The state of incident response
A documented incident response plan is only one part of being ready for a cyberattack. Our research finds limited uptake of testing, clear responsibilities and recovery planning, raising concerns about how effectively organisations could respond when disruption strikes.
Confidence in incident response is plunging
Among many other things, effective cyber resilience demands well-practised incident response (IR). The security professionals we polled might appear confident in their capability. But peer closer and this assurance is built on sand. It underscores the lack of a standardised, best practice approach to IR.
On the face of it, there’s widespread recognition of the importance of rapid response and recovery. Some 71% of respondents agree that a cyber-attack is the single biggest threat to their ability to keep trading over the next 12 months. It’s also good news that 94% feel confident in their organisation’s ability to respond to a major cybersecurity incident; a figure virtually unchanged from last year.
But drill down further and only 41% describe themselves as “very confident”. That figure has collapsed from 61% last year. The share of respondents admitting their confidence has decreased over the course of 12 months doubled from 5% to 11%. Could this be a recognition of the fact that organisations are still not getting the IR basics right?
Only one of 10 IR best practices – putting in place a documented IR plan – has seen an increase in take up since last year. And in some disciplines, such as automation and tooling (31% vs 40%) or real-time threat intelligence (38% vs 44%) there has been a significant drop off from 2025 to 2026. On average, IR efforts in 2026 contain fewer than four of these 10 best practices.
The share of respondents admitting their confidence has decreased over the course of 12 months doubled from 5% to 11%. Could this be a recognition of the fact that organisations are still not getting the IR basics right?
How confident, if at all, are you in your organisation’s ability to respond to a major cybersecurity incident?
Has your level of confidence in your cybersecurity changed in the past 12 months?
Why best practice matters
A well-documented plan should provide the structure of what to do before, during and after an incident, from detection and triage, to containment, eradication, recovery, escalation and crisis comms.
But simply having a plan is not enough when faced with a fast-evolving threat landscape and enterprise infrastructure and staffing in constant flux. Other key areas cited by our respondents include:
A designated team or individual, which should be appointed to reduce the risk of fragmentation between the various teams (security, comms, legal etc) that are likely to be involved. Two-fifths (39%) of our respondents cite this.
Defined roles and responsibilities (43% of respondents) that ensure everyone chosen to be part of the cross-functional IR team knows exactly what to do, and what is expected of them, during a crisis. This can remove uncertainty over who has the authority to make key decisions, when seconds matter.
Regular testing (45%) through tabletop exercises and more immersive attack simulations. These can help to expose previously unseen gaps and dependencies and enable participants to develop IR “muscle memory”.
Real-time threat intelligence (38%) which can help first responders understand their adversary better and make key decisions on response and containment faster.
Tooling like SIEM and SOAR (31%) which correlate alerts and automate repetitive tasks to ensure responders focus on high-judgement work.
Integration with business continuity and disaster recovery (37%) which is vital to ensure any IR decisions that are made don’t undermine recovery, or the ability to keep critical operations running during an incident.
Post-incident reviews (36%) which help to feed a virtuous cycle of continuous improvement, so that lessons learnt can ensure the next incident is handled more effectively.
Communications plans (36%) which ensure regulators, customers and other stakeholders are kept up to date with the right amount of information. Poor comms can compound the challenges of IR and the damage caused by an incident.
External support (30%) which is sometimes required from specialist PR agencies, legal practices, and other service providers. It’s important that these relationships are established before an incident occurs.
Earlier you said, you are confident in your organisation’s ability to respond to a major cybersecurity incident, what does your incident response plan consist of?
The fact that none of these best practices can boast take up of half or more respondents tells us much about the maturity of IR posture today. Progress appears to have stalled or gone backwards in many cases. Testing remains flat year-on-year, while the share of organisations citing tooling (40% to 31%) and external support (37% to 30%) fell significantly. What’s more, the stats only refer to those respondents that are confident in their ability to respond to a major incident.
There may be a connection between these findings and the fact that two-fifths (38%) of all respondents surveyed this year admit that digital resilience is a challenge.
IR means resilience
The truth is that without a coherent, well-practised and integrated response to cybersecurity incidents, organisations can’t hope to swiftly recover while minimising disruption. At first glance, our respondents once again appear confident that they could do so: 76% believe they could keep trading through a major attack, for example. Yet only 27% strongly agree.
It’s a similar picture when asked if they could detect and recover from an AI-driven attack. Some 77% say they are confident they could do so, but just 29% strongly agree. That makes sense considering the relatively low adoption of IR best practices. It’s also telling that only two-fifths (42%) of responding organisations have tested their defences against emerging threats. Even fewer (37%) have updated their IR plans accordingly.
It’s heartening that 51% of respondents expect their organisation to increase spending on IR in the coming year, even if only a fifth (22%) say they are prioritising it.
The truth is that without a coherent, well-practised and integrated response to cybersecurity incidents, organisations can’t hope to swiftly recover while minimising disruption.
To what extent do you agree or disagree with the following statements about the information security landscape?
