Survey: Merchants Driven By Brand Protection, Not Fines, In Payment Security Investments

SAN FRANCISCO, Calif. and CHICAGO, Ill. - July 19, 2011 - Findings from a new survey of eCommerce merchants released today by CyberSource, a Visa company (NYSE: V) and Trustwave, a leading data security and compliance firm, show that nearly 70 percent of respondents cited the need to "protect the brand" as the primary driver for tightening controls against hackers and other payment security risks. Only 26 percent said avoiding fines resulting from non-compliance with the Payment Card Industry Data Security Standard (PCI DSS) were the key motivator. [Note to editors: The PCI DSS was established in September 2006 to provide guidelines for organizations in the safe storage, processing and transmission of cardholder data. Non-compliance findings can result in fines for the acquiring banks which may then be passed on the merchant depending on contract stipulations.]

"A breach has serious consequences for nearly every division of an eCommerce merchant's organization," said Dayna Ford, Director, Product Management at CyberSource. "But by far the most damaging impact is to the company's brand, affecting revenue, customer loyalty, and even stock valuation. Knowledge of this phenomenon is now widespread, so we're not surprised at the survey finding that puts brand integrity as the most important rationale for payment security investment."

"In the face of increasing numbers of security breaches and data theft, there's a real urgency for organizations to deploy powerful and effective security strategies," said James Paul, Senior Vice President of Global Compliance Services at Trustwave. "Studies like 'The Payment Security Practices and Trends Report,' published today, should help organizations learn best practices and likely costs to attain appropriate levels of security."

Selected survey findings

--Data moving out: Over the next 24 months, an increasing proportion of organizations expect to remove payment data from their environment as a way of reducing security risks.

--Efficiency improving: Organizations that do not capture, transmit, or store data inside their own network tend to employ fewer personnel, validate PCI DSS compliance more quickly, and operate at a lower overall cost of payment security management.

--"Data out" merchants spend less on infrastructure: 75 percent of PCI DSS Level 1 merchants that have removed payment data from their environments spend less than $500,000 on their payment security infrastructure. Only 60 percent of those that keep data in-house can make that claim.

--Risk not confined to outsiders: In one counter-intuitive finding, respondents said they felt the threat of payment data theft from inside employees was about equal to the threat from external hackers.

The Payment Security Practices and Trends Report also covers topics regarding PCI DSS compliance, extended validation secure socket layer certificates, payment security ownership, staffing, and the cost of managing payment security.

To obtain a copy of the report -- for journalists: please call or email Bruce Frymire (650-432-7816), bfrymire@visa.com) or Michelle Genser (312-873-7288) mgenser@trustwave.com. For all others: please visit www.cybersource.com/2011PSReport/.

Methodology The payment security survey was conducted via an online questionnaire by an independent survey organization from December 6, 2010 through January 31, 2011. Respondents to the survey were required to have personal involvement in the management of their organization's payment security practices.

About CyberSource CyberSource, a wholly-owned subsidiary of Visa Inc., is a payment management company. Over 330,000 businesses worldwide use CyberSource and Authorize.Net brand solutions to process online payments, streamline fraud management, and simplify payment security. The company is headquartered in San Francisco, California with international offices in Reading, U.K.; Singapore; and Tokyo. CyberSource operates in Europe under agreement with Visa Europe. For more information, please visit www.cybersource.com.

About Trustwave Trustwave is a leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper' compliance management software and other proprietary security solutions including EV SSL certificates and secure digital certificates. Trustwave has helped thousands of organizations-ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers-manage compliance and secure their network infrastructures, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, Asia and Australia. For more information, visit https://www.trustwave.com.