A Struggle to Identify and Manage Cybersecurity Risks
A new survey from the Cloud Security Alliance (CSA), sponsored by Thales, highlights significant gaps in how organizations assess and mitigate cybersecurity risk management. The report, Understanding Data Security Risk 2025, examines the difficulties companies face in managing data security, governance, and compliance. It also provides insight into evolving cybersecurity risk assessment priorities as businesses adopt risk-based strategies to enhance cybersecurity.
The survey, which gathered responses from 912 IT and security professionals worldwide, underscores a critical need for more effective tools, streamlined security strategies, and stronger cross-team collaboration.
Key Findings: Confidence Gaps and Tool Fragmentation Weaken Risk Management
One of the most alarming findings is the lack of confidence organizations have in identifying high-risk data sources.
- 31% of respondents reported insufficient tooling.
- Nearly 80% lacked high confidence in detecting and mitigating security threats effectively.
Staffing issues exacerbate the issue. Security teams are often spread thin across multiple security tools.
- 54% of organizations use at least four separate tools to manage data risks.
This fragmentation leads to inefficiencies, inconsistencies, and gaps in risk visibility. Security teams struggle to assess and act on real-time threats without integrated solutions.
Management and Staff Misalignment Creates Operational Challenges
The report highlights a growing divide between leadership priorities and security teams’ operational needs. While executives (43%) focus on aligning data security efforts with broader business objectives, operational teams face daily struggles with resource limitations and manual processes.
Many organizations still rely on outdated methods—22% conduct security risk evaluations manually, and 54% use semi-automated processes. Inefficiencies like these create vulnerabilities and slow down incident response times.
Additionally, security professionals on the ground report feeling disconnected from leadership directives, with only 23% expressing high confidence in their ability to identify risks effectively. Organizations risk falling behind in their security postures without greater alignment between executives and operational teams.
Compliance is a Driver, But It’s Not Enough
Regulatory compliance remains a top priority – 59% of organizations cite it as a primary driver for risk management. ISO (51%) and GDPR (50%) were the most commonly followed compliance frameworks, followed by PCI DSS (45%).
However, a compliance-focused approach often leads to reactive security strategies that do not adequately prepare organizations for emerging threats. Only 11% of respondents reported prioritizing user behavior risk assessment, and 12% focused on adapting to new cyber threats.
This indicates that while organizations meet regulatory requirements, they lack the proactive measures needed to anticipate and mitigate evolving cyber risks.
The Shift Toward Risk-Based Strategies Gains Momentum
In response to these challenges, organizations are increasingly prioritizing risk-based strategies.
- Security teams ranked identifying vulnerabilities (7.06/10) and prioritizing them (6.15/10) as top priorities.
- Organizations are focusing on improving training (65%), streamlining processes (51%), and consolidating tools (47%).
- The timeframe for all this is the next 12 to 18 months.
This shift reflects a growing recognition that a proactive risk-based approach can enhance security resilience while maintaining compliance.
Metrics such as vulnerability patch rates (36%) and security violations (35%) are now being prioritized over traditional compliance violations (29%), signaling a move away from rigid compliance-driven security models.
The Path Forward: A More Unified, Proactive Security Approach
The survey findings indicate that organizations must rethink their security strategies to stay ahead of evolving threats. To strengthen their security posture, companies should focus on:
- Enhancing Risk Visibility – Investing in tools that provide real-time insights and a unified view of security risks.
- Bridging the Management-Staff Divide – Improving communication and collaboration between executives and operational teams to align security priorities.
- Reducing Tool Fragmentation – Consolidating risk management, compliance, and security tools to create a more streamlined approach.
- Shifting from Compliance to Risk-Driven Security – Moving beyond regulatory checklists to focus on dynamic threat evaluation and proactive vulnerability management.
Other News: Cyber Risk in 2025: Rising Threats, Stricter Regulations & Insurance Shifts(Opens in a new browser tab)
