The state of information security report 2026
AI is increasingly shaping the information security landscape. It introduces risks such as shadow AI, data poisoning and malicious use, while at the same time offering defenders new ways to strengthen resilience and close critical skills gaps.
Foreword
IO CEO Chris Newton-Smith introduces the 2026 findings and what they reveal about organisational preparedness and business resilience.
The confidence gap
The year-on-year findings reveal where expectations and organisational capabilities are beginning to diverge.
The state of AI security
AI-powered attacks command attention, but this year’s research points to a more immediate challenge inside organisations.
The state of security incidents
The incidents causing serious disruption are often familiar rather than sophisticated.
The state of incident response
Our research finds limited uptake of testing, clear responsibilities and recovery planning, raising concerns about how effectively organisations could respond when disruption strikes.
The state of business resilience
Exploring the distance between an integrated ambition and operational reality.
The state of security compliance
As regulatory pressures mount, are existing approaches helping organisations manage risk or adding to the workload?
The state of the supply chain
Against a backdrop of complex dependencies and changing expectations, the findings reveal a persistent disconnect between exposure and action.
The state of security leadership
Leadership engagement remains inconsistent, even as regulatory expectations become more explicit.
Conclusion
As organisations contend with evolving threats and increasing pressures, the fundamentals of governance, accountability and resilience remain critical.
