Nearly nine in 10 organizations have experienced an AI-related incident, but many remain unprepared to respond effectively, according to new research from CYGNVS and Marsh Risk.
The CYGNVS Resilience Benchmark Report, released October 13, analyzed more than 9,500 survey responses collected between January 2023 and September 2026 across 21 industries in Asia, Europe and North America.
The findings highlight a growing disconnect between AI adoption and organizational readiness. While 89% of organizations reported experiencing an AI incident, 46% said they would improvise their response, and only 33% have a dedicated environment to manage incidents without interference from the AI systems under investigation.
For MSPs and MSSPs, the findings point to growing demand for AI governance, incident response planning and specialized security services.
AI adoption outpaces incident response readiness
Approximately 80% of organizations use generative AI, but only one-third test their AI systems against attacks. Even among companies generating more than $1 billion in revenue, just 39% conduct adversarial AI testing.
The report identifies rogue AI agents, autonomous systems pursuing unintended objectives, data leakage, and failures of AI guardrails among the emerging incident categories organizations face.
Sixteen percent of organizations experience AI incidents at least weekly.
Meanwhile, 67% have not identified clear owners for their most critical business processes and dependencies, potentially delaying decisions during incidents.
“Across the incidents and claims we support every year, the organizations that prepare and practice before an incident consistently fare better than those improvising in the moment,” said Thomas Reagan, Global Head of Cyber at Marsh Risk. “Working with CYGNVS, we want to help clients see where they stand against their peers and close those gaps before they face a debilitating business-critical incident.”
Incident response plans lack testing and preparation
Although 92% of organizations have documented incident response processes, just 37% maintain ransomware-specific playbooks and 29% have plans addressing third-party or vendor incidents.
The research also found:
- 84% review their incident response plans annually or less frequently.
- 67% have never tested recovery under real incident conditions.
- 17% conduct no tabletop exercises.
- 15% conduct fully cross-functional exercises involving legal, communications, and executive leadership.
The reporting challenge is equally significant. Sixty-nine percent acknowledge substantial gaps in incident audit trails, while 52% lack a defined process for AI-related regulatory notifications.
What AI security gaps mean for MSPs and MSSPs
The findings suggest opportunities for channel partners to expand beyond traditional cybersecurity monitoring into proactive AI resilience services.
MSPs and MSSPs could help customers develop AI-specific response playbooks, conduct adversarial testing, establish incident ownership, and coordinate tabletop exercises involving business leadership.
“Every board and leader wants to know how their organization compares to its peers,” said Arvind Parthasarathi, Founder and CEO of CYGNVS. “Most of this data never sees daylight because incident response happens under high confidentiality. As we kick off Cybersecurity Awareness Month in October, this report can help more organizations learn the easy way.”
CYGNVS is also introducing a Resilience Benchmark capability that allows organizations to compare their incident readiness against industry, geographic, and company-size peers.
For channel providers, the broader takeaway is that AI security services increasingly need to address not only preventing incidents but also helping customers contain, recover from, and document them when they occur.
WATCH MORE: MSPs continue to build services and scalable solutions around secure AI demand. WCA Technologies President Peter Fidler shares how his New York City-based MSP is doing it in the latest episode of CI: Partner POV.