Nearly 9 in 10 Organizations Have Faced an AI Incident, But More Than Two Thirds Are Not Confident in Response, CYGNVS Report Finds

More than 6 in 10 organizations say incident volume is rising, yet 84% review their incident response plans once a year or less, according to an analysis of more than 9,500 survey responses

SAN MATEO, Calif., Oct. 13, 2026 /PRNewswire/ -- CYGNVS, the out-of-band command center for cyber and AI incidents, today released the CYGNVS Resilience Benchmark Report with Marsh, a leading global professional services firm. The report draws on more than 9,500 survey responses from organizations across the world to understand how organizations prepare for, practice, respond to and report on business-critical incidents. To date, this is one of the largest collections of organization survey data on incident readiness and resilience.

Cyber incidents are accelerating. More than 6 in 10 organizations say incident volume has risen over the past 12 months, and 91% said their board became more involved. Yet 84% review their incident response plans once a year or less and 17% do not run tabletop exercises at all, a rhythm set when critical incidents were rare. Organizations that had lived through a critical incident were further along at nearly every stage of the response lifecycle, and the report shows how others can put those lessons in place before an incident forces the issue.

"Across the incidents and claims we support every year, the organizations that prepare and practice before an incident consistently fare better than those improvising in the moment," said Thomas Reagan, Global Head of Cyber, Marsh Risk. "Working with CYGNVS, we want to help clients see where they stand against their peers and close those gaps before they face a debilitating business critical incident."

AI incidents are upon us. The report finds that nearly nine in ten organizations have already faced an AI incident, where the AI misbehaves to cause some form of harm, including rogue agents, agentic runaway and jumping guardrails. While 80% of organizations use generative AI, only one in three test their AI models against attacks.

AI oversight is lagging adoption. Organizations use AI for marketing nearly three times as often as for risk assessment, which puts the fastest adoption in the functions least likely to be tested or governed. When an AI incident does occur, nearly half of organizations reported they would improvise their response. The reporting burden is growing as well, with more than 50 jurisdictions now having laws or rules on AI incidents. Meanwhile, 52% have no defined process for regulatory notifications. Only one in three have a dedicated out-of-band environment to manage the AI incident that the AI being investigated cannot access or interfere with.

The report maps its findings across the Prepare, Practice, Respond and Report incident response lifecycle:

• Prepare: 92% of organizations have documented incident response processes, but only 37% have ransomware-specific playbooks and just 29% have playbooks for third-party incidents.
• Practice: 17% of organizations don't run tabletop exercises and another 66% run them only every one to two years, even as critical incidents now arrive monthly or weekly for many teams, meaning many organizations are having to run multiple critical incidents simultaneously.
• Respond: 88% of organizations have a crisis communications plan, but more than four in ten have not secured the outside experts that plan relies on.
• Report: The share of organizations required to formally document security incidents rose from 82% in 2023 to 90% in 2026, yet 69% of organizations admitted gaps in their records of who did what and when.

"Every board and leader wants to know how their organization compares to its peers," said Arvind Parthasarathi, Founder and CEO of CYGNVS. "Most of this data never sees daylight because incident response happens under high confidentiality. As we observe Cybersecurity Awareness Month in October, this report can help more organizations learn the easy way."

Alongside the report, CYGNVS is introducing the CYGNVS Resilience Benchmark, a new capability within the CYGNVS platform that lets customers quantitatively measure their readiness to a critical cyber or AI incident and benchmark themselves against their peers by industry, size or geography. The benchmarks also provide concrete advice and steps to improve readiness and resilience. Organizations that are not yet CYGNVS customers can receive a personalized benchmark report by completing a free assessment.

The full CYGNVS Resilience Benchmark Report, including the complete findings by lifecycle stage and five recommended strategies for the year ahead, is available at CYGNVS.com/resilience.

About the Report

The CYGNVS Resilience Benchmark Report draws on more than 9,500 survey responses collected from organizations in more than 20 industries across Asia, Europe and North America by CYGNVS and Marsh. All responses were anonymized and deidentified, and no individual respondent or organization is identifiable.

About CYGNVS Inc.

Over 3,000 customer organizations rely on CYGNVS as their out-of-band command center to successfully manage cyber and AI incidents. Bringing together IT/security teams with business teams and external providers, CYGNVS helps prepare playbooks, practice in tabletop exercises, control the response, protect legal privilege, document chain of custody and report to regulators and customers. CYGNVS AI is trained on an exclusive, growing set of more than 25,000 major incidents not accessible publicly or commercially. Customers are now running 50 new major incidents on the platform every week. Most do not make the news since CYGNVS helps organizations turn business incidents into business as usual. Learn more at CYGNVS.com.

SOURCE CYGNVS