In a recent study about spyware by Nemertes Research, Senior Vice President Andreas Antonopoulos was surprised to find that 16% of the companies examined were not concerned about the threat.

Suspecting that was because they were small companies, he dug deeper, but found they were some of the largest companies analyzed. He also discovered why they weren't concerned: they spent 6% to 8% of their IT budgets on security, twice what the average company spends.

Having shared this finding at the beginning of his presentation on security at the recent Network World IT Roadmap conference in Boston, you would presume he spent the rest of the session beseeching buyers to go back and beat on the door of the executive suite demanding more dough.

But Antonopoulos - a Network World columnist - is a pragmatist and realizes most companies don't have that option. And time and again he reminded the crowd that technology is not always the answer to every new threat.

"What is a secure company?" he asked the audience. "It is not one that doesn't get breached. It is one that notices the breach, analyzes it and responds."

And that requires process as often as technology, he said. "Don't buy that shiny new box. Spend the money on operational skills."

He also warned the audience to carefully take into account the ancillary costs of technology. Managing an intrusion-prevention system (IPS) around the clock will require the addition of five people, he said, at a minimum cost of $750,000 per year. "If you don't have people and processes in place to manage the IPS, don't buy it. Invest in policy and education instead."

Part of the problem, Antonopoulos said, is too often technical people reach for the latest technical answers to new problems, even when the tech du jour doesn't address the problems that represent some of the biggest threats.

As evidence, he asked the crowd how many were aware of the problems represented by insider threats. Virtually everyone raised their hands.

Then he asked how many would say their spending priorities reflected that knowledge. Not a single hand went up. "Oh dear," Antonopoulos said. "That's the problem. We're focused on the flashy stuff."

As further evidence, Antonopoulos said surveys show that less than 30% of companies bother to collect audit logs. "Audit logs are a treasure trove of information that goes untapped. They can help address everything from compliance, to troubleshooting, forensics and insider threats."