New research from cybersecurity services firm Cyber Defense Group reveals a gap in organizations’ confidence in their ability to contain cyberattacks and preserve critical evidence.
While 60% of IT leaders are very confident they could contain a security incident within 24 hours, just 37% express the same level of confidence in their ability to preserve critical evidence.
The findings, published in the company’s Cybersecurity Strategy Insights Report 2026-2027, highlight weaknesses in incident response readiness, stakeholder communication, and risk management, creating opportunities for MSPs and MSSPs to help customers strengthen and test their cybersecurity response plans.
Incident containment confidence exceeds recovery readiness
Fewer than one in twenty describe their approach as ad hoc with no formal structure.
According to the report, confidence in carrying out critical incident-response tasks within 24 hours remains uneven, with organizations being more confident in stopping an incident than in managing the aftermath.
While 94% have at least some confidence that their organization could contain a security incident within 24 hours, only 60% are very confident.
That confidence falters even more for other critical response activities: less than half are very confident they could communicate effectively with stakeholders, while only 37% are very confident they could preserve critical evidence.
The report details how IT leaders should assess their readiness to handle key tasks in the wake of a cyberattack, and that failing to preserve evidence can make it harder to establish cause, scope, and regulatory exposure. Inconsistent stakeholder communication can complicate legal, commercial, and recovery decisions.
“Cybersecurity is becoming a more established business function, and organizations are looking beyond tooling and solutions to consider outcomes, structures, and wider strategy when they invest,” said Lou Rabon, Founder and CEO of Cyber Defense Group. “That progress is encouraging. But putting structures and strategies in place is only half the picture.”
Documented cybersecurity response plans remain inconsistent
Nearly all respondents say their organization has defined an approach to managing internal and external cybersecurity risk, but only 68% say their internal approach is both documented and communicated, falling to just 44% for their external approach.
“The biggest cybersecurity challenge rarely sits within a single tool, team, or decision,” said Rabon. “Senior IT and C-level executives will ultimately be judged on their organizations’ ability to implement, respond, and recover at speed and at scale.”
Rabon continued: “That means they need to start breaking down silos and take a holistic view of cybersecurity across people, teams, and departments, as well as applications, tools, and infrastructure. It’s a process that begins by asking, ‘Can we contain an incident, preserve evidence, and communicate effectively when time is critical?’ Answering that question will set them on the path to solving one of the biggest issues in today’s cybersecurity sector.”
The report suggests that many organizations have credible cybersecurity foundations; the next step is to make those foundations operate as a connected system.
What incident response gaps mean for MSPs and MSSPs
The findings in the report point to an opportunity for channel organizations to help customers move beyond having cybersecurity policies and tools toward demonstrating that their incident-response processes work under pressure.
The biggest opportunity is in the gaps between incident containment, evidence preservation, stakeholder communication, and recovery.
With the gap between confidence in containing an incident and preserving critical evidence, partners can help customers evaluate their readiness across the entire response process, not just their ability to stop an attack.
The report’s emphasis on pressure-testing systems and addressing vulnerabilities also creates an opportunity for MSPs, MSSPs, and cybersecurity service providers to assess response plans, identify weaknesses, and help customers validate their procedures before an incident occurs.
Channel organizations can also help document procedures, clarify responsibilities, and improve how risk-management expectations are communicated.
Additionally, partners can differentiate themselves by helping customers demonstrate readiness to respond and coordinate recovery efforts, rather than focusing solely on selling security products.
READ MORE: We also continue to cover how AI adoption impacts security incidents and response to them, including the latest data from the CYGNVS Resilience Benchmark report.