Conclusion
This year's findings reveal a growing disconnect between confidence and preparedness. As organisations contend with evolving threats, persistent security weaknesses and increasing pressures, the fundamentals of governance, accountability and resilience remain critical.
Conclusion
UK and US information security professionals share many of the same challenges as their global peers. While headline writers obsess over advanced, multi-stage attacks and cutting-edge AI, a great deal of the security challenges they face are actually closer to home. They come in the form of commoditised threats like phishing, and issues stemming from governance gaps.
Supplier weaknesses, misconfigurations and basic control failures don’t grab many headlines. But they chip away at resilience and allow risk to multiply. As do the blind spots that unmanaged AI creates.
In the meantime, the cost to organisations continues to grow. Yet accountability at the very top is often absent. Clearer ownership can’t magically make an organisation more resilient overnight. But greater board-level engagement and awareness can move things in the right direction.
The priority should be to break down those traditional silos between information security, privacy and AI governance, and focus on best practices. Standards like ISO 27001 can help with things like defining responsibilities, testing plans, documenting processes, establishing reporting channels and lessons learnt.
A plurality (32%) of respondents say that the biggest benefit of compliance programmes like this is time savings from more efficient security processes. They also provide a structured way to establish governance, ownership, and accountability for specific risks.
By combining ISO 27001 with other best practice standards, organisations can tackle the fragmentation of GRC work which diminishes resilience. ISO 27001 compliance demonstrates that risks to information are identified, treated and managed; ISO 27701 proves personal data is handled lawfully and protected; and ISO 42001 establishes that AI systems are governed, transparent and accountable. ISO 22301 can be used to provide assurance that critical operations can keep running through disruption. All help organisations provide proof of resilience to regulators, auditors and customers.
Programmes should be followed in a continuous loop, rather than a periodic race for evidence that’s outdated almost as soon as it’s collected. When evidence is collected and drift continuously remediated, compliance becomes a byproduct of good operational security and resilience, not a box-ticking exercise. That’s something all organisations can work towards.
But standards compliance isn’t a silver bullet. The truth is that controls sometimes drift away from their secure baseline, undermining what looks like a comprehensive security strategy on paper. That’s why programmes should be followed in a continuous loop, rather than a periodic race for evidence that’s outdated almost as soon as it’s collected. When evidence is collected and drift continuously remediated, compliance becomes a byproduct of good operational security and resilience, not a box-ticking exercise. That’s something all organisations can work towards.
Sam Peters, Chief Product Officer, IO
Closing the gap between ambition and action
One of the most revealing findings in this year’s research is the difference between how organisations believe they are managing risk and what they can actually see and demonstrate.
Nearly three-quarters of respondents say they manage information security, privacy and AI as one connected system. Yet only 13% have a single, current view across all three, and fewer than one in five report having one clear line of accountability. That’s a considerable gap between ambition and operational reality.
From a product perspective, these findings reflect challenges we hear about regularly. Organisations are dealing with overlapping regulations, multiple frameworks, growing supplier networks and new technologies. Yet the information they need is often scattered across different systems, teams and processes. Our research finds that security and compliance teams spend an estimated 31% of their time proving compliance rather than improving security. That’s valuable time that could be spent managing risks and strengthening resilience.
Addressing these challenges is central to how we’ve built IO. Our platform connects information security, privacy and AI governance, bringing risks, controls, responsibilities and evidence together. By reducing duplicated effort, supporting continuous compliance and reducing the workload of repetitive tasks, we help organisations maintain oversight while keeping human judgement and accountability central to decision-making.
And we’re ambitious about building on that foundation. We want to continue making connected governance more effective, accessible and responsive to the needs of the organisations we support. Because businesses should be able to understand their risks, demonstrate assurance and make informed decisions with confidence, as part of everyday operations rather than simply preparing for the next audit.
Addressing these challenges is central to how we’ve built IO. Our platform connects information security, privacy and AI governance, bringing risks, controls, responsibilities and evidence together. We help organisations maintain oversight while keeping human judgement and accountability central to decision-making.
Sam Peters
Chief Product Officer, IO
