The cyber resilience divide

Executives are already feeling the impact. Two-thirds of companies report experiencing at least one significant cyber security incident in the past 12 months, and they say the frequency of threats has increased over the past three years.

As a result, cyber resilience – the ability to adapt to evolving threats and protect the business from significant disruption and long-term damage – is now at the top of executive agendas: 67% say it’s critical to overall strategy, while just 33% see it as a technical requirement.

But despite their shared recognition of risk, organizations aren’t all reacting in the same way. Our research reveals a growing divide between organizations that are building true cyber resilience through leadership, investment and innovation and the ones that are still vulnerable.

When governance is addressed, it’s often reactive. More than half (56%) of organizations retrofit existing cyber security controls after technologies are deployed, instead of investing in targeted measures from the start. Governance frameworks that aren’t fit for purpose leave gaps vulnerable to exploitation.

Visibility is another challenge. Many executives say they don’t know where or how employees are using AI. 57% say that unmanaged or “shadow” AI tools represent a growing risk to their organization. They can’t govern AI effectively without this oversight.

But the research also reveals a powerful upside to AI. When organizations get their governance right, the benefits go beyond security. Nearly seven in 10 (68%) executives say that strong AI security frameworks help to build trust with customers and partners, supporting retention and long-term business value. So balancing AI adoption with cyber risk is complex, but the rewards for organizations that get it right can be significant.

Traditional cyber security measures were built around prevention. But as attacks become a constant threat and sophistication grows, the complete elimination of cyber incidents is no longer realistic.

Executives seem to understand this: 67% say their cyber security strategies now assume breaches will occur and aren’t focusing on prevention alone. This means that the real test of cyber resilience is no longer about whether organizations can stop every incident. Instead, the test is whether they can continue operating when an attack happens. Organizations need to prepare their security frameworks for the worst-case scenario.

Our research shows there’s a clear divide between organizations in how they approach this challenge. Some executives are confident in their ability to respond to major cyber security incidents and recover critical operations without incurring significant commercial damage. These are the “leaders” in our research. But others are still worrying about the impact an attack would have on their business. These are the “laggards.”

The difference in confidence between the two groups reflects the difference in their strategic choices. Here, we examine what’s fueling the leader group’s cyber resilience, why the laggards lack confidence and what other executives can learn from both groups.

The leader group also understands that resilience requires constant learning. Almost all of them (93%) regularly learn from internal and external cyber incidents, compared with just 35% of laggards. And 73% actively collaborate with external partners, peers and industry groups to share intelligence – less than half (49%) of laggards do the same.

For leading organizations, cyber resilience is embedded into their day-to-day culture and decision-making. It’s not confined to the IT function.

The most resilient organizations manage innovation responsibly. Our research shows that the leader group deliberately strikes a balance between innovation and governance: 72% say they adopt emerging technologies cautiously – only once cyber risks are well understood and guardrails are in place.

Laggards take a different approach. The majority (59%) prioritize early adoption, even when they don’t fully understand the security implications. Laggards might win the deployment race, but these knowledge gaps could have devastating consequences if they expose the organization to cyber criminals.

This divide is especially apparent in AI strategies. The leader group is four times as likely to have strategies that enable AI-driven innovation without introducing unacceptable cyber risks. They have a good understanding of where and how AI is used by their employees: 56% are monitoring shadow AI use, compared with just 27% of laggards.

The leader group is also getting ahead on AI’s next frontier: agentic AI. Six in 10 (61%) are embedding security controls for agentic systems, compared with 28% of laggards.

Unlike traditional AI models, which are largely confined to pattern recognition and predefined tasks, agentic systems can act autonomously and make decisions with limited human input or oversight. This difference significantly expands the threat landscape.

Internally, agentic AI can introduce vulnerabilities by interacting with multiple systems and acting in ways that are more challenging to monitor or control. Cyber criminals can use it for more frequent, adaptive and persistent attacks.

Agentic knowledge gaps are a problem for laggards: 71% say that internal agentic AI introduces cyber risks they don’t fully understand yet, compared with just 37% of the leader group.

They’re even more worried about how the technology will be used by cyber criminals. Eight in 10 (81%) say agentic AI-driven cyber attacks introduce new resilience requirements that they aren’t prepared for, compared with 38% of the leader group.

As AI adoption accelerates, organizations need to close these knowledge gaps quickly through upskilling, hiring or partnerships.