Is your organisation as prepared as your board thinks it is?
Cyber security is firmly on the board agenda. But new research from CGI reveals a significant gap between recognising cyber risk and being ready to respond when an incident occurs.
72% of organisations anticipate a cyber security breach within the next 12 months. Yet more than a quarter do not regularly rehearse their response and only 35% of respondents believe their board has high levels of expertise to effectively question and challenge cyber security risks and strategies.
Commissioned by CGI and conducted by the Centre for Economics and Business Research (Cebr), the research draws on the views of 150 board-level leaders from some of the UK’s largest organisations.
It also revisits CGI and Cebr’s original 2016 boardroom research, revealing how cyber risk, leadership and preparedness have evolved over the past decade, and where critical resilience gaps remain.
Pre-register now to receive your copy of Cyber security in the boardroom 2026.
The boardroom conversation has changed
Cyber security is firmly on the board agenda. But recognising the risk and being ready to respond to it are two different things.
The research reveals a striking investment challenge. While insiders are identified as the most likely source of a breach, organisations continue to prioritise technology investment considerably more highly than investment in people and processes.
The question for boards is no longer simply “Do we understand our cyber risk?”
It is “Are we resilient enough to respond when it becomes real?”
What will you discover?
Cyber security in the boardroom 2026 explores the decisions facing senior leaders as organisations move from cyber awareness towards greater resilience.
The report will help you explore:
- How boardroom thinking has changed in a decade, with new 2026 findings compared with CGI and Cebr’s original 2016 research.
- Where the resilience gaps remain, from board expertise and incident preparedness to insurance and organisational capability.
- Whether investment matches risk, as technology attracts investment while people-related risks remain a significant concern.
- How your sector compares, with perspectives across banking, insurance, retail, utilities and telecommunications.
- What stronger resilience looks like, including practical priorities for governance, preparedness, people and supply chains.
Be among the first to read the findings
Pre-register today and we’ll send you Cyber security in the boardroom 2026 when it is released:
