Our research security teams are working on everything from printers, laptops, in cloud environments.  They’re doing research in social, mobile and artificial intelligence looking into the future.  We’ve got an amazing insight across all these pieces of technology and that includes things that nobody has seen yet.  That’s the product of all this engineering and research that is always going on and part of our mindset of global intelligence, global reach and capability because attackers are also operating globally.

SA: A lot of companies ‘get it’ when it comes to security.  However we know that there’s still many that have a way to go, battles that have to be won in the board room, at the C-level.  Where are we in the industry as far as making a compelling business case in these situations?

Kawalec: Security really needs to be driven through leadership.  We need to change the responsibility first, starting at that board level and it’s something that has to be driven by very clear objectives.  That conversation starts with the definition about who is responsible for risks and security.  Clarity is vital.  From there you are able to building an organization-wide response.  Take for example, in today’s culture speed to market is a defining factor in business success, but security needs to be a big part of that.   The business discussion around these initiatives should be a million miles from simply buying a firewall and laying it all on that product.  Security needs to step out of the shadows.  It’s a discussion that has so much tremendous value because if it feels that your organization is mature in its security and taking the right steps, that’s not only a great achievement, but it’s one you can be proud of.  If your organization is hampered by attacks and not knowing what is going on or how to deal with it, well you have an opportunity there to start to be transparent about things, that’s when a turnaround can start.

Recent research shows 43% felt that information risk was something that making them less agile.  It should be obvious that organizations that succeed are more agile and security goes with that.  As far as technology investment, we would like to that move some levels up the stack away from network world, computers, servers, and actually move to a client focus.  That’s another way to create change.  Even creating greater security strength to security operations leaders.  We also like the direction of things shifting to threat detection strategies, analyzing anomalies as it relates to cloud environments as well.

Leaders in 2014 and beyond will emerge as they take up security responsibility and execute from the right business levels.  As far as change that comes from the board room, if they are able to stand up make the security case while maintaining scalability, control and enablement, that’s a winning proposition all the way around.  This means that budget constraints and building from a compliance standpoint will be less of a detriment.

SA: Any other giant threats you see out there?

Kawalec:  It’s interesting, our Fortify team has been doing a bunch of incredible research and work on smartphone and mobile apps.  I was quite shocked to see the latest findings that recognized as many as nine out of ten applications have significant security vulnerabilities – and this was a very large sample.  Additionally, it turned out that the problems were in some very basic elements like how information and data was transported, architecture, languages that were used, and other software flaws.  Enterprises will be facing a growing responsibility to deal with that.  It’s something that Fortify is leading the charge in striking a balance to deal with it.  This will be a big topic.