The adoption of enterprise-wide CSIRPs has slowly improved, growing 44% since 2015. Despite this progress and the benefit, 51% of respondents said their CSIRPs were not applied consistently across the enterprise or, worse, the plan was informal or ad hoc.

Of those with a formal CSIRP, only one-third have attack-specific playbooks in place for common attacks such as DDoS or malware. Even fewer respondents had plans for emerging threats like ransomware.

Furthermore, only 7% of organizations reviewed their CSIRPs quarterly — a figure that did not change much over the last five years. In fact, 40% of organizations had no set time period for reviewing and updating the plan, an increase of 8% since 2015. Without an up-to-date CSIRP that is applied across the business, 23% more organizations experienced a significant disruption to their IT and business processes.

While it’s impossible to thwart every attack, the preparation and processes an organization uses to respond can greatly reduce damage. The lack of due diligence around a CSIRP revealed by the study potentially limits its effectiveness in an aggressive threat environment.

Organizations used a high volume of tools to manage their security environments and respond to cybersecurity incidents. Nearly 30% of organizations used more than 50 separate security solutions and technologies, and 45% used more than 20 tools when specifically investigating and responding to a cybersecurity incident.

However, an excessive use of disconnected tools creates complex environments, which can inhibit efficiency. The study revealed that the number of security solutions and technologies an organization used had an adverse effect on its ability to detect, prevent, contain and respond to a cybersecurity incident.

In fact, companies with more than 50 tools ranked 8% lower in the ability to detect a cyberattack and ranked 7% lower in the ability to respond to an attack compared to companies using less than 50 tools.

Visibility into applications and data has been one of the top ways organizations improved their cyber resilience for the last three years. Automation stands out this year as another compelling reason — especially for high performers. High performers reported that using interoperable tools helped increase their cyber resilience: 63% compared with 46% of other organizations.

The emphasis on interoperability helped provide the much needed visibility across multiple vendors’ solutions, while at the same time reduced complexity.