Cyber-leaders are facing mounting pressure to prove their organisations’ readiness in a time when cyber-threats are continuously advancing and the cost of breaches escalating.

According to IBM, the global average cost of a breach is now estimated at $4.88 million (£3.92m) per year, meaning there’s never been more at stake to ensure their security measures are effective.

A recent Cyber Readiness Survey, commissioned by Immersive Labs, highlights the increasing burden on cyber-leaders to demonstrate their organisations’ preparedness to top executives, particularly in light of new industry regulations.

The survey also sheds light on the threats deemed most concerning, ranging from software vulnerabilities to the risks posed by generative AI. Additionally, the data reveals the widespread occurrence of cyber-attacks, with nearly half of respondents (49%) reporting they had experienced one in the past year.

One of the most notable findings is the extensive adoption of cyber drills as a method to strengthen workforce preparedness. These exercises, designed to simulate real-world attacks, allow teams to identify gaps in their responses and improve their overall security posture.

The survey found that 94% of respondents have already implemented cyber drills or plan to do so within the next three years. Additionally, 44% of decision-makers stated that hands-on exercises are among the most effective methods for preparing against cyber-threats.

Communicating cyber-readiness to senior leadership is becoming increasingly critical, with 96% of cyber-leaders emphasising its importance for 2025.

This focus is likely driven by regulatory compliance requirements and the growing number of attacks organisations face. However, a significant challenge remains in measuring and demonstrating cyber-preparedness. Currently, only 39% of cyber decision-makers’ time is allocated to enhancing and evaluating readiness, underscoring the need for more structured assessment strategies.

A shift towards cyber drills is evident, with 57% of cyber-leaders already implementing these exercises and an additional 38% planning to do so within the next three years.

This approach ensures teams gain hands-on experience in high-stress environments, improving their ability to respond effectively when real attacks occur. Cyber drills have proven particularly valuable in exposing skill gaps, according to Immersive Labs’ research, as it allows organisations to address vulnerabilities before they can be exploited.

Despite the proactive steps being taken, 76% of cyber leaders acknowledge barriers to achieving cyber readiness.

The primary obstacle is the prioritisation of other business objectives with a more immediate return on investment, cited by 31% of respondents. However, there is a positive shift in leadership perception, with 55% of organisations reporting that their senior executives are well-versed in cyber-readiness, indicating greater awareness at the top levels of business.

When asked about the most daunting threats, companies identified software and cloud vulnerabilities (51%) as the top concerns, followed closely by ransomware attacks (46%).

Additionally, 44% of respondents flagged Generative AI threats and phishing as significant risks. Given that nearly half of surveyed businesses have experienced a cyber-attack in the past year, the need for continuous cyber readiness assessments and regular security exercises is more pressing than ever.

Recommended reading

• ‘Big Game’ Ransomware Tactics Drives Spike in Attacks
• UK Proposes Ban on Public Sector Ransomware Payments
• Ransomware Payouts Plummet by £350M in 2024

“Executives are much more attuned to cyber threats, cyber risk,” says Dan Potter, senior director of operational resilience at Immersive.

“They’re becoming a lot more savvy around this topic. They’re becoming a much more attuned to the fact that resilience is about being able to respond to a disruptive event. My personal view would be there’s lots of disruptions in the business environment today that might not be down to cyber.

“They’re having to deal with them all the time, whether that’s inflation pressures or supply chain challenges.

“I think there’s growing recognition that cyber is a particular challenge that leadership needs to be ready for, and they need to have confidence in the investments that they’re making in protecting their organisation – through the security team, through their technology infrastructure, through their supply chain – to have the capabilities in place.”