Security: A Kind of Insurance Policy

Security.   The Return on Investment for security technologies is hard to calculate.  In a sense investment in security technology is an insurance policy that helps protect against bad things that might happen.  You probably will never know what could have happened had you not implemented your security.  But companies are continually worried that they should be doing more.

At the Gartner Security Summit 2010, Managing Vice President Vic Wheatman presented information that suggests that most companies are right on in terms of how much they budget for and adopt security technology.  In fact, he suggests that some companies may even be spending too much.

Wheatman’s numbers show that, on average, companies spend about five percent of their total IT budget on security, but the actual numbers varies by industry segment.  Interestingly enough, in high tech shops, the IT group spends as much as 11.3 percent of the IT budget on security.  Banking and Finance companies spend about 8.3 percent of total IT budget, and schools and universities spend less than four percent.  Overall, security spending is expected to increase by about 5.1 percent this year.

When looking at what that translates to in terms of spend per employee, the numbers are interesting.  On average, most companies spend as much as $525 per employee on security.   That ranges from a high in the insurance industry of $866 per employee to a low of about $155 per employee in the transportation industry.

When IT budgets are compared to the total organizational budget, it averages 3.1 percent of total company revenues.  So the spend on security relative to the entire company budget works out to about 0.12 to 0.3 percent of total company revenue.  Wheatman compared this amount to the 0.138 to 0.232 percent of revenue that companies typically spend on casualty insurance.  The numbers are very similar, and based on that, Wheatman thinks that companies are probably just about right on in terms of their security spending levels.

So security spending is in the ballpark of what makes sense and is affordable to companies.  But what gets lost in the analysis is the simple question about whether companies have done enough to protect themselves.  A fixed sum of money will probably buy similar casualty insurance policies.  But security seems to be an altogether different story.  Simply spending a lot of money on security doesn’t necessarily secure you to a certain level of loss or damage.  A better analysis would be to see which security threats companies are trying to protect themselves against and what types of preventative security practices and policies have been implemented.