Insights on Cyber & AI Incident Readiness from 9,500+ Surveys
Critical incidents used to be rare events. Today the average CISO handles 20 a year, and more than 6 in 10 organizations say incident volume has risen over the past 12 months. AI is accelerating that pace from both directions, giving attackers speed and scale while creating a new class of incidents inside the organization.
To understand how organizations are keeping up, CYGNVS and Marsh drew from a combined dataset of more than 9,500 surveys collected over nearly four years. We believe it is one of the largest bodies of incident readiness data ever published. The results are a rare look at how organizations prepare, practice, respond and report on business-critical incidents, and where they can improve in the age of AI.
Key Takeaways:
- Prepare: 92% of organizations have documented incident response processes, but only 37% have ransomware-specific playbooks and just 29% have playbooks for third-party incidents.
- Practice: 17% of organizations don’t run tabletop exercises and another 66% run them only every one to two years, even as critical incidents now arrive monthly or weekly for many teams, meaning many organizations are having to run multiple critical incidents simultaneously.
- Respond: 88% of organizations have a crisis communications plan, but more than four in ten have not secured the outside experts that plan relies on.
- Report: The share of organizations required to formally document security incidents rose from 82% in 2023 to 90% in 2026, yet 69% of organizations admitted gaps in their records of who did what and when.
The data points to one clear pattern: organizations that have lived through a critical incident are further along the readiness curve at almost every stage. Download the report for the full findings across the resilience lifecycle, the lessons those organizations learned and five priorities for the year head.
