Recovery Confidence Plummets As Incident Response Time Lags

Elizabeth Greenberg

04 November 2026, 11.18am

“Organisations’ confidence in their ability to handle a major cyber-attack has dropped sharply,” Chris Newton-Smith, CEO of IO said.

Confidence among businesses in their ability to handle a major cyber incident has fallen sharply over the past year according to new research from business resilience specialists, IO.

Chapter 1: The Confidence Gap from IO’s The State of Information Security report reveals that just 41% of UK and US cybersecurity managers surveyed say they are very confident they could handle a major cyber incident, down from 61% last year – suggesting that confidence in organisational resilience is weakening at precisely the time the threat landscape is becoming more challenging.

Yet as confidence in organisational resilience declines, the research shows that organisations are still failing to act, with fewer than half (45%)* of organisations regularly testing their incident response plan. Even fewer have a designated incident response team or individual (39%) or a documented incident response plan (IRP) (39%). Similarly, only 42% of all companies surveyed have tested their defences against emerging threats.

This is particularly concerning given that 71% of organisations surveyed see a cyber-attack as the single biggest threat to their ability to continue trading over the next 12 months. According to the research, 83% of those who experienced a cybersecurity incident say their organisation’s worst incident disrupted operations for at least a day, while 42% experienced disruption lasting four days or more.

Chris Newton-Smith, CEO of IO explains, “Organisations’ confidence in their ability to handle a major cyber-attack has dropped sharply, but organisations aren’t doing enough to address their concerns at a time when AI adoption, expanding attack surfaces and more sophisticated threat actors are making the threat landscape more complex. And unfortunately, we’ve seen recent attacks resulting from the fact that the basics still aren’t being done right.

“The research shows incident response plans haven’t changed, and fewer than half aren’t regularly tested. Our research also showed that plans include fewer than four out of ten common elements on average, including regular testing, defined roles and responsibilities, and communication plans for regulators and customers.”

The lack in preparedness is compounded by the fact that cybersecurity managers do not expect security spending to increase this year in several crucial areas, including incident response and crisis management (down from 61% last year to 50% this year) and threat intelligence and threat hunting (down from 67% to 54%).

Despite many organisations not increasing their security spending this year, it could ultimately cost them more when an attack occurs.

A quarter of respondents who have experienced any cyber security or information security incidents in the last 12 months said that their most significant security incident cost between £100,001 and £250,000. The largest components of that cost were technical remediation and recovery (22%), downtime or lost revenue due to the incident (17%) and higher insurance premiums after the incident (15%).

Strong governance provides the foundations for resilience by establishing clear ownership, defining responsibilities and ensuring the right processes are in place to support informed decision-making under pressure. Without this clarity, even the most carefully documented incident response plan can falter at a time when it is most needed.

“Therefore, resilience must now be viewed as a core pillar of cybersecurity and governance, rather than a separate consideration. Regulations such as the Cyber Security and Resilience Bill, alongside initiatives such as the Cyber Resilience Pledge, reinforce the growing emphasis on organisations taking a proactive, structured approach to managing cyber risk and maintaining operational continuity,” Newton-Smith concludes.