Companies are increasingly developing information security strategies, yet they face growing obstacles from insufficient data and limited executive support. These findings emerged from viewer polls conducted during the AM Live broadcast titled “Information Security Strategy: Why It Is Needed and How to Defend It.”
During the discussion, experts examined how businesses should align security strategies with corporate objectives, define risk appetite and unacceptable events, distinguish a genuine strategy from a procurement list, and demonstrate value to leadership. Yaroslav Napalkov of MTS Bank shared a case in which presenting the strategy to top management provoked aggression and advised first establishing context. Nikolay Kazantsev of Securitm recommended that newcomers conduct “three cups of coffee” conversations with the CEO, IT teams, and other stakeholders.
Participants also addressed planning horizons of two to three years with annual updates, the role of backups and cyber drills, and practical cases involving ransomware, BYOD, DLP, and SOC construction. Over the past year the proportion of companies developing a strategy grew from 9% to 28%, while those with no plans at all declined from 26% to 21%. However, fewer organizations reached a fully operational document containing metrics and cyber exercises—16% versus 20% previously.
Barriers have also evolved. The share of respondents citing lack of исходных данных rose from 46% to 64%, and absence of top-management buy-in increased from 25% to 43%. Although personnel shortages remain the primary constraint, the figure eased to 59%. Nikolay Kazantsev noted that only 15–20% of security services maintain even a basic formalized risk register.
The leading objective for 2027—reducing risks and financial damage—was named by 78% of participants, a 23-percentage-point increase. Second place went to resilience and minimizing downtime of critical services at 57%. Natalya Glinina of Megafon Pro Business described this focus as logical because financial damage constitutes an unacceptable event that can halt business operations. Regulatory compliance stayed steady at 59%, while optimization of TCO and stack consolidation lost popularity, falling to 8% from 14%.
