A dramatic increase in the number of virus attacks over the first half of 2004 has caused security experts to question whether companies are doing enough to protect their networks.

Antivirus software specialist Sophos detected 4,677 new viruses in the first six months of 2004, an increase of 21 percent compared with the same period last year.

In July the largest number of new viruses was discovered in the wild for almost three years - 1,157 new viruses were recorded.

Figures from security firm McAfee also indicated that the severity of attacks increased. By the end of the first quarter, more viruses had been given a medium or high risk rating than in the whole of 2003, the company said.

Carole Theriault, security consultant at Sophos, said that companies' efforts to stop viruses were being hampered by an overload of information on security as well as by a lack of in-house security experts.

"Companies are not ignoring security warnings; it's just not always the top priority," she added.

Theriault said firms should shore up their defences to combat the growing complexity of viruses, and added that criminals are increasingly using trojans for financial gain. She said that firms should ensure they have proactive systems to combat threats and she advised them to set up automated patch checks.

Graham Smith, security expert at telecoms specialist Energis, said firms must set up good risk assessment processes if they want good security. "Everybody knows virus risks are out there and puts antivirus protection in, but have they put it in the right place?" he asked. "Firms may put antivirus protection on their emails but then fail to do all the laptops in the business."

Smith added that organisations often waste money by installing or using the wrong technology, and relying too heavily on it. "Technology is a tool to mitigate the risk that has been identified in a business continuity policy. It will not cover all risks," he warned. "When a virus does break through, staff must be educated enough to know not to open unknown attachments."

For the latest news for IT professionals, visit IT Week