One-third of businesses with cyber security plans are still not testing their defenses, according to new research from LRQA.
The latest report reveals that while 72% of organizations claim partial or full cyber security integration (33% say full), readiness and control implementation remains uneven. One in four organizations (25%) never conduct independent cyber assessments and nearly one-third (31%) of those with incident response plans have never tested them.
“Proof has become the baseline; boards, insurers and regulators need evidence that controls hold up when tested. This research shows the gap. Most surveyed organizations have an incident response plan, but a third have never tested it. Meanwhile, 74% don’t formally assess their tier one suppliers. Those are gaps SEC disclosures and insurance renewals will find first,” says Chris Oakley, business director for LRQA’s cybersecurity division in the Americas.
Key takeaways:
· Third-party exposure is one of the clearest structural gaps in the data, in spite of being one of the most common entry points for breaches. Although 32% of organizations identify supply chain vulnerabilities as a leading cyber concern, 74% have no formal cyber risk assessments for their Tier-1 suppliers. Added to this, 30% impose no cyber requirements on suppliers at all.
· Half of organizations (50%) have increased cyber budgets in the past year, alongside baseline controls such as multi-factor authentication (56%); backup and recovery capability (56%); and security awareness training (47%).
· The adoption of cyber insurance gives a vital indicator of cyber maturity, with 31% stating that they hold cyber insurance, 46% reporting they do not, and 23% unable or preferring not to disclose.
· Strategy maturity, however, is mixed with 33% reporting established cyber strategies and 25% advanced or optimized approaches. Integration into business strategy is also largely partial (58%), with only 25% stating full integration.
· Incident exposure is comparatively high, with 33% reporting a cyber incident within the last 12 months, while only 42% report conducting annual third-party testing. This disparity suggests exposure levels may be outpacing independent validation.
