Vendor Predictions for 2018, Part 2: AI, the Cloud, and (Inevitably) More on Security

The European Union’s General Data Protection Regulation obligates businesses in EU nations—as well as those elsewhere in the world that buy from, sell to, or partner with them—to notify victims of data breaches within 72 hours. That requirement will call attention on a whole lot of successful attacks that might otherwise have gotten swept under the rug, according to Linus Chang, CEO of BDR vendor BackupAssist.

“With the introduction of GDPR, and strengthening of laws relating to mandatory data breach reporting, we will for the first time have an understanding of how bad the situation really is, and I expect it to be worse than is currently believed,” he says.

Even so, however, Kaseya Chief Product Officer Mike Puglia doesn’t expect GDPR to change anyone’s behavior significantly at first.

“Similar to HIPAA many years ago, there will not be much movement until GDPR fines are actually levied,” he says, and that won’t begin until the end of 2018 at the earliest.

The folks at eSentire beg to differ. Sangster expects regulators to levy a few high-profile fines on mid-market businesses sooner than that in an attempt to send a message about the importance of complying with new law. His colleague Eldon Sprickerhoff, eSentire’s chief security strategist and founder, expects those fines to have their intended effect too.

“The GDPR will spur corporations worldwide to heighten their privacy measures widely, ahead of what extra-legislative bodies may propose,” he says.