The Cyber Resilience Hallucination: Why 88% of UK Businesses Think They’re Above Average

What is the Cyber Resilience Hallucination?

The Cyber Resilience Hallucination describes the disconnect between an organisation’s perceived cyber resilience and its actual ability to anticipate, withstand, respond to and recover from cyber disruption.

It occurs when businesses mistake positive security metrics, compliance achievements, or favourable assessments for evidence of genuine operational resilience. A dashboard might show that vulnerabilities are being patched, security controls are functioning and compliance obligations are being met, but can it answer the questions that really matter?

• Could the business continue operating during a serious cyberattack?
• Which critical services would be disrupted?
• How quickly could essential operations be restored?
• Are cyber security investments measurably improving resilience?
• Is the organisation more resilient today than it was six months ago?

These are fundamentally different questions from whether an organisation is meeting its security KPIs. And according to NormCyber’s research, too many businesses are struggling to answer them.

The numbers behind the confidence gap

NormCyber’s research reveals five findings that challenge conventional cyber resilience reporting.

• 88% believe their cyber resilience is above average. Yet only 28% feel their reporting provides a completely comprehensive picture across people, processes and technology.
• 60% report a recovery reality gap. Respondents indicated that recovery from a cyber incident took longer than their resilience score suggested, or that their organisation was significantly less resilient than the score implied.
• 74% say compliance drives cyber security investment. Despite cyber security ranking among the top five business priorities for 95% of respondents, investment remains heavily influenced by regulatory and compliance requirements.
• Only 39% believe their board understands what cyber resilience really means. The research reveals a critical knowledge gap: many boards struggle to distinguish between preventing a cyberattack and keeping the business operational when an attack succeeds.
• 92% see the value of continuous measurement. An overwhelming majority believe that a single, continuous measure of cyber resilience would be very or extremely valuable.

Together, these findings suggest a fundamental problem – organisations are increasingly expected to demonstrate resilience, but many are still relying on reporting methods that cannot reliably prove it.

Why traditional cyber security metrics don’t tell the whole story

Most organisations are not short of cyber security data. Security teams monitor vulnerabilities, detection rates, patching performance, incidents, compliance status and countless other operational indicators. The problem is that these metrics often measure individual security activities rather than the organisation’s overall ability to remain operational.

For example, a business might report:

• 95% of critical patches completed within the required timeframe.
• Successful completion of its latest security audit.
• Improved incident detection performance.
• Compliance with recognised cyber security frameworks.

All are valuable indicators. None, individually, proves that the organisation could continue delivering its critical services during a major incident. This distinction matters because cyber security and cyber resilience are not interchangeable. Cyber security focuses on protecting systems, networks and data against threats. Cyber resilience goes further. It considers whether the organisation can anticipate disruption, withstand an incident, maintain essential operations and recover within acceptable business timeframes. A business can be compliant and still suffer prolonged operational disruption. It can have effective security controls and still discover that its recovery assumptions were unrealistic. And it can report improving security performance without knowing whether its ability to withstand a serious incident has improved.

The boardroom blind spot: confidence increases further from the frontline

One of the most revealing findings concerns the difference between strategic and operational perceptions of resilience. Among decision-makers, 92% describe their organisation’s cyber resilience as above average.

Among respondents closer to day-to-day security delivery, that figure falls to 72%.

This 20% point gap raises an uncomfortable question. Are boards and senior decision-makers receiving an accurate picture of cyber resilience, or an increasingly reassuring interpretation of fragmented technical information?

The research suggests that communication is part of the problem. While 55% of technical leaders believe their boards deeply understand and challenge assumptions about cyber resilience, 46% of board members acknowledge that they understand the headline metrics but not the underlying detail. The result can be a reporting environment in which everyone believes resilience is being managed effectively, but few share the same definition of what effective resilience actually means. For CISOs and technology leaders, the challenge is no longer simply to demonstrate that security controls are working, it’s to explain what those controls mean for business continuity, operational risk and the organisation’s ability to recover.

