It’s not surprising that consumers and clients are having a hard time feeling that their personal or business data is safe and secure when engaging or interacting with a brand or company these days—breaches have been common throughout the digital age, but with Generative AI now or soon to be connected to most operations, this threat has reached an unprecedented level of concern. New research from trust management platform Vanta reveals an urgent need for companies to improve—and prove—their security posture.
The firm’s annual State of Trust Report, based on a survey conducted by Sapio Research, provides in-depth analysis of global trends in security, compliance and the future of trust. Most alarming is that despite their best efforts, two-thirds of businesses (67 percent) say they need to improve security and compliance measures, and nearly one in four (24 percent) rate their organization’s strategy as reactive.
For companies of all sizes, limited risk visibility and resource constraints make it challenging to improve their security. Only four in ten organizations rate their risk visibility as strong. Meanwhile, one in four have downsized IT staff and 60 percent have either already reduced IT budgets or are planning to as they continue grappling with the challenging global economic environment.
The security improvement imperative
With rising risk and shrinking resources, the message is clear: businesses need new methods to improve their security. Compounding the urgency is ever-evolving global regulation and the growing time-suck of complying with an increasing number of standards. In an environment where customers want more insight into a company’s security practices, organizations are at an impasse.
Two-thirds of respondents say that customers, investors and suppliers are increasingly looking for proof of security and compliance. While 41 percent provide internal audit reports, 37 percent third party audits, and 36 percent complete security questionnaires, one in eight (12 percent) admit they don’t or can’t provide evidence when asked. That means companies around the world are falling at the very first hurdle—costing them potential revenue and growth opportunities in new markets.
Additional findings include:
- Businesses spend an average of 7.5 hours per week—more than 9 working weeks a year—on achieving security compliance or staying compliant.
- Over half (54 percent) are concerned that secure data management is becoming more challenging with AI adoption with 51 percent saying that using Generative AI could erode customer trust.
- The two biggest barriers to proving and demonstrating security externally are a lack of staffing and lack of automation to replace manual work.
- Only 9 percent of businesses’ IT budgets are dedicated to security, with 1 in 3 leaders saying their IT budgets are continuing to shrink.
- Identity and access management and data processing that doesn’t comply with regulations are the two biggest blind spots for organizations.
Despite all countries continuing to grapple with the unique set of security and compliance challenges, the survey findings illustrate the vast differences experienced across timezones:
- Leaders in the U.S. are most likely to delay entering new markets due to compliance requirements, admitting they’re not prioritizing compliance due to the financial investment.
- Respondents in Australia are the most concerned about Generative AI’s potential impact on customer trust.
- Germany is one of the most likely to say that the volume of standards and regulations is a barrier to maintaining a robust security program.
- 76 percent of leaders in France say they need to improve security and compliance, the highest of all markets.
- Organizations in Australia are least likely to be able to provide proof of compliance to customers.
- UK leaders are more concerned with keeping up to date with evolving regulations than any other market.
- Companies in the U.S. believe they could save at least 3 hours a week by automating security and compliance tasks—the highest of any country.
The trust management tipping point
Ultimately, better security improves efficiency, builds trust and boosts the bottom line. A majority (70 percent) of leaders say that a better security and compliance strategy positively impacts their businesses thanks to stronger customer trust, while nearly three in four (72 percent) agree that a better security and compliance strategy would make them more efficient.
An overwhelming 83 percent of businesses have or plan to increase their use of automation, particularly for reducing manual work and streamlining vendor risk reviews and onboarding. All in, respondents believe they could save at least two hours per week—over 2.5 working weeks a year—if security and compliance tasks were automated.
“The business case for trust management is undeniable,” said Christina Cacioppo, CEO of Vanta, in a news release. “For companies at the forefront of disrupting the security status quo, centralizing processes, automating compliance and accelerating security reviews can turn trust into a truly marketable advantage. By closing the loop on the security lifecycle from compliance through continuous monitoring and communication, businesses can transform how they build trust and ultimately unlock growth.”
The future of trust in an AI world
Automation and Generative AI are top of mind for IT and business decision makers with 77 percent of businesses already or planning to use AI/ML to detect high-risk actions.
When done right, AI has an undeniable power to accelerate security workflows and transform trust. Respondents believe the biggest potential of AI will be improving the accuracy of security questionnaire responses (44 percent), eliminating manual work (42 percent), streamlining vendor risk reviews and onboarding (37 percent), and reducing the need for large teams (34 percent).
Download the full report here.
The State of Trust 2023 Report surveyed the behaviors and attitudes of 2,500 business leaders across Australia, France, Germany, the UK and U.S. to understand the challenges and opportunities they’re facing when it comes to security and trust management.
