Ask the 11 alleged hackers charged in August with breaking into TJX and other retailers by way of insecure Wi-Fi. Forty million credit and debit card numbers were stolen. Ask the Medicaid claims processor at the outsourcer EDS. In February she pleaded guilty to stealing Social Security numbers and dates of birth, and selling them for use on fake tax returns. Ask the courier hired by the University of Utah Hospital to take backup tapes to offsite storage. One day in June, he used his own car instead of his company's secured van. The tapes, containing billing data for 2.2 million patients, were stolen from his front seat.

Or you could, as we did, ask 7,097 business and technology executives worldwide about their security troubles. In this, our sixth year of conducting the "Global State of Information Security" survey with PricewaterhouseCoopers, we got an earful about the challenges, worries and wins in security technology, process and personnel.

Quantifying returns on information security projects can be a struggle, often because it's hard to put a dollar value on a crisis averted. This year, a bad economy forces decision makers to squint even harder at proposals. Even so, survey results show companies are buying and applying technology tools, including software for intrusion detection, encryption and identity management, at record levels. That's pretty good news.

However—and this is serious, folks—too many organizations still lack coherent, enforced and forward-thinking security processes, our survey shows. While 59 percent of respondents said they have an "overall information security strategy," that's up just two points from last year and it's not enough, says Mark Lobel, advisory services principal at PricewaterhouseCoopers. Two elements, Lobel says, correlate with lower numbers of security incidents: having a C-level security executive and developing the aforementioned security strategy. But disappointing numbers piled up this year. (For additional stats see "The Global State of Information Security.")

For instance, 56 percent of respondents employ a security executive at the C level, down 4 percent from last year. You comb network logs for fishy activity, but just 43 percent of you audit or monitor user compliance with your security policies (if you have them). This is up 6 percent from 2007, but still "not where we need to be," Lobel says.

As a result, security is still largely reactive, not proactive. More-sophisticated organizations will funnel data from network logs and other monitoring tools into business-intelligence systems to predict and stop security breaches. So along with encryption fanatics and identity management experts, an infosec team needs statisticians and risk analysts to stay ahead of trouble and keep the company name off police blotters.