Business Confidence in Surviving a Major Cyber-Attack Plunges as Incident Response Preparedness Lags
New IO research finds just 41% are very confident they can handle a major cyber incident, down from 61% last year, yet
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
New IO research finds just 41% are very confident they can handle a major cyber incident, down from 61% last year, yet fewer than half regularly test their response plans
NEW YORK, NY / ACCESS Newswire / November 4, 2026 / Confidence among businesses in their ability to handle a major cyber incident has fallen sharply over the past year according to new research from business resilience specialists, IO.
Chapter 1: The Confidence Gap from IO’s The State of Information Security report reveals that just 41% of UK and US cybersecurity managers surveyed say they are very confident they could handle a major cyber incident, down from 61% last year – suggesting that confidence in organizational resilience is weakening at precisely the time the threat landscape is becoming more challenging.
Yet as confidence in organizational resilience declines, the research shows that organizations are still failing to act, with fewer than half (45%)* of organizations regularly testing their incident response plan. Even fewer have a designated incident response team or individual (39%) or a documented incident response plan (IRP) (39%). Similarly, only 42% of all companies surveyed have tested their defenses against emerging threats.
This is particularly concerning given that 71% of organizations surveyed see a cyber-attack as the single biggest threat to their ability to continue trading over the next 12 months. According to the research, 83% of those who experienced a cybersecurity incident say their organization’s worst incident disrupted operations for at least a day, while 42% experienced disruption lasting four days or more.
Chris Newton-Smith, CEO of IO explains, “Organizations’ confidence in their ability to handle a major cyber-attack has dropped sharply, but organizations aren’t doing enough to address their concerns at a time when AI adoption, expanding attack surfaces and more sophisticated threat actors are making the threat landscape more complex. And unfortunately, we’ve seen recent attacks resulting from the fact that the basics still aren’t being done right. The research shows incident response plans haven’t changed, and fewer than half aren’t regularly tested. Our research also showed that plans include fewer than four out of ten common elements on average, including regular testing, defined roles and responsibilities, and communication plans for regulators and customers.”
The lack in preparedness is compounded by the fact that cybersecurity managers do not expect security spending to increase this year in several crucial areas, including incident response and crisis management (down from 61% last year to 50% this year) and threat intelligence and threat hunting (down from 67% to 54%).
Despite many organizations not increasing their security spending this year, it could ultimately cost them more when an attack occurs. A quarter of respondents who have experienced any cyber security or information security incidents in the last 12 months said that their most significant security incident cost between $134,000 and $335,000. The largest components of that cost were technical remediation and recovery (22%), downtime or lost revenue due to the incident (17%) and higher insurance premiums after the incident (15%).
Newton-Smith continues, “Ultimately, resilience is about being able to maintain critical operations and keep the business running when disruption strikes. However, effective incident response starts long before a crisis occurs. Strong governance provides the foundations for resilience by establishing clear ownership, defining responsibilities and ensuring the right processes are in place to support informed decision-making under pressure. Without this clarity, even the most carefully documented incident response plan can falter at a time when it is most needed.
“Therefore, resilience must now be viewed as a core pillar of cybersecurity and governance, rather than a separate consideration. Frameworks such as the NIST Cybersecurity Framework 2.0, alongside initiatives such as CISA’s Cybersecurity Performance Goals, reinforce the growing emphasis on organizations taking a proactive, structured approach to managing cyber risk and maintaining operational continuity,” Newton-Smith concludes.
ENDS
About IO
IO is the business resilience platform helping organizations move beyond compliance to build information security, data privacy and AI governance that holds up in the real world.
Most compliance tools are only built to help you pass an audit. IO is built for audit and what comes after. That requires governance with the operational depth to back the certificate up; controls that are embedded, understood and actively maintained. Our platform gives organizations the structure, workflows and evidence management to run compliance properly, backed by a team that works directly with customers every day to make sure the right judgement is applied at every point where it matters. We have been doing this for over a decade.
IO brings Information Security, Data Privacy and AI Governance together in one joined-up SaaS platform, supporting over 100 global frameworks including ISO 27001, ISO 27701, ISO 42001, SOC 2, GDPR, NIS2 and DORA. Trusted by over 1,000 organizations worldwide, including ScottishPower, Siemens, Rightmove and Panasonic. Rated G2 Leader 9 quarters in a row.
IO. Setting the standard for business resilience.
Contact Information
Sarah Hawley
Origin Communications
sarahhawley@origincomms.com
Research methodology
2025:
The research was conducted by Censuswide, among a sample of 3001 Cybersecurity and Information Security Managers+ (18+) in the UK and USA. The data was collected between 23.07.2025 – 07.08.2025. Censuswide is a member of the Market Research Society (MRS) and the British Polling Council (BPC), and a signatory of the Global Data Quality Pledge. It adheres to the MRS Code of Conduct and ESOMAR principles.
2026:
The research was conducted by Censuswide, among a sample of 3,000 Cybersecurity Managers+ from the following industries: Education, Finance, Healthcare, IT & Telecom, Legal, Manufacturing & Utilities, Travel & Transport across the UK and US (2,000 and 1,000 respondents respectively). The data was collected between 14.09.2026 and 1.10.2026. Censuswide is a member of the Market Research Society (MRS) and the British Polling Council (BPC), and a signatory of the Global Data Quality Pledge. It adheres to the MRS Code of Conduct and ESOMAR principles.
* Organizations surveyed who are confident in their organization’s ability to respond to a major cybersecurity incident.
SOURCE: IO
View the original press release on ACCESS Newswire
Media gallery
