I’d say, based on what I see in my security assessment work, that malware is indeed a problem – more than many believe. Traditional anti-virus is not enough for many enterprises. Mobile too. It’s mostly out of control. Not good for security.
The one thing that many still overlook is web vulnerabilities that have gone unacknowledged. It’s simply a matter of time before they’re exploited. Find them and fix them in *all* of your web systems: marketing site and content management systems included.
As for compliance, focus on the security essentials and it’ll come naturally. Focus on compliance and not security and you’re setting your business and your IT department up for failure.