Written by Jess Munday.

Trust is critical to the success of every business. And in 2024, we saw that building, scaling, and demonstrating trust is getting more difficult for organizations.

Vanta’s second annual State of Trust Report uncovered key trends across security, compliance, and the future of trust. Based on a survey of 2,500 IT and business leaders in the U.S., UK, and Australia, our research found that more than half (55%) of organizations say that security risks for their business have never been higher.

‍In 2025, security leaders will need to address complex threats, a growing compliance burden, and increasing risk from their third-party vendor footprint. The rapid adoption of AI technologies only adds to the challenge, requiring more oversight and governance.

‍Here are five key trends to consider as you scope your security priorities for the year ahead: 

‍

1. The security landscape has never been more challenging

Cybersecurity threats are the number one concern for businesses in 2024, higher than financial and operational risk. And more than half (55%) of organizations say that security risks have never been higher, with 50% of organizations detecting and responding to cybersecurity threats at least once a week.

‍

‍While threats are increasing, businesses are also facing growing security expectations. Nearly two-thirds (65%) of organizations say that customers, investors, and suppliers are increasingly requiring proof of compliance. 

‍To establish and deepen trust with customers amid these challenges, businesses need to prioritize security resourcing.

‍

2. AI adoption is accelerating, but governance and risk management fall behind

AI is becoming increasingly common in the tech stack, and security concerns around its use are also on the rise. A majority (62%) of businesses plan to invest more in security around the use of AI within their organization in the next year.

‍However, only 2 in 5 (37%) organizations currently conduct, or are in the process of conducting, regular AI risk assessments. When it comes to formal policies for governing AI usage, only 36% of organizations have, or are in the process of putting, a company AI policy in place despite the increased use of AI tools. 

In 2025, security leaders should consider governance and risk management as their organization adopts and implements more AI technologies. 

3. Time spent on compliance tasks is growing—but automation can reduce the burden

Time spent on compliance tasks increased to 11 working weeks—up from 10 working weeks the previous year. And 1 in 10 (9%) respondents are spending over 21 hours each week—25 working weeks a year—on security compliance.

‍

‍

On average, security teams could save between 3-5 hours a week by automating activities like user access reviews, employee management, and answering security questionnaires—allowing them to focus on strategic security initiatives.

‍While 72% of IT decision makers say that their company could save time and money through automation, just 57% of business decision makers say the same. Leaders from the frontlines of security can help bridge this gap by getting buy-in for automation that reduces time-consuming processes. 

‍

4. Third-party risk increases as companies scale

Managing vendor risk is a challenge for any business, and this only becomes more difficult as a company grows. The larger the business, the more vendors they have—and the bigger the associated risk.

‍

‍At the same time, less than a quarter (24%) of organizations rate their visibility into vendor risk as “very strong.” With almost half (48%) of organizations saying that a vendor they work with has previously experienced a breach, businesses need to implement a proactive approach that reduces risk and enables continuous visibility into their third-party landscape.

‍

5. Demonstrating trust continues to drive business value—but measuring ROI is a challenge 

Nearly half (48%) of organizations believe good security practices drive customer trust for their business (up 7% from last year), and 46% recognize that good security practices lead to reduced financial risks.

‍The top three ways that organizations measure impact are: compliance and audit outcomes, operational efficiency, and risk reduction. While teams are quantifying and measuring impact, only 36% are measuring actual ROI.

‍

‍

Over the next year, it will be important for teams to implement trust management tools that automate and continuously monitor security and compliance programs to unlock visibility and efficiency.