Confidence among cybersecurity managers in their organisations’ ability to handle a major cyber incident has fallen sharply over the past year, while gaps in incident response planning and testing continue to leave businesses exposed to operational disruption.
New research from business resilience specialist IO found that just 41% of UK and US cybersecurity managers were very confident their organisation could manage a major cyber incident, compared with 61% in 2025.
The findings, published in the first chapter of IO’s State of Information Security report, also highlight weaknesses in the arrangements businesses have established to respond when attacks occur. Only 39% of respondents reported having a designated incident response team or individual, while the same proportion had a documented incident response plan.
Regular testing is another concern. Among respondents confident in their organisation’s ability to respond to a major incident, 45% said their incident response plan was regularly tested. Across the wider sample, only 42% reported having tested their organisation’s defences against emerging threats.
The research was conducted by Censuswide among 3,000 cybersecurity managers across the UK and US between 14 September and 1 October 2026. The sample comprised 2,000 UK respondents and 1,000 US respondents, covering industries including finance, healthcare, manufacturing, utilities, and telecommunications.
Chris Newton-Smith, CEO of IO, said: “Organisations’ confidence in their ability to handle a major cyber-attack has dropped sharply, but organisations aren’t doing enough to address their concerns at a time when AI adoption, expanding attack surfaces and more sophisticated threat actors are making the threat landscape more complex.”
The potential consequences extend beyond immediate security breaches. Some 71% of respondents identified cyberattacks as the greatest threat to their organisation’s ability to continue trading over the next 12 months.
Among respondents whose organisations had experienced a cybersecurity incident, 83% said their worst incident had disrupted operations for at least one day. More than four in ten, or 42%, reported disruption lasting four days or longer, illustrating the potential consequences for businesses dependent on continuously available digital systems.
Financial losses were also substantial. A quarter of respondents who had experienced an information security incident in the previous 12 months reported that their most significant incident had cost between £100,001 and £250,000.
Technical remediation and recovery accounted for the largest reported component of incident costs at 22%, followed by downtime or lost revenue at 17%, and increased insurance premiums at 15%.
Despite those pressures, expectations for increased cybersecurity spending have weakened in several important areas. Half of respondents anticipated higher investment in incident response and crisis management, compared with 61% in the previous year’s survey. The proportion expecting increased spending on threat intelligence and threat hunting fell from 67% to 54%.
The findings suggest that concerns about resilience are not consistently translating into additional investment in the capabilities required to manage disruption. IO also found that incident response plans included fewer than four out of ten common preparedness elements on average, including testing arrangements, defined responsibilities, and communication procedures for regulators and customers.
Newton-Smith said: “Ultimately, resilience is about being able to maintain critical operations and keep the business running when disruption strikes. However, effective incident response starts long before a crisis occurs.”
He added: “Strong governance provides the foundations for resilience by establishing clear ownership, defining responsibilities and ensuring the right processes are in place to support informed decision-making under pressure. Without this clarity, even the most carefully documented incident response plan can falter at a time when it is most needed.”
The results echo concerns identified in separate UK government research published in September. The Cyber Security Skills in the UK Labour Market 2026 study found that 47% of people responsible for cybersecurity in businesses that had not outsourced incident response lacked confidence in their ability to handle breaches or attacks. Almost half of business cyber leads, at 49%, also lacked confidence in writing an incident response plan.
Meanwhile, the National Cyber Security Centre’s annual review, published on 3 November, highlighted the continuing role of familiar security weaknesses in successful attacks, reinforcing the importance of effective monitoring, incident response, and business continuity arrangements.
The findings come as the UK’s Cyber Security and Resilience Bill progresses through Parliament. Following its third reading in the House of Lords on 2 November, the legislation has returned to the Commons for consideration of amendments. The proposed reforms would strengthen security and incident reporting requirements for organisations providing essential and digital services.
You must be logged in to post a comment.