1. IDC MaturityScape: IT Security
Maturity Adoption Trends in New Zealand, 2015
Donnie Krassiyenko, IT Services Market Analyst
Adam Dodds, IT Services Research Manager
March 2015

2. Synopsis
© IDC Visit us at IDC.com and follow us on Twitter: @IDC 2
This study examines the MaturityScape of New Zealand IT security adoption as perceived by end-
users and profiles the New Zealand market by its maturity level and business demography.
It examines these traits in connection to aspects of end-user/vendor security engagement as
technology investment patterns, contract preferences, and budget plans for managed security and
business continuity/disaster recovery services (BCDR).
This study also compares New Zealand security trends with those in Australia and Asia/Pacific,
including reasons for security outsourcing and influence of security issues on IT vendor selection.
It is based on two IDC's surveys:
• New Zealand IT Services Ecosystem Survey 2014 (n=337)
• Asia/Pacific IT Services End-user Survey 2014 (NZ n=100, Australia n=100, APeJ n=1300)
"Attacks are now evolving from improvised origins to professionally managed sources that are well
funded and supported by cyber-research capabilities. Expenditure for IT security is challenged by the
rapid escalation of cyberattacks. The current spending on cybersecurity is insufficient as it has not
risen at a rate to match the rapidly expanding threats to IT networks. Adoption of IT security has a
complex market landscape and depends on more than segmentation by vertical and business size. In
this report, IDC New Zealand analyses the security market, looking at it from a maturity perspective."

3. Table of Contents
 IDC's IT Security MaturityScape....……...………….……………………………..............4
 IT Security Maturity Adoption Trends in New Zealand
 Assessed vs. Perceived Maturity………….………………………………………….....................5
 Analysis of Perceptual Gap ….……………………………………………………………..............6
 Maturity by Business Size.….…….……………………………………………….………………...7
 Maturity by Industry.….…………………………………….……………….………..………………8
 Use of IT Security: External vs. Internal.………………………………………................9
 Security Services Contract Preferences………………………………………………….10
 Budget Plans
 Managed Security...…………………………………………………...........................................11
 Business Continuity and Disaster Recovery Services...........................................................12
 New Zealand Technology Investment Shift
 Radar...………………………………………….........................................................................13
 Ripple Visualisation................................................................................................................14
 Security Analysis...………………………………………………….............................................15
 Essential Guidance
 For Technology Buyers........….……..…………………....……………………………………….17
 For Service Providers........….……..………………………....………………………………..….18
 Read More: Related Research...….……….….….….…………………….....................20
3

4. 4
About IDC’s IT Security MaturityScape
Question: For IT Security, please indicate the level of your company’s use?
New Zealand organisations are maturing quickly in the adoption of the core categories of the 3rd platform (Mobile, Cloud, Social and Big Data) coupled
with the requirements of Security. Establishing a framework for understanding an organisations maturity is important as size and industry analysis are
normalising and provide only a partial view of the picture. Maturity has two categories:
 Assessed view of maturity – This is where IDC assesses the organisation’s adoption of IT Security. It is quantitative in nature and is subject to a
number of IDC assumptions.
 Perceived view of maturity – The organisation provides a view of where they perceive themselves to be in the adoption process of IT Security. It is
qualitative in nature and is subject to respondents’ bias.
The difference between organisations’ assessed position and their perceived positions, as shown above, is important as it provides a framework for road-
mapping the organisation and service provider engagement. Organisations often have a higher perception of their maturity than the assessed. Often
service providers treat the organisation based on the organisations self-perception and this creates an expectation/perception gap. The graph shows how
New Zealand organisations overestimate their adoption of security. Analysis on the next page provides a deeper insight into the current situation.
Ad Hoc Opportunistic Repeatable Managed Optimised
Assessed Maturity
Perceived Maturity*
Source (assessed): IDC New Zealand IT Services Heatmap 2014
Source (perceived): IDC New Zealand IT Services Ecosystem 2014 (n=337)
IT Security Maturity Adoption Trends in New Zealand
Assessed View vs. Perceived View
*Note: 18% of respondents didn’t manage to identify their perceived maturity level and, thus, are excluded from the graph.

5. 5
Questions: What are the top services that currently help your organisation’s IT needs? As part of your business objectives, are you looking to invest in any of the
following solutions over the next 12-24 months?* By perceived maturity stage of security.
The circles below represent visualisation of the investment radars from the previous slide; they are clustered by current/future-oriented focus and security layers. The
best way to read this graph is to compare colour differences between the left and the right circles and note how, for instance, DaaS/WaaS lost its positions over the
time, while Mobility gained significant interest across all maturity layers. Security-related implications of this shift are discussed in the following slides.
Technology Investment Shift: Ripple Visualisation

6. About International Data Corporation
International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the
information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business
executives, and the investment community make fact-based decisions on technology purchases and business strategy. More
than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in
over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business
objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company.
IDC New Zealand
Level 11, 203 Queen Street
Auckland, New Zealand
+64-9-377-0370
Twitter: @IDC
idc-insights-community.com
www.idc.com
Copyright Notice
This IDC research document was published as part of an IDC continuous intelligence service, providing written research,
analyst interactions, telebriefings, and conferences. Visit www.idc.com to learn more about IDC subscription and consulting
services. To view a list of IDC offices worldwide, visit www.idc.com/offices. Please contact the IDC Hotline at 800.343.4952,
ext. 7988 (or +1.508.988.7988) or sales@idc.com for information on applying the price of this document toward the purchase
of an IDC service or for information on additional copies or Web rights.
Copyright 2015 IDC. Reproduction is forbidden unless authorized. All rights reserved.
6
CONTACT US:
Donnie Krassiyenko
Market Analyst
IT Services
dkrassiyenko@idc.com
Adam Dodds
Research Manager
IT Services
adodds@idc.com
© IDC Visit us at IDC.com and follow us on Twitter: @IDC