The differences between that place and the place most people are today is pronounced. Start with money. Financial services companies have bigger security budgets, but not necessarily bigger vis-¿is the overall IT budget. To whatever extent these companies are more secure than the average company, that superiority can be attributed to more efficient spending, and spending on strategic planning, not technology. One simple example of this is investment in network firewalls. It was the fifth most cited strategic priority for next year with all respondents, but it doesn’t even make the top 10 with financial services companies. Same for data backup, which is number three overall but noton financial services companies’ radar. These companies have these important technologies in place but also seem to have shifted priorities, perhaps understanding that more technology doesn’t mean more security. (The one type of technology financial services companies do seem to be investing in is identity management—not surprising as a reaction to the ID theft epidemic.)

On the other hand, the banks were far more likely to have listed compliance testing as a priority for next year compared with the overall respondent base. You should anticipate this happening to your company, and start preparing sooner rather than later, as regs—including the big ones such as Sarbanes-Oxley, but also local ones such as California’s 1386 law and whatever new regs come out of the current identity theft pandemic—start to take hold and you have no choice but to do compliance testing.

And just because the financial companies seem to be more strategic doesn’t mean they shy away from using threats to justify investments. While financial companies are slightly more likely to use ROI and contribution to business objectives as justifications for security investments, they are still far more likely to rely on legal and regulatory requirements, liability and revenue impact to justify their investments. Interestingly, half of all financial services respondents said “common industry practice” was one justification for security investments—suggesting either some level of information sharing amongst companies in the industry, or at least a copycat culture where many security executives try to keep up with the good security Joneses.

One area in which the financial services sector doesn’t seem to outperform the rest of the respondents is integration with physical security practices. Watching the year-over-year numbers next year in this area will be important given the number of high-profile data thefts that used physical security weaknesses—or at least the disconnect between the information security practices and physical security practices—to gain access to personal records.