Some of the most qualified security professionals around are more confident in attackers than they are in themselves or their end users.

A whopping 72% of respondents to the latest Black Hat Attendee Survey, released today, felt it was at least likely their organizations would have a major data breach in the next 12 months. Fifteen percent of the 250 respondents went so far as to say they had "no doubt," up from 13% last year. 

Two-thirds of respondents felt they didn't have enough staff, enough budget, or enough training to adequately address an ever-evolving threat landscape. The most common complaint? A shortage of qualified people and skills, which 37 percent of respondents listed among the top-three reasons that security initiatives fail -- soundly beating lack of management support (22%) and a lack of integration among security products (14%). Sixty-seven percent said they feel they themselves don't have the skills and training to do all the tasks they're responsible for.

This year, the Black Hat Attendee survey once again showed that security pros' time management and spending don't quite correspond with their top priorities. When asked how they spend most of their time, respondents listed measuring risk (35%), managing regulatory compliance (32%), and addressing vulnerabilities in internally developed applications (27%). However, when asked to list their top three concerns, respondents most often identified social engineering attacks (46%) and sophisticated, targeted attacks (43%).    

The worry about users being a weak link continued to arise. When asked "what is the weakest link in enterprise IT defenses" the number one answer by far was "End users who violate security policy and are too easily fooled by social engineering attacks," claiming 28%. (A lack of comprehensive security architecture and cloud services were distant second and third with 17% and 12%, respectively. Vulnerabilities in internally developed software -- one of the biggest time-gobblers -- was considered the weakest link by only 4%.)

With social engineering a burning worry, it's no surprise that when asked to identify the most serious new cyber threat to emerge in the past 12 months, respondents put two such issues at the top of the list. "A rapid increase in ransomware" took 37% and "social engineering attacks targeted directly at individuals in a specific organization" took 20%. 

When ticking that latter category, respondents likely had business email compromise attacks in mind. BECs have caused billions of dollars in losses and respondents indicate they aren't doing enough to combat the threat.   

Respondent Donald Codling, CISO of Urban FT, says his concern about BEC attacks is very high: "These attacks I think will go from being costly annoyances ... to forcing all manner of companies to reshape/retool their internal accounting and financial services departments ... basically go back to old school methods of two person authentication, regular visits or phone calls  to CFO/CEO to ask if these transactions are legit."

"We had a couple [BEC attacks] last year," says respondent Daniil Chernov, a global VP of application security. "But we [now] have a policy to double confirm the email content if it is asking for some serious steps to be performed."

Chernov says if he could change anything about his organization's security program he would "enhance staff awareness trainings," adding that "business is not happy to devote business hours for [these] procedures."

Chernov is not the only one who wants more awareness training. When asked what they would change about their security program if they could change anything, the most common answer to an open-ended question from a Dark Reading editor was more user awareness training.

Or, similarly, "Automate the entire business and flush out the humans," as respondent Jacob Anderson suggests. "Otherwise, just keep swimming." 

Despite all the challenges, the lion's share of security pros are whistling while they work. Only 11 percent of survey respondents said they were actively looking for new jobs and 32 percent (leaping up from 24 percent last year) said "I really love my job and my employer and it would take a LOT to get me to move."

"Every time I round up a phisher or spammer," says Anderson, "it makes my day."

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Related Black Hat 2016 Content: