Cyber incidents are becoming more frequent, but many <a href="https://bitcomme.com/blue-mantis-introduces-mantis-genius-to-help-organizations-identify-cloud-security-risks-and-costs/” title=”Blue Mantis Introduces Mantis Genius to Help Organizations Identify Cloud Security Risks and Costs”>organizations continue to rely on incident response processes designed for a time when major disruptions were relatively rare.
New research from CYGNVS and Marsh finds that more than six in ten organizations experienced an increase in cyber incidents over the past 12 months, yet 84% review their incident response plans only once a year or less. Meanwhile, 17% do not conduct tabletop exercises at all, raising questions about how prepared businesses are to manage a serious disruption.
The findings come from the CYGNVS Resilience Benchmark Report, which analyzes more than 9,500 survey responses from organizations spanning more than 20 industries across Asia, Europe and North America.
The report suggests that while cybersecurity has gained greater executive attention, operational readiness has not necessarily followed. Some 91% of organizations reported increased board involvement in cyber incidents, but significant gaps remain across the four stages of incident management: preparation, practice, response and reporting.
Although 92% of organizations have documented incident response processes, only 37% have specific playbooks for ransomware attacks, and just 29% have plans addressing third-party incidents. Two-thirds conduct tabletop exercises only once every one to two years, despite many organizations now facing critical incidents monthly or weekly.
Even where response plans exist, organizations may lack the resources to execute them. While 88% have a crisis communications plan, more than four in ten have not secured the external specialists those plans depend on.
“Across the incidents and claims we support every year, the organizations that prepare and practice before an incident consistently fare better than those improvising in the moment,” said Thomas Reagan, Global Head of Cyber, Marsh Risk. “Working with CYGNVS, we want to help clients see where they stand against their peers and close those gaps before they face a debilitating business critical incident.”
Artificial intelligence is introducing further challenges. Nearly nine in ten organizations reported experiencing an AI incident, including instances of rogue agents, autonomous systems exceeding their intended boundaries and AI bypassing established guardrails.
Despite widespread AI adoption, only one in three organizations test their AI models against attacks, and nearly half say they would improvise their response to an AI incident. More than two-thirds are not confident in their ability to respond effectively.
The report also highlights a growing documentation problem. The proportion of organizations required to formally document security incidents increased from 82% in 2023 to 90% in 2026. Yet 69% acknowledge gaps in their records of who did what and when during an incident, while 52% lack a defined process for regulatory notifications.
One of the clearest distinctions identified in the research is between organizations that have experienced a critical incident and those that have not. Businesses with firsthand experience were more advanced across nearly every stage of the incident response lifecycle, suggesting that practical experience remains a major driver of resilience.
“Every board and leader wants to know how their organization compares to its peers,” said Arvind Parthasarathi, Founder and CEO of CYGNVS. “Most of this data never sees daylight because incident response happens under high confidentiality. As we observe Cybersecurity Awareness Month in October, this report can help more organizations learn the easy way.”
Alongside the research, CYGNVS has launched its Resilience Benchmark capability, allowing organizations to measure their incident readiness against industry peers based on size, sector and geography. The platform provides recommendations to help businesses identify weaknesses before they experience a major incident.
The findings reinforce a central challenge for organizations: as cyber and AI incidents become more frequent and complex, annual planning exercises and static response documents may no longer be enough to ensure business resilience.
The full report is available at CYGNVS.com/resilience.
