CYGNVS, in collaboration with Marsh, a leading global professional services firm, published the CYGNVS Resilience Benchmark Report. Based on more than 9,500 survey responses from organizations worldwide, the report examines how businesses prepare for, rehearse, manage and report on business-critical incidents. It represents one of the largest collections of organizational survey data focused on incident readiness and resilience to date.
Cyber incidents are accelerating. More than 6 in 10 organizations say incident volume has risen over the past 12 months, and 91% said their board became more involved. Yet 84% review their incident response plans once a year or less and 17% do not run tabletop exercises at all, a rhythm set when critical incidents were rare. Organizations that had lived through a critical incident were further along at nearly every stage of the response lifecycle, and the report shows how others can put those lessons in place before an incident forces the issue.
“Across the incidents and claims we support every year, the organizations that prepare and practice before an incident consistently fare better than those improvising in the moment,” said Thomas Reagan, Global Head of Cyber, Marsh Risk. “Working with CYGNVS, we want to help clients see where they stand against their peers and close those gaps before they face a debilitating business critical incident.”
AI incidents are upon us. The report finds that nearly nine in ten organizations have already faced an AI incident, where the AI misbehaves to cause some form of harm, including rogue agents, agentic runaway and jumping guardrails. While 80% of organizations use generative AI, only one in three test their AI models against attacks.
AI oversight is lagging adoption. Organizations use AI for marketing nearly three times as often as for risk assessment, which puts the fastest adoption in the functions least likely to be tested or governed. When an AI incident does occur, nearly half of organizations reported they would improvise their response. The reporting burden is growing as well, with more than 50 jurisdictions now having laws or rules on AI incidents. Meanwhile, 52% have no defined process for regulatory notifications. Only one in three have a dedicated out-of-band environment to manage the AI incident that the AI being investigated cannot access or interfere with.
The report maps its findings across the Prepare, Practice, Respond and Report incident response lifecycle:
- Prepare:Â 92% of organizations have documented incident response processes, but only 37% have ransomware-specific playbooks and just 29% have playbooks for third-party incidents.
- Practice:Â 17% of organizations don’t run tabletop exercises and another 66% run them only every one to two years, even as critical incidents now arrive monthly or weekly for many teams, meaning many organizations are having to run multiple critical incidents simultaneously.
- Respond:Â 88% of organizations have a crisis communications plan, but more than four in ten have not secured the outside experts that plan relies on.
- Report:Â The share of organizations required to formally document security incidents rose from 82% in 2023 to 90% in 2026, yet 69% of organizations admitted gaps in their records of who did what and when.
“Every board and leader wants to know how their organization compares to its peers,” said Arvind Parthasarathi, Founder and CEO of CYGNVS. “Most of this data never sees daylight because incident response happens under high confidentiality. As we observe Cybersecurity Awareness Month in October, this report can help more organizations learn the easy way.”
Alongside the report, CYGNVS is introducing the CYGNVS Resilience Benchmark, a new capability within the CYGNVS platform that lets customers quantitatively measure their readiness to a critical cyber or AI incident and benchmark themselves against their peers by industry, size or geography. The benchmarks also provide concrete advice and steps to improve readiness and resilience. Organizations that are not yet CYGNVS customers can receive a personalized benchmark report by completing a free assessment.
Related News:
CYGNVS Launches AI Incident Command Center
CYGNVS Launches CISO Liability Insurance Coverage
About the Report
The CYGNVS Resilience Benchmark Report draws on more than 9,500 survey responses collected from organizations in more than 20 industries across Asia, Europe and North America by CYGNVS and Marsh. All responses were anonymized and deidentified, and no individual respondent or organization is identifiable.
