CISO Survey 2025: Harnessing Next-Generation Cyber Resilience

TAKE SURVEY

Overview

As cyber threats grow in complexity, CISOs are at the forefront of safeguarding enterprise security. This exclusive survey captures key insights from security leaders, highlighting evolving priorities, top challenges, and strategic approaches to risk management. From navigating compliance and AI-driven security to enhancing cyber resilience, the findings provide a comprehensive snapshot of the modern cybersecurity landscape.

Share how you adapt to the dynamic threat environment, the technologies shaping your defence strategies, and the measures taken to fortify digital assets. Whether you're a security leader, decision-maker, or industry observer, share your insights and valuable perspectives on the future of cybersecurity.

We value your opinion!

Cybersecurity is a dynamic landscape, we would like to understand how enterprises are working towards building a cyber resilient strategy...

Start

Q1.

How would you rate your organization's readiness or maturity towards enterprise security?

1 - We are still developing fundamental controls
2 - We have standard protections and regular risk assessments
3 - We employ proactive threat detection, continuous monitoring
4 - We have integrated, automated, and predictive security capabilities

A response is mandatory

Back Next

Q2.

How would you describe your organization's primary cybersecurity strategy approach?
Select Upto Two Best Options

Reactive approach, addressing threats as they appear
Proactive threat prevention and monitoring
Zero-trust architecture
Compliance-driven (focused on meeting regulatory requirements)
Risk-based (aligning security investments to identified risk exposure)
Embedded security by design (integrating security in every process)

A response is mandatory

Back Next

Q3.

How do you primarily manage day-to-day security operations?

1 - Entirely in-house with a dedicated SOC (Security Operations Center)
2 - Partially in-house and partially outsourced
3 - Fully outsourced to a Managed Security Services Provider (MSSP)
4 - Ad-hoc approach without a formal SOC or MSSP

A response is mandatory

Back Next

Q3a.

Basis your experience in the last 12 months, how will you rate your MSS experience on a scale of 1 to 5

1 - Very confident on their capabilities to handle security attacks
2
3
4
5 - Not very confident on their capabilities to handle security attacks

A response is mandatory

Back Next

Q4.

What are the key drivers of your organizations' current cybersecurity strategy?
Select all that apply.

Regulatory or compliance requirements (e.g., GDPR, HIPAA, PCI-DSS)
Executive / Board directives
Past breaches or security incidents
Digital transformation initiatives (cloud migration, remote work, etc.)
Industry standards and best practices
Customer / partner demands
Competitive advantage

Others

A response is mandatory

Back Next

Q5.

To what extent do these trends tend to take place in your organization

Enterprise Security teams are either not consulted or consulted too late when urgent strategic business decisions are made!

Business teams roll out new technologies to urgent timescales that do not allow time for suitable assessment or oversight from security!

Board members routinely review and update the organization's security plan and strategy

A response is mandatory

Back Next

Q6.

Have your organization made significant changes to the cybersecurity strategy in the last 12-18 months?

1 - Yes, we performed a major overhaul
2 - Yes, we made moderate adjustments
3 - Minor changes only
4 - No significant changes

A response is mandatory

Back Next

Q9.

In the enterprise-security domain, what is the current status of the below security tools/processes to ensure cyber resilience in your organization?

	Implemented, with continuous monitoring	In process of implementation	Will Implement this year	No plans yet for this year
Cyber resilience services
Data Security
Incident Reporting
Data Storage/ Backup/ Recovery
Risk Management
Network Security Management
Infrastructure Security
Cloud Security
End User - Device Management
Application Security Management
AI or Generative AI

Response mandatory for all.

Back Next

QN1.

Considering application security minimizes the risk of service interruptions that lead to costly downtime - will your business prefer a more proactive approach to protecting sensitive information by securing the applications themselves, allowing for better control over access and potential vulnerabilities at the source, rather than just encrypting data once it's stored

A response is mandatory

Back Next

QN-2.