Why annual cyber resilience assessments are no longer enough

Cyber resilience is not static. New vulnerabilities emerge. Suppliers change. Technology environments evolve. Employees gain access to new systems. Business dependencies become more complex. Yet many organisations continue to assess resilience through periodic audits, annual assessments and point-in-time reporting.

NormCyber’s research found that:

• 50% of respondents conduct annual or twice-yearly supplier audits.
• 42% use point-in-time supplier assessments.
• 26% rely on static data, such as spreadsheet reports, or do not formally measure cyber resilience at all.

These approaches can provide useful assurance, but they cannot consistently show how resilience changes between assessments. A security posture that was considered acceptable three months ago may no longer reflect the organisation’s actual exposure. This is why continuous cyber resilience measurement is becoming increasingly important. Rather than treating resilience as something to assess periodically, organisations need to understand how it changes over time, which weaknesses matter most and whether remediation is delivering measurable improvements.

From compliance reporting to measurable cyber resilience

The research also exposes a disconnect between cyber security investment and strategic business outcomes. Although 95% of respondents identify cyber security as a top-five business priority, 74% report compliance as a driver of investment, while 65% cite security incidents. Compliance frameworks such as ISO 27001, Cyber Essentials and the NCSC Cyber Assessment Framework (CAF) provide valuable structures for managing risk. But compliance is not the same as resilience.

A successful audit demonstrates that defined requirements have been met. It does not automatically demonstrate that critical business services can withstand a sophisticated cyberattack or recover within acceptable timeframes. As expectations of board accountability increase, this distinction becomes more significant. Organisations need to move beyond demonstrating that security activities have taken place towards proving that those activities are reducing operational risk. That requires a different approach to cyber resilience reporting: one grounded in evidence, linked to business outcomes and capable of demonstrating improvement over time.

What should effective cyber resilience measurement look like?

The future of cyber resilience measurement isn’t about producing more dashboards or collecting more security metrics. It’s about making existing information more meaningful.

Effective measurement should bring together evidence from across an organisation’s people, processes, technology and third-party dependencies to establish a consistent view of resilience.

It should enable security leaders and boards to answer three essential questions:

1 – How resilient are we today?
Not simply how many vulnerabilities exist or how many alerts have been resolved, but how well the organisation is positioned to withstand disruption and maintain critical operations.

2 – Where are we most exposed?
Which weaknesses, systems, suppliers or operational dependencies present the greatest risk to business continuity?

3 – Are we becoming more resilient?
Can the organisation demonstrate measurable improvement over time and establish whether security investments are delivering meaningful outcomes?

Answering these questions requires continuous visibility, consistent measurement and a common language between technical teams and business leaders. It also requires organisations to understand their minimum viable operations: the essential services and capabilities that must remain available during a serious cyber incident. Because ultimately, the purpose of cyber resilience is not to make an organisation breach-proof. It’s to keep the business operating when prevention isn’t enough.

The future of cyber resilience – confidence backed by evidence.

The most encouraging finding from NormCyber’s research is that organisations recognise the need for change. 92% of respondents believe a single, continuous measure of cyber resilience would be very or extremely valuable.

This reflects a growing appetite to move beyond fragmented security reporting and towards a more objective, business-aligned approach. At NormCyber, we believe cyber resilience should be measurable, understandable and continuously improving. Our Cyber Resilience Score brings together signals from across an organisation’s security environment to provide a consistent, NCSC CAF-aligned measure of resilience. Combined with expert analysis and prioritised action, it helps organisations understand where they’re exposed, where to focus and whether they’re making meaningful progress. Because confidence should be the result of evidence, not a substitute for it.

And the real test of cyber resilience isn’t how secure an organisation looks on a dashboard. It’s whether the business can keep operating when it matters most.