Business confidence in surviving a major cyber-attack plunges as incident response preparedness lags

Confidence among businesses in their ability to handle a major cyber incident has fallen sharply over the past year according to new research from business resilience specialists, IO.

Chapter 1: The Confidence Gap from IO’s The State of Information Security report reveals that just 41% of UK and US cybersecurity managers surveyed say they are very confident they could handle a major cyber incident, down from 61% last year – suggesting that confidence in organisational resilience is weakening at precisely the time the threat landscape is becoming more challenging.

Yet as confidence in organisational resilience declines, the research shows that organisations are still failing to act, with fewer than half (45%)* of organisations regularly testing their incident response plan. Even fewer have a designated incident response team or individual (39%) or a documented incident response plan (IRP) (39%). Similarly, only 42% of all companies surveyed have tested their defences against emerging threats.

This is particularly concerning given that 71% of organisations surveyed see a cyber-attack as the single biggest threat to their ability to continue trading over the next 12 months. According to the research, 83% of those who experienced a cybersecurity incident say their organisation’s worst incident disrupted operations for at least a day, while 42% experienced disruption lasting four days or more.

Chris Newton-Smith, CEO of IO explains, “Organisations’ confidence in their ability to handle a major cyber-attack has dropped sharply, but organisations aren’t doing enough to address their concerns at a time when AI adoption, expanding attack surfaces and more sophisticated threat actors are making the threat landscape more complex. And unfortunately, we’ve seen recent attacks resulting from the fact that the basics still aren’t being done right. The research shows incident response plans haven’t changed, and fewer than half aren’t regularly tested. Our research also showed that plans include fewer than four out of ten common elements on average, including regular testing, defined roles and responsibilities, and communication plans for regulators and customers.”

The lack in preparedness is compounded by the fact that cybersecurity managers do not expect security spending to increase this year in several crucial areas, including incident response and crisis management (down from 61% last year to 50% this year) and threat intelligence and threat hunting (down from 67% to 54%).

Despite many organisations not increasing their security spending this year, it could ultimately cost them more when an attack occurs. A quarter of respondents who have experienced any cyber security or information security incidents in the last 12 months said that their most significant security incident cost between £100,001 and £250,000. The largest components of that cost were technical remediation and recovery (22%), downtime or lost revenue due to the incident (17%) and higher insurance premiums after the incident (15%).

Newton-Smith continues, “Ultimately, resilience is about being able to maintain critical operations and keep the business running when disruption strikes. However, effective incident response starts long before a crisis occurs. Strong governance provides the foundations for resilience by establishing clear ownership, defining responsibilities and ensuring the right processes are in place to support informed decision-making under pressure. Without this clarity, even the most carefully documented incident response plan can falter at a time when it is most needed.

“Therefore, resilience must now be viewed as a core pillar of cybersecurity and governance, rather than a separate consideration. Regulations such as the Cyber Security and Resilience Bill, alongside initiatives such as the Cyber Resilience Pledge, reinforce the growing emphasis on organisations taking a proactive, structured approach to managing cyber risk and maintaining operational continuity,” Newton-Smith concludes.

About IO

IO is the business resilience platform helping organisations move beyond compliance to build information security, data privacy and AI governance that holds up in the real world.

Most compliance tools are only built to help you pass an audit. IO is built for audit and what comes after. That requires governance with the operational depth to back the certificate up; controls that are embedded, understood and actively maintained. Our platform gives organisations the structure, workflows and evidence management to run compliance properly, backed by a team that works directly with customers every day to make sure the right judgement is applied at every point where it matters. We have been doing this for over a decade.

IO brings Information Security, Data Privacy and AI Governance together in one joined-up SaaS platform, supporting over 100 global frameworks including ISO 27001, ISO 27701, ISO 42001, SOC 2, GDPR, NIS2 and DORA. Trusted by over 1,000 organisations worldwide, including ScottishPower, Siemens, Rightmove and Panasonic. Rated G2 Leader 9 quarters in a row.

1. Setting the standard for business resilience.

Research methodology

The research was conducted by Censuswide, among a sample of 3,000 Cybersecurity Managers+ from the following industries: Education, Finance, Healthcare, IT & Telecom, Legal, Manufacturing & Utilities, Travel & Transport across the UK and US (2,000 and 1,000 respondents respectively). The data was collected between 14.09.2026 and 1.10.2026. Censuswide is a member of the Market Research Society (MRS) and the British Polling Council (BPC), and a signatory of the Global Data Quality Pledge. It adheres to the MRS Code of Conduct and ESOMAR principles.

* Organisations surveyed who are confident in their organisation’s ability to respond to a major cybersecurity incident.