A recent survey of 8,000 security professionals across 30 markets indicates that most organizations face significant internal friction and delays in implementing new security controls, with only a small fraction demonstrating high effectiveness against modern threats. The survey, conducted by Cisco, found that only 8% of organizations fall into the top tier of preparedness for AI-era threats.
A key finding highlights that only 21% of organizations can deploy a new security control within six months, even after budget and approvals are secured. For the top-performing organizations, this figure rises to 52%. This delay is largely attributed to internal organizational issues such as procurement bottlenecks, IT infrastructure decisions, and competing C-suite priorities.
The survey suggests that the primary impediment to effective cybersecurity is not a lack of tools, but rather operational inefficiencies and internal friction within companies. This friction accounts for half of the 100-point scoring system used in the survey, meaning organizations with less internal friction inherently rank higher.
A significant amount of time is also consumed by data management. Approximately 40% of security teams report spending more time collecting and correlating data from disparate systems than actively addressing threats. This fragmentation hinders rapid response and threat analysis.
When asked about factors that would have improved a recent incident or near-miss, security professionals frequently cited the need for clearer escalation paths and defined communication channels. One Chief Security Officer in India specifically mentioned confusion over who had the ultimate authority to shut down compromised systems during an incident.
While increased security spending can lead to fewer incidents, the survey indicates that the effectiveness of spending varies significantly. Among all organizations that increased their security budgets, 41% reported a reduction in incidents. However, in the top-tier organizations, 71% saw fewer incidents after increasing spending, suggesting that *what* a company invests in is more critical than the sheer amount spent.
The qualitative responses from practitioners consistently emphasized the need for clearer ownership, defined communication channels, and faster inter-departmental communication. The inability to quickly identify who can authorize a system shutdown, for example, will inevitably lead to lost time during an attack, regardless of the technology in place.
Cisco's recommendations to address these challenges include pre-defining decision rights before an incident occurs, unifying data into a single comprehensive view, practicing incident response playbooks under pressure, leveraging constrained automation for initial responses, and making the most secure option the easiest path for users to follow.
