Risk Management Consulting
 

2026 Cyber Resilience Benchmark: how prepared are UK organisations?

Our survey of 33 UK technology and security leaders shows strong security foundations, but real gaps in testing, third-party risk and readiness for new regulation.

The UK threat landscape has shifted sharply over the past two years. Ransomware gangs are targeting essential services, nation-state actors are more persistent, and the NCSC reports attacks rising in both volume and sophistication.

At the same time, regulation is going through its biggest overhaul in a decade. DORA and the NIS2 Directive already reach UK organisations with European operations, and the UK’s own Cyber Security and Resilience Bill is set to widen the net further.

To understand how organisations are responding, Xcina Consulting surveyed CIOs, CTOs, CISOs and other senior security leaders across 31 questions. This article summarises what we found. The full report benchmarks every question against good practice and emerging trends, and is free to download below.

About the survey

The survey ran in the first half of 2026 and drew responses from 33 organisations. Respondents held senior technology or security roles, or their equivalent where formal titles differ.

• Sectors: financial services, technology and telecommunications made up 79% of participants.

Size: 70-75% had revenues under £100 million and fewer than 1,000 staff, so the results speak strongly to the mid-market.

• Scope: governance, regulation, risk, data protection, incident response, technical controls, people and future outlook.

While the sample size is not statistically representative of the UK market, the findings are directional, designed to help leaders compare their own practices with those of their peers.

Key findings at a glance

Statistic Finding
85% enforce multi-factor authentication for all users and all systems
76% see AI and machine learning as the biggest emerging cyber risk over the next 12 months
64% have a documented cyber resilience strategy that is regularly reviewed
52% run 24/7 security monitoring through a SOC with SIEM and advanced threat detection
48% have not yet started preparing for the Cyber Security and Resilience Bill or NIS2, or consider it not applicable
39% have an incident response plan that is not regularly tested, or no formal plan at all
30% would need more than seven days to recover from ransomware, or do not know how long it would take
18% run a comprehensive third-party risk programme with continuous monitoring

What the survey found

Governance and strategy: commitment is high, independence is not

Most organisations treat cyber as a business issue. 64% have a documented, regularly reviewed strategy, and 64% spend at least 10% of their IT budget on security, in line with good practice. 70% hold comprehensive cyber insurance that they review regularly.

Oversight is less consistent. Only 48% of boards or executives review cyber resilience at least quarterly. Just 27% have a dedicated CISO reporting to the CEO or board, while 36% share security responsibility across IT leadership.

Regulation: a readiness gap is opening

ISO 27001 or NIST is the most common framework (55%), with Cyber Essentials Plus at 42%. Only 55% reported adherence to UK GDPR, which every organisation must comply with.

Preparation for the Cyber Security and Resilience Bill or NIS2 is at an early stage. Only 15% have completed a gap analysis or begun implementation, 36% are in initial assessment, and 48% have not started or see it as not applicable.

Risk management: third parties are the weak point

36% assess cyber risk continuously or at least quarterly; 45% still do so annually. Third-party risk stands out: only 18% run a comprehensive programme with continuous monitoring, and 30% rely on basic contractual terms or have no formal process. Regulations including NIS2, DORA and the forthcoming UK legislation all make supply chain risk management mandatory.

Data protection: established, but rarely comprehensive

87% have established or comprehensive data protection programmes, and 39% have a dedicated DPO with regular audits. Data loss prevention is widely deployed for key channels such as email and cloud (55%), but only 18% have comprehensive coverage with active monitoring.

Incident response and recovery: plans exist, testing lags

97% reported no significant incident in the past 12 months. But confidence in recovery is uneven. Only 18% test their incident response plan at least quarterly, and 39% either do not test it regularly or have no formal plan.

Ransomware recovery estimates vary widely. 15% believe they could fully recover within 24 hours, while 30% would need more than seven days or are unsure. 55% test business continuity and disaster recovery only once a year.

