The Security Benchmark Report respondents were asked about their top issues / concerns in 2022 and 2023 in regards to risk mitigation and enterprise security. The top 10 answers appear here in order. Honorable mentions include Theft, Security budget, and Natural disasters. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked where their security function reports to or resides within. The majority of security teams responding to this year’s Security Benchmark Report report to or reside within COO / Operations, followed closely by CRO / Risk / Legal / General Counsel. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked to choose the title of their senior-most security executive within their enterprise. The choices, which are not exhaustive, are meant to generally group titles for comparison and include: C-Level Executive, Director, Senior Director, Senior Manager, Vice President, General Manager or Not Applicable (N/A). Among those choosing N/A were Police Chiefs, Managers and Supervisors. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked to report which geographic areas their security organization provides risk and security services to within their enterprise. Respondents were able to choose as many geographic areas as applicable. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked if their security organization is Centralized, Decentralized or Regional. The majority of respondents reported their security organization as being Centralized. For this survey’s purpose, the distinction between Decentralized and Regional security is that some Regional security programs may behave in a centralized manner for their determined region, while Decentralized generally means there may be security organizations in multiple locations within an enterprise functioning independently from one another. Those respondents choosing Other reported working in single sites or a Partially Centralized and Partially Decentralized structure. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were given a list of 37 roles and responsibilities that may fall under the security function at an organization and were asked for the level of responsibility the team has over that role within their enterprise. Here are the 15 most common job responsibilities (in alphabetical order) that the security function Owns / Leads or Manages, according to respondents. For this survey, Owning / Leading the responsibility means security both manages and funds the program, while Managing means security manages the program, but another group funds it. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked to report on the security team’s roles and responsibilities within their organization. This year, we asked security leaders for the level of responsibility for each function within their organization with the following choices: Own / Lead Function: Security manages and funds the program; Manage: Security manages the program but another group funds it; Support: Security sets policy, consults on the program (or represents physical security perspective) but does not manage or fund the program; Not Involved: Company has the program but security is not involved in it; Do Not Have; Do Not Know. We have combined Not Involved / Do Not Have or Do Not Know responses for the purposes of this chart, however, 17 more responsibilities and breakdown of responses, in addition to those reported here, are included in the survey and are a part of the full report that respondents receive. One interesting note is that comparing COVID-19 responsibilities with 2021’s responses reveals a smaller number of respondents this year reporting Owning / Leading and Managing COVID-19 response, while a slightly higher percent report Supporting the efforts. One possible explanation could be that, now a few years into the pandemic, organizations have hired or diversified response efforts to in order to sustain pandemic efforts in the long term. SOURCE: The Security Benchmark Report, November 2022

SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked what security checks/testing the organization conducts as part of preemployment screening. Respondents were allowed to indicate as many answers as applicable to their organization. Respondents were also able to choose Other (10%) or Don’t know (3%). The Don’t know answer is meant to give other security organizations knowledge into the roles / responsibilities / maturity of other security programs. For this question, other forms of screening indicated by respondents included education verification, media checks and DMV checks. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents are responsible, at least in part, for physical security within their organization. We asked survey respondents for more insight into the ever-evolving and changing roles of security, including whether their role within the organization is ultimately responsible for both physical security and health & safety, as well as physical security and cybersecurity. In 2021, only 14% of The Security Benchmark Report respondents reported being responsible for both physical security and cybersecurity, translating to a 57% increase in this year’s report. In 2021, 51% of respondents reported being responsible for both physical security and health & safety, translating to a 10% increase in this year’s report. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report captures information on security budgets and total reported revenue / operating budget in the overall organization. To calculate the security budget as a percentage of revenue across the enterprise, the security budget is divided by the total revenue. Companies that reported information on both security budget and total revenue are included in this number; however, if any numbers appeared inaccurately reported or incorrect, they were removed from the calculation. SOURCE: The Security Benchmark Report, November 2022

