The incident response mistake 73% of leaders make
Having an incident response plan doesn't mean you're ready. Nearly three-quarters of security leaders say their organizations would struggle to execute IR plans during an attack.
A best practice for every enterprise is to have incident response (IR) plans to deal with potential cyberattacks. A common assumption of many organizations is that the IR plan will work in the event of an incident, but that's not always true.
A 2026 survey by incident response firm Sygnia examined incident response readiness among 600 senior IT security decision-makers and found that 73% of security leaders would not be fully ready to execute their IR plan if a major attack hits tomorrow.
The finding spans an industry where 99% of organizations have a formal IR plan in place. Organizations have the documentation. What lacks most is predetermined decision authority and rehearsed escalation paths that hold under pressure.
Key findings from the survey:
- Seventy-six percent experienced at least one cyberattack in the past 12 months; 47% of those reported operational shutdowns, 41% data loss, 41% reputational damage and 40% lost revenue.
- Ninety percent say they would struggle to coordinate stakeholders during a significant incident.
- Eighty-nine percent cite limited executive or board involvement in IR readiness and decision-making.
- Seventy-eight percent agree that blind spots in their environment increase the risk of persistent attacker access and repeat incidents.
- Thirty-two percent report extensive AI use across threat detection and IR, with 63% expecting it to be embedded across security operations by 2027.
"What really jumped out to me was the level of doubt expressed by senior security leaders about their readiness to respond to a cyberattack," said Matthew Mosley, incident response manager at Sygnia.
Mosley noted that when he speaks to companies about their IR plans, they often say, 'We're prepared, we're ready to go.' The research, however, shows that respondents are less sure of their readiness, largely because they don't have the right channels in place to respond quickly enough.
"We didn't expect that despite concrete IR playbooks, plans, and technological capabilities, senior security leaders are still facing hurdles with executives, legal and comms teams, who they felt were slowing down the escalation process during a crisis," Mosley said.
Critical gaps undermining IR readiness
The survey points to a consistent pattern across sectors. Organizations have laid the foundations of incident response, but those foundations are not holding up under pressure.
The organizational friction crisis
Among the most consistent CISO challenges in the survey is the gap between technical readiness and executive alignment. Ninety percent of respondents say they would struggle to coordinate stakeholders during a significant incident. Eighty-nine percent cite limited executive or board involvement in IR readiness and decision-making.
Security teams operate in isolation from business units, legal and executive leadership, with no pre-defined authority over who acts when a crisis hits.
"Cyber incidents are incredibly complex ordeals with many moving parts to manage and stay ahead of, so when ownership and escalation paths aren't clearly aligned, technical progress and static response playbooks can fail at the first unanticipated hurdle," Mosley said.
When executives are not engaged, and authority is unclear, IR team coordination breaks down the moment it is needed most.
"Hand in hand with human factors like decision paralysis and conflicting opinions between teams of stakeholders, this is where things can really grind to a halt," Mosley said.
The cross-environment visibility problem
Seventy-eight percent of respondents agree that blind spots in their environment increase the risk of persistent attacker access and repeat incidents. Public cloud tops the visibility gap list at 90%, with on-premises infrastructure, endpoints, OT/ICS and SaaS each cited by 89%.
Fragmented tools and incomplete asset inventories leave gaps in monitoring that attackers can exploit to establish persistence. Without cross-environment visibility, blind spots become a recurring liability.
"In both areas, even after successful detection and containment, if the blind spots that allowed them entry in the first place aren't addressed, they will attempt to repeatedly use them," Mosley said.
Attackers exploit these gaps to move laterally using stolen credentials in cloud environments and legacy footholds in OT/ICS, maintaining access well after initial detection.
The AI era threat expansion
Thirty-one percent of organizations report extensive AI use across threat detection and IR, up from 25% a year ago, with 63% expecting it to be embedded across security operations by 2027.
AI adoption is outpacing the governance frameworks organizations have in place to manage it. "If your IR plan was last updated before your org deployed an LLM-connected application, it describes a threat environment that no longer exists," said Eric Hulse, director of security research at Command Zero.
The governance requirement is non-negotiable. "AI on the defense side isn't optional, and it isn't a differentiator anymore. It's now the baseline, but it still has to be governed," said Shane Barney, CISO at Keeper Security.
The sector-specific reality
No industry is immune, but some sectors face significantly higher attack rates.
Cyberattacks in the past 12 months were highest in crypto and decentralized finance at 83%, retail at 79% and manufacturing at 76%. Ransomware led threat concerns at 46%, followed by cloud attacks at 44% and email compromise at 37%.
The variety of attack vectors means organizations must defend against multiple simultaneous threat types.
For CIOs and IT executives, security can no longer be treated as a CISO concern alone. Business continuity, customer trust and regulatory compliance all depend on effective incident response capabilities across the entire organization.
What this means for your organization
The survey findings translate into distinct business and sector implications for leadership teams.
