Cyber security has become an increasingly important issue in the financial services sector and the world at large. However, as risks continue to rise, an alarming number of companies are not taking these threats into account as they should. According to an Ernst & Young study, only 22% of organizations are taking information security consequences into account when considering strategic plans. In addition, only 5% have undergone changes to strategies based on perceived exposure to elevated risk.

Perhaps part of the problem is that companies are relying too heavily on their resources, with more than 80% doing their own incident investigation and 83% doing their own threat intelligence analysis. Additionally, 64% of companies are doing their own penetration testing.

Even with these practices in place, there is still not enough emphasis put on information security, especially in terms of executive personnel, as 75% of responders in EY’s survey admit that there are no representatives of the information security team on the board. This can cause reporting to become too broad and downplay the threat level a company could be facing.

This is especially true considering many companies don’t feel that their information security systems are as up to date as they could be. According to EY’s survey, less than 50% of responders would rate their software security, security monitoring, incident management and identity and access management systems as “mature.”