Technical controls: strong foundations

Technical hygiene is the survey’s strongest area:

  • MFA: 85% mandate it for all users and systems; the rest require it for privileged and remote access.
  • Vulnerability scanning: 61% scan continuously or use agent-based monitoring.
  • Monitoring: 52% run a 24/7 SOC; 27% monitor during business hours only.
  • Penetration testing: 79% test at least annually, and 27% quarterly.
  • Patching: 45% automate patching with defined SLAs; 55% rely on manual prioritisation.
  • Segmentation: 33% use micro-segmentation; 45% separate critical systems.

People and culture: awareness is good, live testing is rare

52% run continuous awareness training with simulated phishing. Realistic attack simulation is far less common: only 36% run red or purple team exercises at least annually, and around two-thirds do so only ad hoc or never.

Budget is the most cited barrier to building resilience (36%), followed by organisational culture and user awareness (27%), legacy systems (21%) and skills shortages (15%).

Future outlook: AI dominates, supply chain leads spending

AI and machine learning is the top emerging-technology concern (76%), followed by cloud complexity (58%) and remote and hybrid working (33%). Some respondents also flagged quantum computing.

The top investment priority for the next 12 months is supply chain and third-party risk management (58%), ahead of threat detection and response (55%) and cloud security and data protection (55%).

Five messages for technology and security leaders

 

1.

Test what you have built. Controls are strong, but plans, recoveries and defences are rarely tested under realistic conditions. Regular tabletop exercises, BC/DR tests and purple team exercises turn a plan on paper into proven resilience.

2.

Start regulatory preparation now. With nearly half of respondents yet to begin, an early applicability assessment and gap analysis against the Cyber Security and Resilience Bill and NIS2 will avoid a rush later, especially for 24-hour incident reporting.

3.

Close the third-party gap. Supply chain risk is the top investment priority, yet only 18% have a mature programme. Tier suppliers by risk, build security into contracts and move from onboarding checks to continuous monitoring.

4.

Strengthen governance and independence. Quarterly board reporting in business terms, and a security function with direct access to the CEO or board, are the clearest markers of mature organisations.

5.

Govern AI before it governs your risk. AI is the leading concern for three in four leaders. Set clear rules for its use, watch for shadow AI leaking data, and prepare staff for AI-enabled phishing and deepfakes.

The common thread is a shift from compliance-driven to risk-driven security. The organisations that thrive will treat cyber resilience as a continuous journey, not a destination.

Download the full report

 

The full 2026 Cyber Resilience Benchmark Report covers all 31 survey questions. For each one, you will find:

  • the full breakdown of participant responses
  • why the topic matters
  • good practices commonly seen across industry
  • emerging trends to plan for

Use it to benchmark your organisation against your peers and to prioritise your next investments.

Want to discuss what the findings mean for your organisation? Our Cyber Maturity team offers a free, no-obligation conversation. Contact us at info@xcinaconsulting.com.

Cyber Resilience Survey Report 2026

 

Lindsey Domingo

Senior Director
LinkedIn >>
T: +44 (0)203 745 7826

Lindsey Domingo

Xcina Management Team

Lindsey is a Senior Director at Xcina Consulting as well as the Data Protection Officer of Shearwater Group plc. He has 30 years’ experience, mainly in governance, risk and regulatory advisory roles based in the UK, continental Europe and emerging markets.

Lindsey is a Chartered Accountant, Certified Information Systems Auditor, and holds qualifications in GDPR, Governance, Risk & Compliance, Executive Coaching & Mentoring as well as Project Management.

He has led risk and compliance assurance advisory and change projects across financial and industrial sectors, and managed entire markets, with responsibility for developing teams, growing the practice, and delivering risk advisory, assurance, change management and regulatory projects. Lindsey also leads our Audit & Compliance practice.

Subscribe to Updates

Receive regular updates from our expert consultants as they provide clarification and guidance on issues impacting your organisation.

Subscribe >>