73% of Organizations Admit They Are Not Fully Ready for a Major Cyberattack, New Research Reveals

New research from The State of Incident Response Readiness 2026, based on a survey of 600 senior IT security decision-makers conducted by Vanson Bourne, reveals that 73% of organizations admit they would not be ‘fully ready’ if a significant cybersecurity attack occurred tomorrow. The report highlights a critical gap between having incident response capabilities and executing them effectively under pressure.

Key findings include:

• 76% of organizations experienced at least one cyberattack in the past 12 months, with 32% experiencing more than one.
• Fewer than 40% of respondents described key incident response components as ‘highly effective,’ including documented plans, tabletop exercises, threat hunting, digital forensics, and 24/7 monitoring.
• 90% of organizations expect difficulty coordinating stakeholders during a significant incident, and 75% agree delays or uncertainty around legal and communications team involvement slow decision-making.
• 89% cite limited executive or board involvement in incident response readiness and decision-making.
• 78% of respondents agree blind spots in their environment create persistent attacker access and increase the risk of repeated incidents.
• 84% of organizations are concerned about attackers crossing from corporate IT systems into operational technology (OT) or industrial control system (ICS) environments.
• Ransomware and cloud environment attacks are the leading future concerns, with organizations preparing for a crowded threat landscape including cloud compromise, identity abuse, third-party risk, and AI-enabled threats.
• Nearly one-third of organizations now report extensive AI use across threat detection and incident response, up from 25% last year, with 63% expecting AI to be embedded by 2027.
• Many organizations are re-evaluating external incident response and managed detection and response (MDR) relationships, expecting to switch providers for better proactive support, broader coverage, and faster response.

The report emphasizes that incident response readiness must be treated as an ongoing operational discipline, with clear decision rights, cross-functional coordination, validated visibility across environments, and AI used to support—not replace—response processes.