Cyber Performance Centre, Hack The Box, has released new data showcasing the perspectives of chief information security officers (CISOs) towards cyber-preparedness in 2025. 

In the aftermath of a number of high-profile cybersecurity incidents in 2024, CISOs are reassessing their organisation’s readiness to manage a potential  “chaos” of a full-scale cyber crisis.  

According to the data many CISOs across the UK and US, are concerned about their organisation’s ability to handle a cyber-crisis due to a number of reasons including the rising volume of cyber-incidents (31%), lack of incident response planning (20%), and a lack of realistic, stress-tested crisis simulations (19%).  

It’s these drivers that are motivating CISOs to reallocate budgets towards crisis preparedness, as they seek to maintain security posture.

With regards to key findings, the report found that 74% of CISOs reported their organisations are increasing annual budgets for crisis simulation exercises in 2025, motivated by last year’s major incidents. 

Further, 73% identified practical crisis simulations and incident response exercises involving both technical and non-technical teams – as their top business priority for 2025. 

Finally, 77% stated they would allocate greater budgets for cyber crisis simulations if the exercises were more realistic and actionable. 

The findings highlight a growing recognition among CISOs of the importance of realistic, hands-on crisis simulations to build visibility and ensure their organisations can respond effectively during a crisis. In fact, according to the report, as much as 16% of 2025 security budgets are being reallocated to simulation exercises following last year’s incidents. 

Recommended reading

• Two-thirds of CISOs Have Had Budgets Slashed Due to AI
• Half of Cybersecurity Professionals Expect to Burnout Within the Next Year
• Cyber Leaders Reveal Compliance and Boardroom Struggles

Haris Pylarinos, CEO and founder at Hack The Box, commented: “Preparedness is the foundation of resilience, and crisis simulations play a crucial role in testing organisation’s security and workforce performance when it’s most critical. Organisations are right to prioritise crisis simulation and must ensure that these are implemented in the right way.

“There is a need for these exercises to be increasingly realistic and engaging, to equip both technical and non-technical teams of all levels with the confidence needed to decisively defend against evolving threats.”