1. Compliance – None of the regulations are going away, nor are the auditors being furloughed. Thus, you still have to comply, regardless of the horror show that is the organization’s balance sheet.
2. Attackers – It seems the attackers haven’t gone on vacation either. If anything, as things get tight they act more desperately to keep ill-gotten food on their table.
3. Breaches – Successful attacks continue to happen every day, and they need to be fixed. Again, this is not dependent on the economy, so enterprises will still have to clean up their messes.

Those reasons are plausible, but I still didn’t believe it. Though I kept seeing survey after survey saying everything was OK. I was starting to think maybe it was me that was crazy.

Thankfully we are starting to see some rationality happen and perhaps even some honesty from the folks that fill out these surveys. I’ll point to a survey done by my friends at MetroSITE Group (PDF of the survey), as well as some research done by Peter Kuper and the IANS folks. Both show spending going down and even deteriorating a bit.

You can peruse the results yourself and draw your own conclusions, but ultimately the laws of economics have not been repealed. When an organization tightens the belt, EVERYONE needs to tighten. Even us security folk. So what? Budgets are down, what do we do now? The optimists do make good points in that compliance isn’t going away and neither are attackers.

It gets back to the age old need to “Do More With Less.” And the only way to do that is to automate. That’s right, the only way to continue to 1) comply and 2) secure with 3) less budget is to figure out how all that computing horsepower can be brought to bear to analyze what’s happening in your environment, allow you to react faster to threats, and to document your controls when the auditor comes to party.

So even in a “down” market, there is still a lot of need for security and compliance management solutions.

Exhibit 26: In terms of ROI benefits, which types of initiatives will your organization fund in 2009?

Projects that will reduce operating expenses including personnel costs 72%
Projects that will drive top line revenue growth 59%
Projects that will meet compliance obligations 46%
Projects that will reduce future capital expenditures 33%
Source: Goldman Sachs IT Spending Survey.

So what does that mean? It means that it’s all about cost containment and that means it’s all about efficiency. Of course, the only way to gain IT-based efficiency is to automate your security and/or compliance activities (probably both).

That’s why a lot of folks (including eIQ) are going to be pretty focused on the ideas of security and compliance automation this year. That’s going to be one of the only ways to get projects funded.

So over the next week, I’ll be doing a series on cost containment here at eIQviews. We’ll focus on areas that are applicable for automation, as well as strategies for communicating these imperatives to senior management (that will eventually need to foot the bill) for any new tools for automation.