What are your organization's plans for enhancing application security in the next 12-24 months?
Select all that apply.

Expanding the use of existing application security tools
Investing in new application security solutions
Enhancing DevSecOps integration
Prioritizing API security
Adopting AI/ML-driven security solutions
Implementing Zero Trust application security

No immediate plans for enhancement

A response is mandatory

Back Next

QN-3.

What are the top priorities for your organization when evaluating cybersecurity observability solutions?
Select all that apply.

End-to-end visibility across cloud, on-prem, and hybrid environments
Faster threat detection and incident response times
AI-driven anomaly detection and predictive analytics
Compliance and regulatory alignment (e.g., DPDP, GDPR, NIST)
Seamless integration with existing security tools (SIEM, SOAR, XDR)
Reducing mean time to detect (MTTD) and mean time to respond (MTTR)
Cost and resource optimization for security operations

A response is mandatory

Back Next

AI in induced in every aspects around us, including cybersecurity, we would like understand its true utilization

Back Next

Q11.

Which of the following AI technologies are you utilizing in your cybersecurity operations?
Select all that apply.

Machine Learning
Natural language processing (NLP)
Predictive analytics
Deep learning
Automated reasoning
Generative AI

Others

A response is mandatory

Back Next

Q11a.

Which of the following AI technologies do you plan to utilize in your cybersecurity operations?
Select all that apply.

Machine Learning
Natural language processing (NLP)
Predictive analytics
Deep learning
Automated reasoning
Generative AI

Others

A response is mandatory

Back Next

Q12.

How effective has AI been in improving your cybersecurity posture?

1 - Extremely effective
2 - Very effective
3 - Moderately effective
4 - Slightly effective
5 - Not effective

A response is mandatory

Back Next

Q12a.

Did you repatriate your AI project?

A response is mandatory

Back Next

Q13.

What benefits has your organization realized from using AI in cybersecurity?
Select all that apply.

Faster threat detection
Reduced false positives
Improved incident response times
Enhanced vulnerability management
Better fraud detection and prevention
Cost savings
Increased operational efficiency

Others

A response is mandatory

Back Next

Q14.

What challenges have you encountered in implementing AI in cybersecurity?
Select all that apply.

High cost of implementation
Lack of skilled personnel
Integration with existing systems
Data privacy concerns
Scalability issues
Algorithm transparency and explainability

Others

A response is mandatory

Back Next

With a dynamic cybersecurity landscape, how agile is the approach of enterprises

Back Next

Q15.

Over the next 12-24 months, do you anticipate further strategic shifts in your cybersecurity approach?

Yes, a major strategic pivot
Yes, moderate adjustments
Possibly minor realignments
No planned changes at this time

A response is mandatory

Back Next

Q16.

Which emerging initiatives are you currently adopting or planning to adopt to improve your organization's cybersecurity stature?

	Already Adopted	Evaluating	Not in Consideration
Artificial Intelligence / Machine Learning for Threat Detection, Diagnosis & Remediation
Artificial Intelligence / Machine Learning driven RegTech
Zero Trust Architecture
Extended Detection and Response (XDR)
Secure Access Service Edge (SASE)
Blockchain-based security solutions
Quantum-safe cryptography
ESG / SDG Solutions
Secure DevOps (DevSecOps) at scale
Attack Surface Management
Privacy-Driven Application and Data Decoupling

Others

Response for all options mandatory

Back Next

Q17.

Please indicate your current top 3 cybersecurity priorities:
Select Top 3 Options

Strengthening email security and anti-phishing measures
Improving cloud security
Expanding threat intelligence capabilities
Enhancing endpoint and IoT security
Upgrading identity and access management
Data loss prevention (DLP) and encryption
Security awareness training and culture
Incident response and business continuity
Third-party risk management

A response is mandatory

Back Next

We would like to understand the organization's cybersecurity investments

Back Next

Q19.

