The bMighty Blog -- Security

The results of a recent survey of small and midsize business IT security spending plans are being interpreted/marekted as signs that your security spending is "recession proof." A closer look suggests something quite different.

The security-centric survey of 300 RSA attendees earlier this month was conducted by security vendor Astaro.

67 percent of those surveyed said they didn't expect their security spending to be affected by a recession this year.

Now, it's no news to you or me that sponsored survey results get spun in the direction of the sponsor's revenue stream (which underwrites the survey in the first place.) That's part of the nature of the beast, and shouldn't be taken as a knee-jerk indictment of the process or the results, and certainly not of Astaro. Everybody does it, and we report on most of them.

Astaro's own coverage of the survey, in fact, is (relatively) freer from hype and, at least in its first few paragraphs, sellspeak than most. But take special note of the key word in their headline:

According to Survey, IT Security Budgets Seem Recession Proof -- underline mine.

To seem is not necessarily to be, and it may be that on closer examination the survey's findings aren't as budget-hopeful as they, well, seem.

For one thing, Astaro cites a Gartner report indicating that small business's IT security budgets are likely to grow by about 3.25 percent over last year, while midsize business security spending should grow by 5.34 percent.

Both of those percentages are lower than the annual increases in the last couple of years, which it seems to me is, if nothing else, reflective of recession-concerns if not recession effects. (And offer Astaro a chance to discuss the cost-savings and economies that are part of their marketing effort for their products.)

But for another, and more telling, thing, look again at where the survey took place: RSA San Diego.

Now, I don't have statistics, and I haven't taken a survey, but I think it's a fairly safe bet that attendees at a security conference, whose presence there represents at least some level of travel budget and security-education investment, may be likelier to forecast stability and even small growth in their security spending than representatives of companies that don't attend such conferences, and a lot likelier than those of companies whose budgets don't permit such attendance.

Conferences are great and conferences are often valuable, but conferences don't take place -- deliberately: just ask any conference planner -- in the real world.

Again, this isn't a crack at Astaro, just a reminder (to myself as well as you) that while conferences and conference attendees are important sources of information and insight, they're also special cases, tight-focused on the subjects and the survey-subjectss at-hand, while most of the world stays at home and worries about the recession's effect not just on security spending but also on every other aspect and line-item of their business budgets.

Spotlight on Solutions

(Sponsored By Cisco)