New research from Cyber Defense Group, a cybersecurity services firm specializing in Outcomes–Based Security®, indicates that cybersecurity is becoming a more structured business function. However, organizations continue to face challenges in ensuring their security strategies translate into consistent performance during high-pressure incidents.
The Cyber Defense Group Cybersecurity Strategy Insights Report 2026–2027 identifies a notable change in cybersecurity strategy since the company published its inaugural report last year. Nearly half of surveyed organizations now maintain structured, ongoing cybersecurity programs with defined outcomes. Just under one-third combine formal programs with point-in-time activities, while fewer than 5% describe their approach as ad hoc and lacking formal structure.
Cyber Defense Group’s 2025 report highlighted investments in security tools and products, internal personnel, and external consultants, while identifying shortcomings in strategy and executive oversight. The latest findings indicate a stronger emphasis on measurable outcomes. Approximately 60% of IT leaders identified compliance, detection and response, and reduced overall risk exposure as priorities for their security and AI budgets.
Despite these advances, organizations report varying levels of confidence in their ability to execute critical incident-response activities within 24 hours. The findings suggest that organizations may be better prepared to contain an attack than to manage its subsequent operational and investigative demands. Although 94% of respondents express at least some confidence in their organization’s ability to contain a security incident within 24 hours, only 60% are very confident. Confidence is lower for other essential response functions: fewer than half are very confident in their ability to communicate effectively with stakeholders, and just 37% are very confident they could preserve critical evidence.
The findings underscore the importance of evaluating incident-response readiness beyond containment. An inability to preserve evidence can hinder investigations into an incident’s cause and scope, as well as assessments of potential regulatory exposure. Similarly, inconsistent stakeholder communication can complicate legal, commercial, and recovery decisions at a time when timely, accurate information is essential.
This disparity in confidence may point to a broader disconnect between establishing a cybersecurity strategy and implementing it effectively. Nearly all respondents report that their organizations have defined approaches to managing internal and external cybersecurity risks. However, only 68% say their internal approach is both documented and communicated across the organization. For external cybersecurity risk, that figure falls to 44%.
“Cybersecurity is becoming a more established business function, and organizations are looking beyond tooling and solutions to consider outcomes, structures, and wider strategy when they invest,” said Lou Rabon, Founder and CEO of Cyber Defense Group. “That progress is encouraging. But putting structures and strategies in place is only half the picture. Companies need to pressure-test their systems, understand their vulnerabilities, and address any gaps before a real-world incident occurs.”
Overall, the research indicates that many organizations have established credible cybersecurity foundations, but further work is needed to integrate their people, processes, and technologies into a coordinated security program.
“The biggest cybersecurity challenges rarely sit within a single tool, team, or decision,” Rabon comments. “Senior IT and C-level executives will ultimately be judged on their organizations’ ability to implement, respond, and recover at speed and at scale.”
“That means they need to start breaking down silos and take a holistic view of cybersecurity across people, teams, and departments, as well as applications, tools, and infrastructure,” he concludes. “It’s a process that begins by asking, ‘Can we contain an incident, preserve evidence, and communicate effectively when time is critical?’ Answering that question will set them on the path to solving one of the biggest issues in today’s cybersecurity sector.”
Download the full Cyber Defense Group Cybersecurity Strategy Insights Report 2026–2027.
Research methodology
Censuswide conducted the research among 500 U.S. senior IT and C-level and executive management professionals aged 25 and older. Respondents represented organizations with 100 to 5,000 employees and annual spending exceeding $200,000 on security personnel and tools. Participants included business owners, CFOs, CEOs, Chief AI Officers, CIOs, CISOs, CSOs, CTOs, Heads of AI, Heads of IT, Heads of Security, IT Directors, IT Managers, Managing Directors, Security Directors, and Security Managers.
Fieldwork took place from June 2 to June 8, 2026, covering organizations in manufacturing, fintech and finance, telecommunications, transport and distribution, legal services, retail, and media and entertainment. The sample therefore reflects security-invested mid-market and enterprise organizations and should not be considered representative of all U.S. organizations.
Fieldwork took place from June 2 to June 8, 2026, covering organizations in manufacturing, fintech and finance, telecommunications, transport and distribution, legal services, retail, and media and entertainment. The sample therefore reflects security-invested mid-market and enterprise organizations and should not be considered representative of all U.S. organizations.
_____
About Cyber Defense Group
Cyber Defense Group (CDG) delivers Outcomes-Based Security® Programs to mid-market organizations in regulated industries. Every program has three parts: a named security leader accountable for the program, a delivery team that executes it, and a defined set of outcomes measured and reported to the executive team. All of it runs on a fixed subscription.
Programs anchor on security leadership and compliance attestation, including cyber insurance requirements, the FTC Safeguards Qualified Individual role, NYDFS Part 500, SOC 2, and HIPAA. Managed detection and response, penetration testing, and incident response sit underneath so that findings get fixed, not just reported. Contact us at info@cdg.io or visit www.cdg.io for more information.
Media Contacts
Touchdown PR: Olivia Manning cdg@touchdownpr.com
Cyber Defense Group: Zia Hellman zia@cdg.io
Join our LinkedIn group Information Security Community!