The business impact translation
For CIOs, SOC readiness counts for little without pre-authorized decision authority. System shutdowns, service suspensions and recovery decisions require that authority to be documented before an incident
For CFOs, IR failures register on the balance sheet well before they appear in an audit. "When incident response breaks down, organizations lose the ability to contain, to communicate and to operate," Barney said. "That translates directly into downtime, regulatory exposure, customer attrition and long-tail reputational damage."
For boards, cyber risk is business risk that requires active, rehearsed oversight at the leadership level. SEC rules require material breach notification within four business days of determining materiality. Most boards have never rehearsed that scenario under live-incident conditions.
"The board question is no longer 'were we breached?' It's 'can we stand behind a public disclosure in four days, while the incident is still active and the scope is still unknown?'" Hulse said.
The sector reality check
Crypto and decentralized finance recorded the highest attack rate in the past 12 months at 83%, followed by retail at 79% and manufacturing at 76%. Ransomware remains the top threat concern at 46%, followed by cloud attacks at 44% and email compromise at 37%.
The 2026 Sygnia CISO Survey found no single dominant threat. Organizations face exposure across every attack vector.
Actions IT leaders must take
Three-time horizon structure and plans help prepare an enterprise for action
Immediate actions
Establish decision authority before an incident forces the issue.
- Conduct an executive alignment assessment. Identify who holds pre-authorized decision rights over containment, ransomware payments and regulatory notification across CISO, CIO, CFO, legal and communications. "If there's ambiguity in who makes the call during an incident, that's your first failure point," Barney said.
- Audit cross-environment visibility. Inventory assets across on-premises, cloud and OT to identify monitoring gaps and lateral movement risks.
- Evaluate AI security governance. Inventory deployed AI tools, assess governance frameworks and assign ownership over systems that could become attack vectors.
Medium-term initiatives
Test the authority structure and secure the external partnerships needed when a real incident hits.
- Run executive-level IR simulations. Put the board and C-suite in the decision seat. "The board has four or five critical calls to make in a real breach. They need to have made them before the phone rings," Hulse said.
- Establish pre-approved IR partner relationships. Retain forensics, legal and crisis communications partners under pre-approved terms with 24/7 contacts.
- Close cross-environment integration gaps. Implement unified security monitoring and centralized logging across cloud, endpoint and OT.
Long-term strategic actions
Embed board cyber oversight and continuous improvement into the operating model.
- Operationalize board cyber oversight. Name a board liaison accountable for IR exercise outcomes. "Walk in with the decisions the board owns: which business processes would end the company if they stopped for 30 days, what attack surface puts each one at risk, and what they're choosing for each: accept, fund, or transfer," said Bradley Smith, senior vice president and deputy CISO at BeyondTrust. "The recommendation is yours, but the decision is theirs."
- Build a continuous IR improvement program. Run quarterly reviews on real-incident lessons and track time-to-detect, time-to-contain and coordination speed.
- Develop AI-specific IR capabilities. Train IR teams on LLM poisoning and agent-to-agent attack vectors and establish dedicated response playbooks.
Determining readiness success
Readiness is not measured by what is in place. Just 33% of respondents rated their documented IR plan as highly effective, even though 97% have one in place.
The metrics that matter are behavioral. "The organizations that build real maturity update after incidents. The ones checking boxes update after audits," Hulse said.
The readiness checklist:
- Executive alignment. C-suite knows its IR roles and can make rapid decisions.
- Unified visibility. Proven visibility across all environments, without blind spots.
- Tested readiness. Simulations have exposed and fixed friction points.
- AI governance. AI tools are governed and monitored, not deployed without oversight.
- Partner readiness. External IR partners are retained and can mobilize immediately.
Organizations that close the readiness gap recover faster, retain customer trust and maintain competitive positioning. In an environment where 76% of organizations face at least one attack annually, IR readiness is a measurable business advantage.
Key executive takeaways
The survey findings carry clear implications for how leadership teams prioritize and act.
- Ninety-nine percent of organizations have a formal IR plan. Seventy-three percent say they would not be fully ready to execute it under real attack conditions.
- The readiness gap is fixable. Pre-authorized decision sequences, documented escalation authority and regular rehearsal are changes any leadership team can make.
- The data alone is not enough to drive action. "If the C suite doesn't feel uncomfortable, there hasn't been the right conversation," said Gareth Lindahl-Wise, CISO at Ontinue.
- The starting point is specific. "Run tabletops as often as you can, find the pain, expose the gaps, and surface the misses before an attacker does it for you," said David Lindner, CISO at Contrast Security.
- The only honest measure of IR readiness is pressure. "No one knows when the next breach could happen or how, but the only way to truly know if an incident response framework is battle-ready is to test it under pressure," Mosley said.
Sean Michael Kerner is an IT consultant, technology enthusiast and tinkerer. He has pulled Token Ring, configured NetWare and been known to compile his own Linux kernel. He consults with industry and media organizations on technology issues.
