Cyber resilience CNG
By most measures, cyber resilience in the UK is improving. Security leaders report stronger visibility, broader controls and a better understanding of cyber risk than a year ago.
But when resilience is tested under real incident pressure, confidence can drop sharply.
What we’re seeing is a growing gap between perceived improvement and operational confidence. According to our UK Cyber Resilience Benchmark Report, 81% of organisations report an improvement in their cyber resilience. However, fewer than one in four are very confident their security approach would hold during a major incident.
That disconnect matters, because attackers don’t test resilience in theory. They test it in the middle of the night, across fragmented systems, stressed teams and overloaded suppliers.
The challenge facing security leaders today is whether their organisation can execute under pressure. The conversation has evolved beyond whether organisations have invested in security tools, to whether those tools, teams and partners can operate effectively under pressure.
When incidents happen, coordination matters more than controls
In practice, resilience fails less because of technological gaps and more because of coordination breakdowns.
During a live incident, security teams must interpret alerts, assess impact and make decisions quickly, often across complex hybrid environments. When visibility is fragmented, ownership is unclear or escalation paths are poorly defined, confidence evaporates, even if the underlying technology is strong.
Organisations need to pressuretest how incidents are handled, rather than just assess how threats are detected. That involves asking uncomfortable but necessary questions, like:
- Who leads response at each stage of an incident?
- How quickly can teams see what is happening across internal and external systems?
- How effectively do internal teams and partners coordinate when decisions need to be made fast?
Resilience is increasingly defined by how well people, processes and platforms come together when things go wrong.
Hybrid security is changing the risk equation
48% of organisations operate hybrid security models, combining internal teams with managed services, cloud platforms and specialist providers. This approach reflects how cyber defence has become too complex to rely on a single team or capability.
But hybrid models also introduce new challenges. Sharing responsibility across multiple parties means that accountability and leadership can become blurry.
Hybrid security models demand clarity by design. Organisations need clearly defined roles, responsibilities and escalation paths that are understood before an incident occurs.
More importantly, leadership teams need a consistent, unified view of activity across the environment. Without shared visibility, hybrid models can add operational risk, even as they increase flexibility.
Human behaviour and supplier risk remain the weak points
Despite advances in technology, the most common sources of operational strain remain stubbornly human.
Security leaders consistently cite phishing, identity compromise and supply chain exposure as their biggest challenges. Attacks rarely begin with a sophisticated technical failure. Far more often, they start with a compromised credential, a convincing email or a trusted third party used as an access route.
As digital ecosystems grow, so does the number of potential entry points.
Improving resilience requires treating identity and behaviour as frontline controls. That means:
- Monitoring how users and suppliers interact with systems.
- Reducing unnecessary access and standing privileges.
- Ensuring thirdparty access is governed, visible and continuously reviewed.
Technology enables resilience, but behaviour determines how attacks unfold.
Complexity is quietly undermining incident response
50% of organisations believe their security stacks, although complex, are effective. That’s until an incident puts them under strain.
Years of incremental technology investment have left many teams managing large, overlapping collections of tools. Individually valuable, but collectively difficult to orchestrate. During a fastmoving incident, this complexity creates noise, delays investigations and increases the load on responders.
Resilience increasingly depends on simplification and integration. In practice, fewer, well integrated tools make it easier for teams to share context and respond effectively during incidents.
Security leaders should be asking whether their architecture helps teams move faster during incidents or slows them down.
AI is accelerating attackers faster than defenders can adapt
Most organisations expect AIenabled attacks to shape the threat landscape soon. Many are already seeing early signals in phishing and reconnaissance.
Yet while attackers are operationalising AI quickly, defensive adoption remains cautious. Deployment within day-to-day decision-making is still limited. Only 15% of organisations are actively using AI in security operations, with a further 16% who haven’t considered AI usage.
This creates a shortterm imbalance, in which speed and scale can outpace caution.
AI can’t be treated as a standalone capability. To support resilience, it needs to operate within clear guardrails – one that are embedded into existing workflows, tooling and response processes, with human oversight retained at key decision points.
Organisations that benefit most from AI will be those that apply it with intent: governed, tested, and integrated into how incidents are detected, investigated and resolved, rather than experimented with in isolation.
Closing the resilience gap
Taken together, this shows that cyber resilience isn’t defined by individual controls or technologies.
Now, it’s defined by readiness. It’s the ability to respond quickly, coordinate effectively and maintain clarity under pressure that matters most
Closing the resilience gap requires a shift in focus.
- From adding tools to improving how they work together.
- From theoretical capability to tested response.
- From technology alone to people, processes and partners.
The threat landscape is now defined by automation, complexity and speed. Only the organisations that are the most operationally prepared can respond with confidence.
Review the full results from Gamma Communications’ research in our Cyber Resilience Benchmark Report, and start reviewing how your organisation can better prepare and respond to cyber incidents: UK Cyber Resilience Benchmark Report