Business Confidence in Cyber Crisis Response Falls
A State of Information Security report finds fewer organisations feel ready to handle a major cyber incident than a year ago.
Updated on Nov. 4, 2026 in Cybersecurity
Live Poll
Do you trust businesses to be prepared for a major cyber attack?
Research from business resilience specialists IO shows confidence among cybersecurity managers in the UK and US in handling a major cyber incident dropped sharply over the past year. Just 41% now say they are very confident, down from 61% last year.
Why it matters
Cyber-attacks are now seen as the single biggest threat to continued trading by 71% of organisations, yet preparation lags behind. The findings point to a widening gap between perceived risk and readiness as AI adoption and more sophisticated threat actors complicate the landscape.
The figures come from a survey of UK and US cybersecurity managers, showing 41% now feel very confident in handling a major incident versus 61% a year earlier. Whether the decline reflects weaker preparation or a more candid self-assessment is not addressed by the findings.
The players
IO
IO is a business resilience specialist that produces the State of Information Security report tracking cybersecurity preparedness among organisations.
The details
Fewer than four in ten common incident response plan elements appear on average, and 42% of organisations have tested defences against emerging threats. Among organisations hit by an incident, 83% reported at least a day of disruption, while 42% experienced disruption lasting four days or more.
Timeline
Last year: 61% of cybersecurity managers reported being very confident in handling a major incident.
This year: 41% report the same confidence, and security spending is expected to stay flat in key areas.
Over the next 12 months: 71% of organisations see a cyber-attack as the biggest threat to continuing to trade.
Industry Context
The decline in confidence comes as organisations weigh AI adoption and expanding attack surfaces against thin preparation, with fewer than half regularly testing incident response plans. The IO series shows the readiness gap is measured against a year-earlier baseline rather than a fixed standard.
Organisations without a documented incident response plan or designated response team face longer disruptions when attacks hit, with many outages lasting multiple days. Readers at work should check whether their own employer has tested recovery procedures.
The takeaway
Preparedness is measured by testing, not intent, and fewer than half of organisations regularly rehearse their response plans. Organisations that run those tests are better positioned to keep operating when an incident occurs.
Further reading
Explore more coverage in the Cybersecurity section for context on how organisations are preparing for attacks.
Source note: This article includes information reported by Digit.
Live Poll
Do you trust businesses to be prepared for a major cyber attack?
