Prepare · Practice · Respond · Report
Cyber Resilience
Benchmark Hub
CYGNVS and Marsh gathered more than 9,500 surveys for a rare look at how ready organizations really are for cyber and AI incidents. Benchmark your organization today to find resilience gaps before a critical incident does.
AI Is Outpacing
Incident Readiness
Critical incidents used to be rare events. Today, the average CISO reports handling 20 a year, and more than 6 in 10 organizations say incident volume has increased in the past 12 months.
Three Shifts Redefining Cyber Resilience
Shift 01
AI Is Now an Incident Source, Not Just a Threat Vector
89%
of organizations have already faced some kind of AI incident, including rogue agents, data leakage, hallucinations and broken guardrails.
Shift 02
Plans Exist but Response Is Still Chaotic
67%
haven't mapped clear owners for their most critical processes and dependencies, which slows every decision once an incident hits.
Shift 03
Board Interest in Cyber Readiness Is Increasing
91%
of CISOs say their board has become more involved in the past 12 months and nearly half say significantly more.
CYGNVS Resilience Benchmark Report
Get the full data on how organizations perform across every stage of cyber resilience: prepare, practice, respond and report. Plus five moves to make in the year ahead.
Resilience Is a Muscle That Most Organizations Train Just Once a Year
Resilience is built in four stages: Prepare, Practice, Respond and Report. Each stage builds on the last, so a weakness early in the lifecycle tends to resurface later, under pressure, when it costs the most.
Prepare
Specific, Current and Executable
Almost every organization has an incident response plan. Far fewer know if it would hold up. 52% have never benchmarked their plan against an outside standard.
Practice
Practice Is Where a Plan Gets Proven
Critical incidents now arrive monthly or even weekly for many teams. Yet 66% of organizations run tabletop exercises only once a year or every two years.
Respond
Containment Moves Faster When Everyone Works from One Picture
Every minute counts in a live incident. Yet 69% of organizations don't have a platform that acts as a single source of truth for status, tasks and decisions.
Report
Building a Record That Holds Up Under Scrutiny
When the incident ends, the questions begin. Only 29% of organizations feel completely ready to meet disclosure deadlines in every jurisdiction that applies to them.
Source: CYGNVS Resilience Benchmark Report.
Benchmark Your Cyber Resilience Against Your Peers
Take the CYGNVS Resilience Benchmark survey, which maps your organization against seven dimensions within the Prepare, Practice, Respond and Report framework. You'll get a custom view of where your organization lands on each stage and tailored recommendations to improve your resilience.
Takes less than 10 minutes. Get a custom report with your score, benchmarks and recommendations, emailed straight to you. Your responses are kept confidential.
Sample benchmark results report
“Our mission is to help organizations everywhere turn business-critical incidents into business-as-usual.”
CYGNVS and Marsh drew from a combined dataset of over 9,500 surveys collected from January 2023 through September 2026. Respondents spanned 21 industries across Asian, European and North American countries.