Forrester Research Highlights Persistent Breach Risks Despite Rising Security Budgets New findings from Forrester reveal that while organizations are increasing investments in security and privacy programs, breach frequency remains stubbornly high. Over the past 12 months, two-thirds of enterprises reported at least one breach, with 67% of security decision-makers confirming sensitive data was compromised despite expanded defenses. The research identifies several key challenges driving this disconnect. External attacks, insider incidents, and supply-chain vulnerabilities continue to dominate breach causes, while rapid AI adoption introduces new risks. Nearly 30% of respondents prioritize improving AI governance, and 28% are developing frameworks to assess privacy risks from generative AI systems. However, security and privacy teams often lag behind deployment, creating gaps in oversight as AI-driven automation and data flows expand without consistent controls. Detection and response remain critical focus areas, with 31% of security leaders naming it a top priority. Identity and access management (IAM) also sees growing investment, with employee IAM rising from 22% to 25% year-over-year and customer IAM increasing from 21% to 24%. Yet operational hurdles such as visibility gaps, alert fatigue, and tool complexity limit the effectiveness of these efforts. Executive engagement in security and privacy is improving but remains uneven. Over a third of enterprises now include their Chief Privacy Officer at the executive table, with 22% reporting directly to the CEO and 17% to the board. Meanwhile, 31% of CISOs report to the CEO or president, and 10% directly to the board. However, only 15% of organizations prioritize formal board-level communication on security risks, leaving many with oversight structures but limited strategic discussion. Cloud complexity further complicates security operations. With 63% of public cloud decision-makers planning to increase their number of providers, organizations face fragmented policy frameworks, identity architectures, and monitoring tools. Despite this, only 19% prioritize consolidating their security technology stack, suggesting most will continue integrating more tools rather than streamlining them. Forrester’s findings paint a picture of rising ambition in security and privacy, offset by persistent execution challenges including legacy vulnerabilities, AI-related risks, and an expanding supplier footprint. As budgets grow and leadership visibility improves, breaches remain a near-certainty for many enterprises.

The Vermont Office of the Attorney General reported a data breach involving Forrester Research on July 27, 2023. The breach, which involved the vendor Pension Benefit Information, compromised names, dates of birth, social security numbers, and resident states/zip codes of impacted employees, while no personal health information was accessed. Approximately UNKN individuals were affected, and the breach was connected to a vulnerability in the MOVEit Transfer software exploited by cybercriminals.