Almost all (98%) CISOs plan to spend money on secure access service edge (SASE), and 55% of them intend to prioritize 25% to 75% of future IT security budgets on it, according to Cisco’s latest CISO Survival Guide.

Cisco released the 2021 report, which surveyed more than 100 CISOs and security leaders, this week. The biggest shift for CISOs this year is toward SASE, following the pandemic and related trend of working from anywhere in the world, said Dug Song, chief strategy officer at Cisco Secure.

“I think hybrid work is here to stay,” Song told SDxCentral in an interview. Most organizations have decided to maintain flexible work for employees even post-pandemic, which requires changes to their IT security programs. 

CISOs now have to “think about how they bring more security to where their people are, instead of moving their people to where the security is,” Song said, adding that this “shift is one that I think is quite different because it's a direct move to cloud delivery of security.”

According to the report, 98% of respondents see clear benefits of SASE, including a context-aware state, adaptability, and continuous access. 

When first seeing this “super-high” percentage, Janey Hoe, VP of Cisco Investments, requested to see the report for details. However, “it's not surprising it is the top line for the CISOs,” she said in the interview. Because SASE is still a relatively new security architecture, respondents are at different stages of the SASE adoption process and implementing zero trust technologies, cloud firewalls, and other security tools. 

In this second edition of the CISO Survival Guide to Emerging Trends from the Startup Landscape, Cisco deconstructed four major trends in cybersecurity: SASE, privacy and compliance, DevSecOps, and security automation.

According to the report, 42% of survey participants said zero-trust network access (ZTNA) was their top spending priority within SASE, while 44% reported that data access control is their top privacy concern. Meanwhile, 93% of CISOs reported facing challenges in bringing a governance focus into app development. And 60% see the network as the most difficult to inventory. 

The data center is now the cloud, which means data is everywhere, so access control is going to be much more sophisticated challenge than it’s ever been, Song said. “Customers need help with a program of governance and the technologies that allow them to do what they used to do right within the four walls of their building.” 

He explained that zero trust is fundamentally about “​​knowing who and what is accessing your data in the right way at the right time.” 

It’s the age of access and data, Hoe echoed. Not only is access control providing better security, vendors such as Cisco Duo also are trying to make it less interruptive for users.

Cisco acquired Duo Security, which provides multi-factor authentication, for $2.35 billion in 2018. And as part of this charge to make security less interruptive, earlier this year Cisco Duo rolled out passwordless security. 

As CISOs change their perspective around file security, and look to integrate artificial intelligence (AI) into risk management and data production, AI and machine learning (ML) become key technologies for CISOs, according to Hoe and Song.

Another change over the last year: The volume of the security startup landscape has turned up, according to Cisco. During the pandemic, security concern and needs fueled the market. Capital flowed in, and companies stayed private longer. Even the early-stage companies saw “a tremendous increase in activity from investments to the volume,” Song said.

Security is a dynamic problem and constantly involved. Last year, in particular, more startups spun up covering a whole spectrum of topics, Hoe added. 

In Cisco’s report, 99% of respondents said their organizations were open to working with a security startup, but 56% of them don’t have a formal assessment process.

Buyers tend to follow venture capitalist firms and reputable investors like Cisco, while more and more of them “want to try before they buy.” And increasingly, startups demonstrate value by building communities around their technologies, Song said.

As an advisor in mergers and acquisitions processes, Song, in a blog post, said he looks for certain qualities in every company. These include how its vision aligns with customers’ priorities and operational realities, and whether a startup is dedicated to building an inclusive workplace. Additionally, he said it’s important to understand how they adapt to and lead in competitive markets.