Foreword

As we publish our fourth annual State of Information Security report, it’s a question that feels particularly relevant. Our latest research, conducted independently by Censuswide, reveals a growing gap between organisations’ confidence in their preparedness and the measures they have in place to support it.

While 94% of respondents express confidence in their ability to respond to a major cybersecurity incident, the proportion who are very confident has fallen from 61% to 41% in just one year. Nearly three-quarters say they manage information security, privacy and AI as one connected system, yet only 13% have a single, current view across all three.

These findings point to a challenge that extends well beyond security teams. Businesses increasingly recognise the importance of resilience, but translating that understanding into effective governance, clear accountability and operational readiness remains difficult.

There is encouraging progress. Organisations are reporting tangible benefits from stronger security and compliance, including improved decision-making, greater efficiency and increased customer trust. Yet investment expectations have become more cautious, placing greater emphasis on how businesses prioritise resources and make the most of what they have.

What strikes me, looking at this fourth edition, is how many of the underlying challenges remain familiar. AI is introducing new risks, regulatory expectations are changing, and businesses are becoming more interconnected. Yet questions about ownership, visibility and preparedness continue to shape how effectively organisations manage risk.

I hope this report offers an opportunity to look beyond assumptions, reflect on the progress being made and consider what stronger resilience might mean in practice for your own organisation.