Most organizations will face a cyber incident this year, and few have tested whether they can actually recover from one. In Futurum Research’s 1H 2026 Cybersecurity Decision-Makers Survey, 81% of security leaders reported a significant security incident in the past 12 months. Prevention and detection still absorb most of the security budget, and they still matter, but they no longer decide the outcome. In an assume-breach world, the question a board needs answered is how quickly the organization can resume operations, not whether it will be compromised.
AI is changing the stakes on two fronts. It broadens what attackers can do, lowering the cost and skill needed to mount a capable campaign, and it deepens an organization’s dependence on data, as AI systems increasingly read from and act on that data. Confidence is running ahead of proof: 65% of security leaders say they are very or extremely confident they could recover from a major incident, yet operational downtime ranks among the consequences they report most often, named by 37%. Disaster-recovery plans built for hardware failures and natural disasters assume a clean restore point and a cooperative environment. A deliberate attacker offers neither.
In our latest thought leadership brief, Cyber Resilience Is Now the Mandate: A CXO Checklist, completed in partnership with Everpure, Futurum Research lays out ten questions every leadership team should be able to answer about its recovery posture, and shows where isolated, immutable backups and validated recovery fit into closing the gap between confidence and proof.
In this brief, you will learn:
- Why prevention and detection no longer decide the outcome in an assume-breach world
- The ten questions that separate a tested recovery plan from an untested one
- Why disaster-recovery plans built for storms and hardware failures fall short against a deliberate attacker
- How isolated, immutable recovery environments and validated restores close the gap between confidence and proof
If you are interested in learning more, be sure to download your copy of Cyber Resilience Is Now the Mandate: A CXO Checklist today.
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
