A survey led by PricewaterhouseCoopers LLP, on behalf of the Department for Business, Enterprise & Regulatory Reform (BERR), has found that IT systems and information security are more important to UK companies than ever before, with 81% of boards giving a high or very high priority to information security.

As businesses continue to grasp the opportunities provided by new technology (97% now have a broadband internet connection), there has been a real improvement in basic disciplines such as anti-virus and backups. The average spend by companies on security defences has tripled over the last six years with reported security breaches dropping by a third. Despite this reduction, the annual cost to companies still runs into several billions of pounds.

Four-fifths of companies that have computers stolen have not encrypted their hard drives, and two-thirds of companies do nothing to prevent confidential data leaving on USB sticks.

Business Minister Shriti Vadera said: "New technology is a key source of productivity gains, but without adequate investment in security defences these gains can be undermined by IT security breaches. The survey shows increasing understanding by business of the opportunities and threats, but challenges remain."

The broadband revolution has allowed companies to use the internet to reach their customers and enable their staff to be more mobile:

• 54% of UK companies allow staff to access their systems remotely;
• 42% use a wireless network;
• 17% use Voice over IP telephony, and this will rise to 30% by the end of 2008;
• 5% have moved some of their IT operations offshore; and
• 84% are heavily dependent on their IT systems.

Over the last six years, the security landscape has changed dramatically:

• 98% of companies now have software to scan for spyware;
• 94% of wireless networks are now encrypted, versus only 47% in 2002;
• 55% of UK companies have a documented security policy, versus 27% in 2002;
• Expenditure on information security has increased from 2% to 7% of IT budget over that period;
• 40% of businesses provide ongoing security awareness training to staff - twice as many as six years ago;
• 14% use strong (i.e. multi-factor) authentication; and
• 11% have implemented the British/International Standard for information security management (BS 7799/ISO 27001), versus only 5% in 2002.