There’s a quiet crisis unfolding in security operations centers around the world. It isn’t a zero-day vulnerability. It isn’t a new ransomware strain. It’s something far more insidious: the growing gap between having an incident response plan and actually believing you can execute it when everything goes sideways.

A recent global survey of over 600 senior cybersecurity leaders paints a sobering picture. While nearly every organization surveyed — 99%, to be exact — has a formal incident response plan on paper, a staggering 73% of CISOs and security decision-makers admit they wouldn’t be fully ready to execute under pressure if a major attack hit tomorrow. That’s not a skills shortage. That’s not a budget problem. That’s a readiness gap, and it’s widening.

The Confidence Gap Nobody Wants to Talk About

Let’s sit with that number for a moment. Three out of four security leaders, despite their experience, their certifications, and their carefully documented playbooks, don’t trust their own organization’s ability to respond effectively when the alarm goes off at 2 AM. And this isn’t hypothetical anxiety — 76% of these same organizations have already been hit at least once in the past year. Over a third have been breached multiple times.

The consequences aren’t abstract. In the last twelve months alone, nearly half of attacked organizations suffered operational shutdowns. Four in ten lost data, took reputational damage, or watched revenue bleed out while they scrambled to contain the damage. These aren’t minor incidents. These are business-altering events.

So why the disconnect? Why do organizations invest in IR planning only to end up with leaders who fundamentally doubt their own preparedness? The answer, according to the data, comes down to three structural failures: organizational friction, visibility blind spots, and a threat landscape that has outpaced traditional defense models.

When Bureaucracy Becomes the Attacker’s Ally

The most revealing finding in the report has nothing to do with malware or firewalls. It has to do with people. Specifically, how poorly organizations coordinate when every second counts.

Consider this: 90% of security leaders expect serious difficulty coordinating key stakeholders during an active incident. Not some — 90%. That’s not a fringe concern; that’s a universal expectation of dysfunction. Add to that the fact that 89% report limited executive or board involvement in IR readiness, and 75% say legal and communications teams actively slow down decision-making during crises.

What emerges is a picture of incident response as a political and logistical nightmare rather than a technical one. In private healthcare, where regulatory exposure and reputational stakes are highest, 86% of respondents cited legal and communications challenges as major friction points during response efforts.

Guy Segal, CEO of Sygnia, put it bluntly: incident response has to be owned at the security, operational, and executive levels, with pre-agreed escalation pathways and regular board-level rehearsal. The playbook alone isn’t enough. You need muscle memory across the entire organization, not just the SOC.

And right now, most organizations are running on documentation instead of discipline.

You Can’t Defend What You Can’t See

If organizational friction is the human problem, visibility is the technical one — and it’s just as severe. Nearly 80% of respondents flagged potential blind spots across public cloud, SaaS platforms, and endpoints as factors that would slow detection or investigation. Public cloud environments topped the list at 90%, which shouldn’t surprise anyone who’s watched enterprise infrastructure sprawl across multi-cloud architectures without corresponding security instrumentation.

More concerning is the industrial angle. 84% of security leaders pointed to IT vulnerabilities as a worrisome bridge into operational technology and ICS environments. That’s a terrifying vector because it collapses the traditional air gap between enterprise networks and physical systems. When an attacker can pivot from a compromised endpoint to a manufacturing floor or energy grid, the stakes shift from data loss to physical safety.

These blind spots don’t just delay detection. They create persistence opportunities for attackers. If you can’t see them move laterally, you can’t evict them completely. And that directly contributes to repeat incidents — something over a third of organizations have already experienced.

The Threat Surface Has Become a Threat Ocean

Ransomware remains the boogeyman of choice, with 46% of security leaders naming it their top concern. Cloud environment breaches follow closely at 44%. But what’s striking is the breadth of threats keeping CISOs awake at night: email compromise (37%), data theft (37%), supply chain attacks (35%). No single vector dominates because attackers aren’t specializing — they’re diversifying.

Sector data tells its own story. Crypto and decentralized finance firms reported the highest attack rates at 83%, likely reflecting both their high-value targets and their relatively immature security postures. Retail clocked in at 79%, manufacturing at 76%. These aren’t industries traditionally associated with cutting-edge cybersecurity investment, yet they’re facing nation-state-level pressure from criminal groups.

The common thread? Every organization, regardless of sector, is defending a perimeter that no longer exists. Remote work, cloud migration, and third-party integrations have dissolved the network boundary that IR plans were originally built around. When your assets are everywhere, your response capability has to be everywhere too — and right now, it isn’t.

AI: The Accelerant and the Amplifier

Perhaps the most complex dynamic in modern incident response is the role of artificial intelligence. On one hand, AI adoption in security operations is accelerating rapidly. Nearly a third of organizations now report extensive AI use across threat detection and IR activities, up from 25% last year. By 2027, that number is projected to hit 63%.

Organizations with moderate to extensive AI integration consistently rate their IR capabilities — documented plans, 24/7 monitoring, digital forensics — as more effective than those with limited AI use. When AI is embedded into workflows rather than bolted on top, it genuinely improves readiness.

But here’s the catch: the adoption of AI cybersecurity solutions is outpacing the consideration of AI security implications. AI isn’t just a defensive tool anymore; it’s an attack surface. LLM poisoning, deepfakes, adversarial manipulation of training data — these are no longer theoretical risks. They’re active vectors that expand what defenders have to protect while simultaneously promising to automate their protection.

The organizations winning this battle aren’t the ones buying the most AI tools. They’re the ones building structured governance around AI adoption, maintaining human oversight, and managing the full lifecycle of their AI assets. AI strengthens IR foundations when it augments human judgment, not when it replaces it.

What “Ready” Actually Looks Like

So if 99% plan coverage and 73% execution confidence represent the current state, what does improvement look like?

First, it means treating incident response as an organizational capability, not a security team procedure. The board needs skin in the game. Legal and communications need pre-baked decision trees for crisis scenarios. Stakeholder coordination needs to be rehearsed until it’s reflexive, not improvised under pressure.

Second, it requires ruthless visibility. That means closing the cloud and endpoint blind spots that 78% of organizations know they have but haven’t fully addressed. It means mapping IT-to-OT bridges before an attacker does. You cannot respond to what you cannot observe.

Third, it demands a realistic threat model. Ransomware and cloud breaches are table stakes, but email compromise and supply chain infiltration require entirely different detection and response postures. A plan built only for the headline threats will fail against the ones that actually show up.

Finally, AI integration needs guardrails. The 63% AI adoption target by 2027 is inevitable, but ungoverned AI deployment creates more risk than it mitigates. Security teams need to secure their AI tools with the same rigor they apply to their networks.

The Bottom Line

There’s a certain dark irony in the fact that the people paid to worry about organizational security are themselves worried about organizational readiness. But that worry is justified. An incident response plan that exists only in a PDF, unread by executives and untested by reality, is a liability masquerading as a safeguard.

The next major attack isn’t a matter of if — for most organizations, it’s a matter of when, and whether it’ll be the first or the repeat visit. The difference between organizations that survive intact and those that suffer operational shutdown, data loss, and reputational damage won’t be who had the better plan on paper.

It’ll be who actually trusted their ability to execute it.