LONDON—November 8, 2023 — Vanta, the leading trust management platform, today released its annual State of Trust Report, an in-depth analysis uncovering global trends in security, compliance and the future of trust. Despite their best efforts, nearly two-thirds of UK businesses (66%) say they need to improve security and compliance measures with one in four (25%) rating their organisation's security and compliance strategy as reactive.

UK businesses today are navigating an unprecedented security landscape. The expansion of attack surfaces in a post-pandemic hybrid world, combined with shrinking teams and budgets and the rapid rise of Generative AI, are fueling an urgent need for companies to improve — and prove — their security posture. Despite this, according to Vanta's findings only 9% of the average UK company's IT budget is dedicated to security.

For companies of all sizes, limited risk visibility and resource constraints make it challenging to improve their security. Fewer than half (42%) of UK organisations rate their risk visibility as strong. Meanwhile, 21% have downsized IT staff and 62% have either already reduced IT budgets or are planning to as they continue grappling with the challenging global economic environment.

Conducted by Sapio Research on behalf of Vanta, the State of Trust 2023 Report surveyed the behaviours and attitudes of 2,500 business leaders, including the 500 in the UK, as well as respondents across Australia, France, Germany and U.S. to understand the challenges and opportunities they're facing when it comes to security and trust management.

The security improvement imperative

With rising risk and shrinking resources, the message is clear: businesses need new methods to improve their security. Compounding the urgency is ever-evolving global regulation and the growing time-suck of complying with an increasing number of standards. In an environment where customers want more insight into a company's security practices, organisations are at an impasse.

Two-thirds (67%) say that customers, investors and suppliers are increasingly looking for proof of security and compliance. While 37% provide internal audit reports and third party audits, and 39% complete security questionnaires, one in eight (12%) admit they don't or can't provide evidence when asked. That means UK companies are falling at the very first hurdle – costing them potential revenue and growth opportunities in new markets. Additionally:

• The average UK leader spends on average 7.5 hours per week – more than 9 working weeks a year – on achieving security compliance or staying compliant.
• The two biggest barriers to proving and demonstrating security externally are a lack of staffing (33%) and lack of automation to replace manual work (30%).
• Only 10% of UK businesses' IT budgets are dedicated to security, with 1 in 3 leaders saying their IT budgets are continuing to shrink. 
• Identity and access management and data processing that doesn't comply with regulations are the two biggest blind spots for UK organisations. 
• Over half (57%) are concerned that secure data management is becoming more challenging with AI adoption with 55% saying that using Generative AI could erode customer trust.

Despite all countries continuing to grapple with the unique set of security and compliance challenges, the survey findings illustrate the vast differences experienced across timezones:

• UK leaders are more concerned with keeping up to date with evolving regulations than any other market.
• Leaders in the U.S. are most likely to delay entering new markets due to compliance requirements, admitting they're not prioritising compliance due to the financial investment.
• Respondents in Australia are the most concerned about generative AI's potential impact on customer trust.
• Germany has the strongest visibility into security risks of all markets, with 47% saying they have 'strong' or 'very strong' sight of risks'
• 76% of leaders in France say they need to improve security and compliance, the highest of all markets.
• Organisations in Australia are least likely to be able to provide proof of compliance to customers. 
• Companies in the U.S. believe they could save at least 3 hours a week by automating security and compliance tasks – the highest of any country.

The trust management tipping point

Ultimately, better security improves efficiency, builds trust and boosts the bottom line. 68% of UK leaders say that a better security and compliance strategy positively impacts their businesses thanks to stronger customer trust, while nearly three in four (73%) agree that a better security and compliance strategy would make them more efficient. 

An overwhelming 83% of UK businesses have or plan to increase their use of automation, particularly for reducing manual work and streamlining vendor risk reviews and onboarding. All in, respondents believe they could save at least two hours per week – over 2.5 working weeks a year – if security and compliance tasks were automated. 

"The business case for trust management is undeniable," says Christina Cacioppo, CEO, Vanta. "For companies at the forefront of disrupting the security status quo, centralising processes, automating compliance and accelerating security reviews can turn trust into a truly marketable advantage. By closing the loop on the security lifecycle from compliance through continuous monitoring and communication, businesses can transform how they build trust and ultimately unlock growth."

The future of trust in an AI World

Automation and Generative AI are top of mind for IT and business decision makers with 78% of UK business leaders already or planning to use AI/ML to detect high risk actions. But the risks of Generative AI without guardrails can't be denied. For larger organisations, nearly 6 in 10 (56%) leaders say regulating AI would make them more comfortable investing in it.

When done right, AI has an undeniable power to accelerate security workflows and transform trust. UK respondents believe the biggest potential of AI will be improving the accuracy of security questionnaire responses (43%), eliminating manual work (43%), streamlining vendor risk reviews and onboarding (33%), and reducing the need for large teams (34%).

On December 5, Vanta will host VantaCon: The Future of Trust in an AI World. Bringing together the foremost experts on the intersection of AI and trust, VantaCon speakers include Christina Cacioppo, Aaron Levie, Nat Friedman, Andrew Reed, Sarah Guo, Harrison Chase, Eric Newcomer and much more. To learn more, visit https://vantacon2023.com.

About Vanta

Vanta is the leading trust management platform that helps simplify and centralise security for organisations of all sizes. Over 6,000 companies including Atlassian, Autodesk, Chili Piper, Flo Health and Quora rely on Vanta to build, maintain and demonstrate their trust—all in a way that's real-time and transparent. Founded in 2018, Vanta has customers in 58 countries with offices in Dublin, New York, San Francisco and Sydney. For more information, visit www.vanta.com.

Press Contact

press@vanta.com