response (XDR). The full Decision Maker IQ dashboard with interactive visualizations, full data filtering (slice and dice), and companion report will be available on June 28, 2024.

Much of what was discussed at RSAC aligns with how enterprise decision makers view the current cybersecurity market.

Security Investments Map to the Changing Threat Landscape

Now in its 33^rd year, the RSA Conference’s theme this year was The Art of Possible. Generally speaking, “the art of the possible” refers to emphasizing pragmatism over idealism and pushing the boundaries of what is possible to achieve, even if it feels far-fetched—both of which are critical when it comes to defending within today’s security landscape. The onslaught of attacks that continue to increase in severity and sophistication is never-ending, and the threat landscape is evolving at an unprecedented cadence as malicious actors gain new fuel in the form of access to artificial intelligence (AI).

As underscored by The Futurum Group’s conversations at RSAC, as well as by the findings in our Cybersecurity Decision Maker IQ data, it is clear that just as attackers are evolving and innovating, organizations must also evolve and innovate when it comes to their approach to security. More than two-thirds of respondents to our survey indicated plans to add at least one new cybersecurity vendor over the next year, primarily to add new or enhance existing cybersecurity capabilities. Even among the respondents who do not plan to add a new vendor, more than 80% indicated an intent to invest more in their existing cybersecurity vendors.

But where exactly should customers be looking to invest? There is no lack of buzz terms, with AI spearheading practically all conversations and vendor messages, followed closely by security posture management and zero trust. The key is to get to tactical discussions around technologies, frameworks, and services that can be implemented to help overwhelmed and understaffed security and IT teams become more proactive and preventative and to streamline and accelerate their response when an incident does occur.

Mapping this feedback to The Futurum Group’s conversations at RSAC underscores the world is changing. Organizations are embracing a diverse range of cloud-hosted, software as a service (SaaS), and mobile IT resources for daily and critical functions. New AI applications—off -the-shelf and custom-built—are entering the scene and bringing a host of new vulnerabilities and security requirements, spanning security and protection of the data pipeline and large language models (LLMs) to the AI applications themselves. Applications are being developed using agile methodologies and open-source code repositories. This all increases potential vulnerabilities and vastly expands the potential attack surface. It is critical to have an inventory of all of the assets and to not only identify risk but also analyze it and prioritize actions.

To facilitate this end, vendors are baking automation and, more recently, AI into their tools to help IT and security teams assess risk and prioritize actions. This is an evolution, as to-date we have typically heard about and seen automation be used to streamline daily operations and address the burnout of understaffed security and IT teams. While the latter is certainly an issue facing organizations today, survey feedback and The Futurum Group’s conversations at RSAC indicate that the pressing requirement is empowering these teams to up-level, scale, and respond more quickly to the most critical vulnerabilities and incidents.

Shoring up data security and ensuring recoverability of critical data assets has been and will continue to be an important area of focus when maximizing resiliency against attack. As attackers increasingly target user identities and compromise credentials for access, the ability to adopt a Zero Trust approach that incorporates the security of users’ identities becomes critical, as well. In The Futurum Group’s research, all products were being used by at least 45% of respondents, but the top three were Cloud Network Security (79%), Network Security (77%), and Data Protection (75%). Looking ahead at the new product categories that respondents intend to add, Data Protection remains a key focus area, but respondents indicated broad interest across the product categories we surveyed about.

Conclusion

The cybersecurity landscape is very challenging, but there is hope. Organizations must adapt and invest with attackers leveraging AI and with the attack surface expanding. The Futurum Group’s Cybersecurity Decision Maker IQ data shows strong interest in new vendors and increased spending on existing ones. While AI is a hot topic, focus on practical solutions for proactive prevention, faster response, and better risk management. Cloud, mobile, and agile development introduce new vulnerabilities, so a complete asset inventory and risk analysis are crucial. Automation and AI-powered tools are emerging to help overwhelmed security teams, allowing them to prioritize critical issues. Data security, user identity protection, and Zero Trust are also key areas for investment. While Cloud Network Security, Network Security, and Data Protection are the most common tools, adoption is broad across all security categories. The future is about empowering security teams to be more proactive and adaptable in the face of ever-evolving threats.

Disclosure: The Futurum Group is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.

Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of The Futurum Group as a whole.

Other Insights from The Futurum Group:

Fight Smarter: Accelerate Your SOC with AI – Six Five On the Road

Securing and Governing AI with Microsoft Security – Six Five on the Road

Insight Type: Six Five Webcast

Author Information

Krista Case

With a focus on data security, protection, and management, Krista has a particular focus on how these strategies play out in multi-cloud environments. She brings approximately 15 years of experience providing research and advisory services and creating thought leadership content. Her vantage point spans technology and vendor portfolio developments; customer buying behavior trends; and vendor ecosystems, go-to-market positioning, and business models. Her work has appeared in major publications including eWeek, TechTarget and The Register.

Prior to joining The Futurum Group, Krista led the data protection practice for Evaluator Group and the data center practice of analyst firm Technology Business Research. She also created articles, product analyses, and blogs on all things storage and data protection and management for analyst firm Storage Switzerland and led market intelligence initiatives for media company TechTarget.