Kroll Survey Finds 72% Report Misalignment Between Business and Cybersecurity Priorities
Report discovered via Awesome Annual Security Reports.
Summary
Kroll’s 2026 survey of 1,000 cybersecurity decision-makers finds 72% report frequent misalignment between business and security priorities. Rising budgets coexist with gaps in AI governance and post-incident response planning.
Key points
- Sapio Research surveyed 1,000 senior cybersecurity decision-makers across 10 countries in November and December 2025 for Kroll.
- Seventy-two percent reported frequent misalignment between business and cybersecurity priorities; differing risk tolerance and limited executive cyber literacy were leading reported causes.
- Eighty percent reported increased cybersecurity budgets for 2026, yet 23% reported cuts to identity and access management controls and zero trust architectures.
- Forty-eight percent reported little or no governance over AI tool adoption. Reported AI-related security incidents ranged from 89% among very-low-maturity organizations to 54% among very-high-maturity organizations.
- Although 99% reported having an incident response plan, only 3% said their organization updates it after a cyber incident; 44% lacked clarity on cyber insurance coverage and requirements.
- The report recommends aligning investment with operational risk, strengthening foundational controls, testing recovery capabilities and continuously reviewing AI governance.
Article Details
- Publisher
- Kroll
- Report Period
- 2026 report; survey conducted in November and December 2025
- Scope
- Cybersecurity governance, investment, operational resilience, incident response and AI security across organizations in 10 countries.
- Sample Size
- 1,000 cybersecurity decision-makers at senior manager level or above, representing organizations with at least USD 50 million in global annual revenue.
- Key Statistics
- 72% of respondents frequently experience misalignment between business and cybersecurity priorities.
- 96% of represented organizations have quantified cyber risk; reported potential financial losses average USD 20.9 million.
- 80% of respondents say their organizations plan to increase cybersecurity spending in 2026, while 23% report cuts to identity and access management controls and zero trust architectures.
- Reported AI-related security incident prevalence ranges from 89% among very-low-maturity organizations to 54% among very-high-maturity organizations; 48% of respondents report little or no governance over AI adoption.
- 99% of respondents report having an incident response plan, but only 3% say their organization updates it after a cyber incident.
- Recommendations
- Translate cyber risks into financial and operational impacts, establish a shared risk taxonomy and link investment decisions to business objectives.
- Use targeted security assessments and continuous monitoring to identify gaps and prioritize controls that reduce business risk.
- Strengthen security training, identity protections and operational fundamentals rather than relying solely on additional technology purchases.
- Establish enterprise-wide AI governance, continuously monitor AI systems and conduct security-control, vulnerability and model assessments.
- Review and update incident response plans after incidents to incorporate lessons learned, and clarify cyber insurance requirements and coverage.
Threat Actors
Countries
ChinaA major China-linked campaign (Salt Typhoon/Operator Panda) infiltrated leading U.S. telecom carriers, operating undetected inside some of the most hardened networks for months. This attack exposed the fragility of evenUnited Kingdom**Retail-Sector Disruption: Coordinated Ransomware Attacks Across Major UK Brands**[^3]United StatesFor example, UnitedHealth Group’s (U.S.) 2025 earnings materials highlight USD 799 mn of “final cyberattack costs” (the impact to 2025 earnings before taxes)[^1].
Industries
IT distribution**IT Distribution Hit: Ingram Micro Ransomware Disruption**[^4]Retail**Retail-Sector Disruption: Coordinated Ransomware Attacks Across Major UK Brands**[^3]TelecommunicationsA major China-linked campaign (Salt Typhoon/Operator Panda) infiltrated leading U.S. telecom carriers, operating undetected inside some of the most hardened networks for months. This attack exposed the fragility of even