From 20 new viruses popping up on the web each day 10 years ago to 25,000 new viruses a day this year, the exponential growth of online security threats pose a big problem for many financial services firms.

According to new research by security software provider Symantec, many companies have spent an average US$2 million a year fixing or preventing cyber attacks - an amount that keeps growing as online fraud become more sophisticated.

Symantec found in the global study that 9 in 10 Australian and New Zealand companies have been the subject of cyber attacks in the past 12 months. Not surprisingly, 43 per cent of those surveyed ranked security as their top issue, ahead of natural disasters, terrorism and traditional crime.

The scale of the problem is highlighted by Symantec's study, which found all of the 2,100 businesses surveyed across 27 countries suffered a cyber attack in January this year.

Hitting the financial services sector in particular were the Conficker virus and the Silentbanker Trojan. In Australia and New Zealand, a third of those surveyed ranked these viruses as somewhat, if not highly, effective, at causing serious IT problems.

"The fraud and crime happening overall are escalating. Banks are getting attacked every day and the frequency of these attacks are rising, too," said Craig Scroggie, vice president and managing director - Pacific region, for Symantec.

The clean-up costs can be in the millions, said Scroggie. "The cost could be the data loss, or if it's about a company's online shopfront getting attacked and they have to shut it down, you're talking about loss of revenue streams," he added.

One way banks and other financial services firms can avoid these costs is to implement the right IT policy. For example, software security firms knew about the Conficker virus before it spread around the globe - but unless a firm have a strict policy about regularly updating their security program, it would be a case of ‘too little, too late'.

As the old saying goes, prevention is better than the cure, which is why Scroggie said part of Symantec's services is to alert companies about potential online threats before they happen.