How much of your security do you outsource today?

Security & GRCOutsourcing & Managed Services

None23%

<25%47%

25-50%20%

51-75%6%

>75%2%

818 PARTICIPANTS
5.8k viewscircle icon2 Upvotescircle icon1 Comment
Sort by:
VP, Director of Cyber Incident Response in Finance (non-banking)4 years ago

When you ask how much is outsourced, what do you mean?  Percentage of the overall budget?  Headcount?  Security components in the organization (there are a lot of managed services out there)?

Lightbulb on1

Content you might like

How can the risk management function be strengthened to counterbalance overly aggressive executive decisions?

Read More Comments

Have you evaluated any “AI native” data security platforms so far (like Concentric AI, Normalyze, etc)? Interested to know your thoughts on these, whether or not you move forward with implementing.

What is the primary way your organization anticipates using AI agents within the next 12-18 months?

To automate routine tasks and workflows (e.g., scheduling, data entry, basic customer/patient service inquiries)25%

To enhance decision-making through advanced analytics and insights generation (e.g., risk assessment, market forecasting)43%

To create new products, services, or customer/patient experiences (e.g., personalized recommendations, virtual assistants)22%

To improve cybersecurity and fraud detection (e.g., threat analysis, anomaly detection)10%

We are not currently planning to implement AI agents within the next 12-18 months

View Results

To simplify your IT, do you expect all the security controls (CASB, ZTNA, SEG and SWG) delivered by the same vendor?

Yes, I am looking at consolidating multiple vendor solutions81%

No, I am fine with managing multiple vendors18%

As part of our NYSE IPO prep, we’re debating how to communicate our system hardening efforts in regulatory disclosures (e.g., SEC Form 20-F, SFC).

Would you recommend sharing % compliance (e.g., “85% CIS Tier 2”) or sticking to qualitative descriptions of how we identify and mitigate risks? Also, do SFC/ISO 27001 expectations require full ISMS integration, or is a % model acceptable?