Compliance has led to increased security spending, but it should be a by-product of a much broader strategy, he said.
Organizations are cloaking their pet projects in compliance to get funding. "We have reached a point where the information security budget is peaking and downward pressure will begin to emerge," he said, adding that the current spend is about 6 percent of the IT budget.
Jack Jones, chief information security officer (CISO) at Nationwide Mutual Insurance Company, said that when companies try to manage risks by using a checklist of compliance items, there is "a very real danger" of overlooking other critical security issues. "Checklists cast the world in black-and-white terms," Jones said.
Neal Wise, partner with IT security consultancy firm Assurance.com.au, warned many companies approach compliance and security as an opportunity to kill two birds with the one stone.
"Legislation is getting some companies to invest in security, but in some cases they are just doing the bare minimum and this could give those companies a false sense of security," he said.
"In some cases, because companies have to look externally for security recommendations, they may use regulations to start building their own security frameworks."
Ben Rothke, a senior security consultant at ThruPoint, said the problem with compliance is that people tend to take a myopic view of what needs to be done whenever new regulations come out.
"The point needs to be made that those organizations with a solid security framework in place could easily handle any regulations thrown at them," he added.
James Turner, Frost & Sullivan security analyst, said compliance is about transparency.
"Obfuscating funds by using the compliance hot button is going to get stomped on ... of course this doesn't mean shonky people won't try it, and ironically these are the very people that regulations are beefed up to address," Turner said.
(Jaikumar Vijayan of Computerworld (US) contributed to this report.)