Summary
- Only 41% of UK and US cybersecurity managers surveyed are very confident in handling a major incident, down from 61% in 2025.
- Just 45% report regularly testing incident response plans, while 39% have a designated response lead or team and 39% a documented plan.
- Among respondents who experienced an incident, 42% report disruption lasting four days or longer; expectations of increased response spending have also weakened.
Confidence in the ability to manage a major cyber incident has fallen sharply among UK and US cybersecurity managers, although fewer than half of the organisations in a new survey regularly test their response arrangements.
Research from business resilience specialist IO found that 41% of respondents were very confident their organisation could handle a serious incident, compared with 61% in last year’s study. The 20-percentage-point fall comes alongside substantial gaps in preparation, with only 45% reporting regular testing of incident response plans.
The first chapter of IO’s State of Information Security research, titled The Confidence Gap, also found that 39% of respondents had a designated response team or individual, while the same proportion reported having a documented incident response plan. Separately, 42% said their organisation had tested its defences against emerging threats.
The findings come from a survey of 3,000 cybersecurity managers across the UK and US, including 2,000 UK respondents and 1,000 US respondents. Censuswide conducted the fieldwork between 14 September and 1 October 2026 across seven industry groups, including finance, healthcare, manufacturing and utilities, and transport. The year-on-year comparison uses separate survey samples rather than tracking the same organisations.
Operational disruption is already prominent in respondents’ experiences. Among managers whose organisations had experienced a cybersecurity incident, 83% said their worst incident interrupted operations for at least a day, and 42% reported disruption lasting four days or longer. Across the full survey, 71% identified a cyberattack as the greatest threat to their organisation’s ability to continue trading over the next 12 months.
Chris Newton-Smith, CEO of IO, said: “Organisations’ confidence in their ability to handle a major cyber-attack has dropped sharply, but organisations aren’t doing enough to address their concerns at a time when AI adoption, expanding attack surfaces and more sophisticated threat actors are making the threat landscape more complex.”
Testing and ownership remain inconsistent
The gaps concern more than the existence of a written document. A response plan needs to establish who can authorise containment, how technical and operational teams coordinate recovery, and who manages decisions about customer communications, regulators, and outside suppliers. Exercises can reveal whether these arrangements work when normal systems, personnel, or communications channels become unavailable.
The UK’s National Cyber Security Centre guidance distinguishes between creating a response plan and exercising an existing one. It recommends realistic exercises that test organisational procedures and expose weaknesses before an actual incident. A tabletop rehearsal and a technical recovery test measure different aspects of readiness, so their frequency alone does not establish whether an organisation can maintain essential operations.
Financial expectations add another constraint. Half of surveyed managers expected increased spending on incident response and crisis management in 2026, down from 61% in the previous study. The proportion expecting greater investment in threat intelligence and threat hunting fell from 67% to 54%. These results indicate fewer respondents anticipating increases, rather than demonstrating that spending across either area is falling.
Among respondents who experienced a security incident during the preceding 12 months, one in four placed the cost of their most significant incident between £100,001 and £250,000. Technical remediation and recovery (22%), downtime or lost revenue (17%), and subsequent increases in insurance premiums (15%) were among the leading cost components cited by respondents.
Newton-Smith said: “Ultimately, resilience is about being able to maintain critical operations and keep the business running when disruption strikes. However, effective incident response starts long before a crisis occurs.”
The issue also intersects with proposed UK cyber resilience legislation. The Cyber Security and Resilience (Network and Information Systems) Bill completed its House of Lords stages on 2 November and returned to the Commons with amendments. Its proposed changes include stronger security and incident reporting requirements for specified essential services and digital infrastructure, rather than a blanket new duty for every business.
The survey measures managers’ reported confidence and preparedness, not the effectiveness of independently tested recovery capabilities. With the legislation still under parliamentary consideration, its eventual scope and implementation timetable remain subject to the final legislative process.
