New research from Cyber Defense Group, suggests cybersecurity is becoming a more structured business function. However, many organizations have yet to demonstrate that those structures will work consistently under pressure.
The Cyber Defense Group Cybersecurity Strategy Insights Report 2026–2027 reveals a significant shift in strategy since the company’s inaugural report last year. Nearly half of organizations now operate a structured, ongoing cybersecurity program with defined outcomes, while just under a third operate a mix of program and point-in-time activities. Fewer than one in twenty describe their approach as ad hoc with no formal structure.
The company’s 2025 report highlighted investment in tools and products, internal staff, and external consultants, but identified gaps in strategy and executive oversight. This year’s findings, however, point to a greater focus on outcomes, with compliance, detection and response, and reduced overall risk exposure each cited by around 60% of IT leaders as priorities for their security and AI budgets.
Despite this progress, confidence in carrying out critical incident-response tasks within 24 hours remains uneven. The report’s findings suggest organizations may be more confident in stopping an incident than in managing the aftermath. While 94% express at least some confidence that their organization could contain a security incident within 24 hours, only 60% are very confident. Confidence falls further for other critical response activities: less than half are very confident they could communicate effectively with stakeholders, while only 37% are very confident they could preserve critical evidence.
The report highlights the need for IT leaders to assess their readiness to deal with key tasks in the wake of a cyberattack. Failing to preserve evidence can make it harder to establish cause, scope, and regulatory exposure. Meanwhile, inconsistent stakeholder communication can complicate legal, commercial, and recovery decisions when speed and accuracy matter most.
This uneven confidence may reflect a wider gap between defining a security approach and putting it into practice. Almost all respondents say their organization has defined an approach to managing internal and external cybersecurity risk. Yet only 68% say their internal approach is both documented and communicated, falling to just 44% for their external approach.
“Cybersecurity is becoming a more established business function, and organizations are looking beyond tooling and solutions to consider outcomes, structures, and wider strategy when they invest,” said Lou Rabon, Founder and CEO of Cyber Defense Group. “That progress is encouraging. But putting structures and strategies in place is only half the picture. Companies need to pressure-test their systems, understand their vulnerabilities, and address any gaps before a real-world incident occurs.”
Taken as a whole, the research suggests many organizations have laid credible cybersecurity foundations. The next step is to make those foundations operate as a connected system.
“The biggest cybersecurity challenges rarely sit within a single tool, team, or decision,” Rabon comments. “Senior IT and C-level executives will ultimately be judged on their organizations’ ability to implement, respond, and recover at speed and at scale.”
“That means they need to start breaking down silos and take a holistic view of cybersecurity across people, teams, and departments, as well as applications, tools, and infrastructure,” he concludes. “It’s a process that begins by asking, ‘Can we contain an incident, preserve evidence, and communicate effectively when time is critical?’ Answering that question will set them on the path to solving one of the biggest issues in today’s cybersecurity sector.”
Download the full Cyber Defense Group Cybersecurity Strategy Insights Report 2026–2027 here: https://www.cdg.io/cybersecurity-strategy-insights-report-2026/
