From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Computer Security

Billy Hurley

itbrew.com

Like a knuckle sandwich slowly forming in the hand of the overworked IT pro, security resources are tightening.

Growth of security spending budgets—and security staff—has lagged for the first time in five years, according to IANS Research. And money is more likely to go to tools than people, according to the report’s researchers.

“We are seeing incredibly small budget availability for staff and much more willingness to spend on tools than people,” Nick Kakolowski, senior research director at IANS told us, referring to conversations he’s had with CISOs.

A 2024 Information Services Group survey, referenced in Forrester’s budget planning guide for 2025, revealed that software made up 35.9% of security budgets, while personnel made up 28.3%.

From 2020 to 2024, security budgets as a percentage of IT spending “grew steadily” from 8.6% to 11.9%. In 2025, the party slowed down, dipping for the first time in five years to 10.9% growth.

The IANS report, released in August, cites budget constraints across org departments, due to uncertainty caused by global market volatility, fluctuating inflation and interest rates, and unclear tariff policies.

“Cyber is not immune to macro conditions. Despite that, there’s still investment in the function,” Steve Martano, partner at Artico Search,which contributed to the IANS report, said.

“Most organizations have a baseline of security at this point, so the transformational days of having to really spend a lot on program build in terms of capex versus opex for most organizations: that’s already been done—not all organizations, but most,” he told us.

IANS found that the security teams, like budgets, are growing, just less than they used to. The average growth rate of the size of security teams reached 7%, according to the newly published research—the lowest increase percentage in the past five years.

Only 45% of CISOs were able to “add net new headcount,” a decline from 67% three years ago, and 51% in 2023.

47% of CISOs kept their team size flat in 2024.

Jill Knesek, CISO at financial operations platform BlackLine, shared in an email that budget growth “has slowed” for the company, “but not significantly.” Knesek shared that the company has invested in “cloud-agnostic security tools that provide a holistic view” of the company’s security posture, as well as products that automate software development and data collection for security audits.

“Leveraging automation, machine learning and AI capabilities will provide better efficiencies in our operations,” wrote Knesek. “This is allowing for the growth of our business while not requiring a like-for-like increase in security headcount.” Knesek noted that the company continues to add headcount “strategically.”

For CISOs and security pros facing tighter budgets and the same number of security threats, Martano recommends practitioners tie their security responsibilities to business needs.

“There’s an opportunity for an information security leader or a CISO to really take charge in the assessment of those products, and to really have a perspective on if and how those products maybe change a risk profile for an organization,” he said. “CISOs should have a voice in that room, and they should think of themselves as AI thought leaders internally. It would really be helpful to their career and would be helpful to their company.”

Security spending lags for the first time in five years: IANS

What a CISO should do as budgets tighten.

Many industry pros are increasingly channeling their inner 

 and predicting the decline of the password.

The PW prognosticating demonstrates some confidence in the IT world that a 

 is now sufficiently in place. What’s left is to convince newcomers and skeptics of biometrics and passkeys’ usability. Enterprises and developers can do this with pilot programs and test runs.

“The most notable shift over the past couple of years has been that every major platform vendor is now supporting open standards for passwordless authentication that are in their flagship operating systems. So, this means for the first time that virtually every modern computing device has the capability to support passwordless authentication,” said Andrew Shikiar, executive director and chief marketing officer at FIDO, during a May roundtable discussion led by authentication provider Okta.

Shikiar also predicted on the call that the majority of consumer services in the next three to five years will offer password-free sign-in options.

In May 2022, Apple, Google, and Microsoft 

 to expand support for a common passwordless sign-in standard created by the FIDO Alliance and the World Wide Web Consortium (W3C).

Google and Apple have since announced integration with passkeys, which store a private credential on an individual’s device rather than in a company’s server. And Windows Hello offers FIDO2-certified passwordless options like facial-recognition or fingerprint-scanning biometrics.

Though some enterprises appear poised to KO the PW—the passwordless vendor SecureAuth’s April 2023 

 survey, conducted independently by VIB Research, found that 65% of 285 IT and security pros are planning on implementing passwordless technologies in the next 24 months—the general public is still a long way from fully embracing alternatives.

 of 10,000 global consumers, released in October 2022, revealed that the ever-persistent password is still the most-used authentication method for 51% of surveyed respondents.

“Using passkeys today, you could have a completely frictionless experience signing into your bank and authorizing a million-dollar transaction. For most people, that’s jarring…So, it’ll take some time to move people down this path to having comfort and confidence in this passwordless, sign-in experience,” said Shikiar.

Both developers and enterprises can lead the passwordless way.

For large enterprises with a variety of employees and devices, Vishnu Allaparthi, partner of cyber risk and regulatory practice at PwC, recommends proof-of-concept projects with a small group of authenticators.

“A lot of organizations have started their journey towards passwordless from an enterprise perspective. That doesn’t mean that you’re totally getting rid of the password…but you’re slowly shifting towards not using the password to authenticate. You still have that as a backup for certain scenarios, certain use-cases where I cannot use my FIDO credentials or passkeys to log in,” said Allaparthi during the May call, adding that developers too must drive adoption by making passwordless a primary registration option as they’re building their apps.

“We’ve got to demand that passwordless future as an end user, because the tools are there,” said Allaparthi.

Passwords have the advantage of ubiquity, but passwordless options, including third-party authenticators and biometrics, are supported by an ubiquitous device: the phone.

“When we think about how much care people put around their mobile devices, it becomes an excellent tool for us to deploy passwordless, because it has all of the available technologies on it to help us implement passwordless,” Jameeka Green Aaron, CISO at Okta, told IT Brew in May.

An illustration of a fingerprint on a blue background.

Computer Security

Security spending lags for the first time in five years: IANS

Enterprises and developers play leading role in passwordless future

Top insights for IT pros