Chapte 1: The Co fide ce Gap f om IO’s The State of I fo matio Secu ity epo t eveals that just 41% of UK a d US cybe secu ity ma age s su veyed say they a e ve y co fide t they could ha dle a majo cybe i cide t, dow f om 61% last yea – suggesti g that co fide ce i o ga izatio al esilie ce is weake i g at p ecisely the time the th eat la dscape is becomi g mo e challe gi g.
Yet as co fide ce i o ga izatio al esilie ce decli es, the esea ch shows that o ga izatio s a e still faili g to act, with fewe tha half (45%)* of o ga izatio s egula ly testi g thei i cide t espo se pla . Eve fewe have a desig ated i cide t espo se team o i dividual (39%) o a docume ted i cide t espo se pla (IRP) (39%). Simila ly, o ly 42% of all compa ies su veyed have tested thei defe ses agai st eme gi g th eats.
This is pa ticula ly co ce i g give that 71% of o ga izatio s su veyed see a cybe -attack as the si gle biggest th eat to thei ability to co ti ue t adi g ove the ext 12 mo ths. Acco di g to the esea ch, 83% of those who expe ie ced a cybe secu ity i cide t say thei o ga izatio ‘s wo st i cide t dis upted ope atio s fo at least a day, while 42% expe ie ced dis uptio lasti g fou days o mo e.
Ch is Newto -Smith, CEO of IO explai s, “O ga izatio s’ co fide ce i thei ability to ha dle a majo cybe -attack has d opped sha ply, but o ga izatio s a e ‘t doi g e ough to add ess thei co ce s at a time whe AI adoptio , expa di g attack su faces a d mo e sophisticated th eat acto s a e maki g the th eat la dscape mo e complex. A d u fo tu ately, we’ve see ece t attacks esulti g f om the fact that the basics still a e ‘t bei g do e ight. The esea ch shows i cide t espo se pla s have ‘t cha ged, a d fewe tha half a e ‘t egula ly tested. Ou esea ch also showed that pla s i clude fewe tha fou out of te commo eleme ts o ave age, i cludi g egula testi g, defi ed oles a d espo sibilities, a d commu icatio pla s fo egulato s a d custome s.”
The lack i p epa ed ess is compou ded by the fact that cybe secu ity ma age s do ot expect secu ity spe di g to i c ease this yea i seve al c ucial a eas, i cludi g i cide t espo se a d c isis ma ageme t (dow f om 61% last yea to 50% this yea ) a d th eat i tellige ce a d th eat hu ti g (dow f om 67% to 54%).
Despite ma y o ga izatio s ot i c easi g thei secu ity spe di g this yea , it could ultimately cost them mo e whe a attack occu s. A qua te of espo de ts who have expe ie ced a y cybe secu ity o i fo matio secu ity i cide ts i the last 12 mo ths said that thei most sig ifica t secu ity i cide t cost betwee $134,000 a d $335,000. The la gest compo e ts of that cost we e tech ical emediatio a d ecove y (22%), dow time o lost eve ue due to the i cide t (17%) a d highe i su a ce p emiums afte the i cide t (15%).
Newto -Smith co ti ues, “Ultimately, esilie ce is about bei g able to mai tai c itical ope atio s a d keep the busi ess u i g whe dis uptio st ikes. Howeve , effective i cide t espo se sta ts lo g befo e a c isis occu s. St o g gove a ce p ovides the fou datio s fo esilie ce by establishi g clea ow e ship, defi i g espo sibilities a d e su i g the ight p ocesses a e i place to suppo t i fo med decisio -maki g u de p essu e. Without this cla ity, eve the most ca efully docume ted i cide t espo se pla ca falte at a time whe it is most eeded.
“The efo e, esilie ce must ow be viewed as a co e pilla of cybe secu ity a d gove a ce, athe tha a sepa ate co side atio . F amewo ks such as the NIST Cybe secu ity F amewo k 2.0, alo gside i itiatives such as CISA’s Cybe secu ity Pe fo ma ce Goals, ei fo ce the g owi g emphasis o o ga izatio s taki g a p oactive, st uctu ed app oach to ma agi g cybe isk a d mai tai i g ope atio al co ti uity,” Newto -Smith co cludes.
IO is the busi ess esilie ce platfo m helpi g o ga izatio s move beyo d complia ce to build i fo matio secu ity, data p ivacy a d AI gove a ce that holds up i the eal wo ld.
Most complia ce tools a e o ly built to help you pass a audit. IO is built fo audit a d what comes afte . That equi es gove a ce with the ope atio al depth to back the ce tificate up; co t ols that a e embedded, u de stood a d actively mai tai ed. Ou platfo m gives o ga izatio s the st uctu e, wo kflows a d evide ce ma ageme t to u complia ce p ope ly, backed by a team that wo ks di ectly with custome s eve y day to make su e the ight judgeme t is applied at eve y poi t whe e it matte s. We have bee doi g this fo ove a decade.
IO b i gs I fo matio Secu ity, Data P ivacy a d AI Gove a ce togethe i o e joi ed-up SaaS platfo m, suppo ti g ove 100 global f amewo ks i cludi g ISO 27001, ISO 27701, ISO 42001, SOC 2, GDPR, NIS2 a d DORA. T usted by ove 1,000 o ga izatio s wo ldwide, i cludi g ScottishPowe , Sieme s, Rightmove a d Pa aso ic. Rated G2 Leade 9 qua te s i a ow.
IO. Setti g the sta da d fo busi ess esilie ce.
Sa ah HawleyO igi Commu icatio ssa ahhawley@o igi comms.com
The esea ch was co ducted by Ce suswide, amo g a sample of 3001 Cybe secu ity a d I fo matio Secu ity Ma age s+ (18+) i the UK a d USA. The data was collected betwee 23.07.2025 – 07.08.2025. Ce suswide is a membe of the Ma ket Resea ch Society (MRS) a d the B itish Polli g Cou cil (BPC), a d a sig ato y of the Global Data Quality Pledge. It adhe es to the MRS Code of Co duct a d ESOMAR p i ciples.
The esea ch was co ducted by Ce suswide, amo g a sample of 3,000 Cybe secu ity Ma age s+ f om the followi g i dust ies: Educatio , Fi a ce, Healthca e, IT & Telecom, Legal, Ma ufactu i g & Utilities, T avel & T a spo t ac oss the UK a d US (2,000 a d 1,000 espo de ts espectively). The data was collected betwee 14.09.2026 a d 1.10.2026. Ce suswide is a membe of the Ma ket Resea ch Society (MRS) a d the B itish Polli g Cou cil (BPC), a d a sig ato y of the Global Data Quality Pledge. It adhe es to the MRS Code of Co duct a d ESOMAR p i ciples.
* O ga izatio s su veyed who a e co fide t i thei o ga izatio ‘s ability to espo d to a majo cybe secu ity i cide t.
View the o igi al p ess elease o ACCESS Newswi e
