So says IBM in their recent 2007 X-Force Security report, released yesterday.

I haven't done a year to year comparison of spam on any of the systems I monitor yet, but personally I haven't noticed any dramatic changes in the overall percentages (hovering around 75% spam, 25% "ham," as the pros like to refer to legitimate e-mail) coming in. And on the flip side, I haven't seen any great increase in browser-based attacks at any of my clients, either.

Of course those are extremely subjective measures and the numbers vary even among the various systems I have access to, so I don't doubt the report. Perhaps the more sinister information, although it's not exactly new, is the increasing penetration of organized crime into the world of electronic theft. The public, whatever their perception, had relatively little to fear from the random individual who was writing a virus for fun or to impress his friends; in fact, those sorts of exploits were welcome in that they demonstrated security holes and were extremely easy to detect. Malware written to lurk and harvest information worth real money, however, is what organized crime brings to the stage, and such programs will do everything they can to avoid detection and to keep from tipping of security researchers on the mechanisms they use to breach security. That's considerably more worrisome from the standpoint of real security, if not stability; you needn't worry about viruses crashing your systems so much anymore, as about them lurking quietly and harvesting customer records and sending them off to be sold without your knowledge.

In the sense that users are less disrupted by these categories of exploits, the perception is probably that security has improved markedly over the past few years. But that in itself may prove a weakness, since for a long time the best virus detector has been the person at the computer that is crashing. Without that safety net, security professionals and CIOs will be relying on security software and the efforts of software vendors, which are notoriously behind the curve defending against exploits.

Full IBM article can be found here.