Here is the average security budget as a percent of revenue by market sector. To calculate the security budget as a percent of revenue across the enterprise, the security budget is divided by the total revenue. Companies that reported information on both security budget and total revenue are included in this number; however, if any numbers appeared inaccurately reported or incorrect, they were removed from the calculation. SOURCE: The Security Benchmark Report, November 2022

A majority of The Security Benchmark Report respondents reported an increased security budget compared with the previous year’s budget. In 2021, 66% of respondents reported an increased budget that year, while this year 69% of respondents reported an increased security budget year-over-year. SOURCE: The Security Benchmark Report, November 2022

If The Security Benchmark Report respondents indicated an increased security budget in 2022 compared with 2021, they were asked what percentage that budget increased. The average increase reported by those respondents for 2022 was 19%. If respondents indicated their security budget in 2022 decreased compared with 2021, they were asked for the percentage decrease. The average decrease reported by those respondents for 2022 was 11%. In 2021, the average increase in security budget was 14% and the average decrease in security budget was 21%. SOURCE: The Security Benchmark Report, November 2022

Of those The Security Benchmark Report respondents that reported using guard / officer forces at their organization, 34% of security leaders reported using both proprietary and contract officer / guard forces, while 33% reported having only proprietary guards and 33% reported having only third-party / contract guards. SOURCE: The Security Benchmark Report, November 2022

Overall, 68% of The Security Benchmark Report respondents reported having a security operations center (SOC) or global security operations center (GSOC) within their enterprise. Respondents that answered “Yes” to having a SOC were asked if their SOCs provide security and risk services to the entire enterprise or just a particular region or site. Overall, among all sectors, 88% of respondents that reported having a SOC offer those services to the entire enterprise. SOURCE: The Security Benchmark Report, November 2022

Among the 68% of The Security Benchmark Report respondents that reported having a global security operations center (GSOC) or security operations center (SOC), Security magazine asked respondents which services their SOCs provide to the enterprise, represented in the bar graph here. Respondents were able to choose as many responses as applicable. SOURCE: The Security Benchmark Report, November 2022

Here is the average money spent on security-related training by sector, based on self-reported information from The Security Benchmark Report respondents. Outliers or information that appeared to be inaccurately reported were excluded from these calculations SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked to report the security-related training they held within their enterprise in 2021. Respondents were able to choose multiple populations for each training if applicable. For example, with Workplace violence, some organizations implemented training for both security staff as well as targeted cross-functional groups. Respondents were allowed to report using as many training types as applicable. “Not Applicable” refers to those organizations that did not implement that type of training in 2021. In addition to these responses, respondents were able to choose “Other.” Some of those responses included: Active shooter; De-escalation; Crime prevention; AED/CPR training; Behavioral threat assessment; Diversity, equity and inclusion (DEI); Drug diversion awareness; COVID-19 protocols; Zero harm initiative for EHS; Suspicious indicators; Suspicious packages; Taser and firearm; Female travelers; Travel security; and Mental health. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked how much their organization plans to spend on electronic physical security systems and services this year. Respondents were asked to choose the range that best describes their planned spending. SOURCE: The Security Benchmark Report, November 2022

The Security Benchmark Report respondents were asked which physical and / or electronic security systems and equipment their enterprise currently has in place. Respondents were able to choose as many systems as applicable. Respondents were also allowed to say which “Other” security technologies they have implemented in their enterprises, and some of those include: weather notification; mobile phone incident reporting application; thermal cameras; physical access control systems; K-9 detection; license plate recognition; shooter detection; or duress. *Two-way radio systems are included here if reported for security personnel only. SOURCE: The Security Benchmark Report, November 2022

Security Teams Emphasizing Metrics to Define Productivity

These security programs report maintaining a metrics program that clearly defines productivity, value creation and cost avoidance.

The below list (in alphabetical order) are those security leaders that reported maintaining a security metrics program that defines productivity, value creation and cost avoidance. Respondents are allowed to remain anonymous from any listings or rankings within the published The Security Benchmark Report; therefore, any respondents choosing to remain anonymous are not included in this list. SOURCE: The Security Benchmark Report, November 2022

*at time of publication