With regard to your cloud environment, how confident are you that your organisation is secured appropriately against the following reasons for cloud security incidents?

	Confidently Managed	Managed but not Confident	Not Adequately Managed	Does not apply to us
Insecure API management
Misconfigured Settings
Poor Data Quality/ Storage Management
Insufficient Employee Training
Inadequate Security Policies
Insufficient Credential Management
Components with known vulnerabilities

A response is mandatory

Back Next

Q20.

Are you correctly cyber insured against any damage or loss from cybersecurity incidents, including employee negligence or insider threats?

Yes
No
Are not insured yet

A response is mandatory

Back Next

While incidents are bound to happen, we intend to understand the preparedness of organizations' IR plan

Back Next

Q21.

In last 12 months, did your organization witness any cyber incident or cyber incident?

A response is mandatory

Back Next

Q22.

On a scale of 1-5, how well did your organization handle the incident?

1 - We handled the incident very well (Considering Identifying, detecting, protecting, responding & recovering)
2
3
4
5 - We were unable to handle it appropriately

A response is mandatory

Back Next

Q23.

If a cyber incident is to happen today in your organization, how confident are you to handle it in all aspects?

1 - We are completely equipped to handle a cyber incident
2
3
4
5 - We are not prepared to handle a cyber incident as of now

A response is mandatory

Back Next

We would like to understand the organization's cybersecurity investments

Back Next

Q24.

Please let us know the share of the enterprise security budget in your overall IT budget

Our Enterprise security budget is separate from IT budget

Back Next

Q25.

How has your cybersecurity budget changed over the past year?

Increased by > 10%
Increased within 1-10%
Remained Same
Decreased by 1-10%
Decreased by > 10%

A response is mandatory

Back Next

Q26.

Please select the appropriate range, mentioning your organization's Enterprise security budget for the year 2025-2026?

< USD 50,000
USD 50,000 - 100,000
USD 100,000 - 250,000
USD 250,000 - 500,000
USD 500,000 - 750,000
USD 750,000 - 1,000,000
USD 1 - 5 Million
USD 5 - 10 Million
> USD 10 Million

A response is mandatory

Back Next

Q27.

Please share your perception on your organization's Enterprise security budget

Enterprise security budget is sufficient
Enterprise security budget share is less
Enterprise security budget share is more than required

A response is mandatory

Back Next

Q28.

What is the % share of below components in your Enterprise security budget?
The sum of all % should be 100.

Cyber resilience services %
Data Security %
Incident Reporting %
Data Storage/ Backup/ Recovery %
Risk Management %
Network Security Management %
Infrastructure Security %
Cloud Security %
End User - Device Management %
Application Security Management %
AI or Generative AI %

The sum of state number should be equal to 100

Back Next

Q29.

How is your enterprise security budget expected to change in next year 2026-2027?

Increase by less than 5%
Increased by 6-10%
Increase by 11-14%
Increase by 15-20%
Increased by more than 20%
Will remain unchanged
Decrease by less than 5%
Decrease by >5%

A response is mandatory

Back Next

CISOs are bound to witness challenges in their cybersecurity strategies

Back Next

Q32.

Please indicate, if the enterprise security initiatives made a positive impact on the following areas
Select All That Apply

Enabled nurturing customer trust
Induced confidence in technology integrity
Improved brand reputation
Reduced resource retention
Improved operational stability
Increased resilience
Increased revenue
Enables competitive edge in the market

A response is mandatory

Back Next

Q34.

Would you be willing to participate in a follow-up discussion or interview?

Yes, please contact me
No, not at this time

A response is mandatory

Back Next

	Priority 1	Priority 2	Priority 3
Cyber resilience services
Data Security
Incident Reporting
Data Storage/ Backup/ Recovery
Risk Management / Threat Intelligence
Network Security Management
Identity and access management
Infrastructure Security
Cloud Security
End User - Device Management
Application Security Management
Compliance & Audit
Training and awareness programs
AI driven cybersecurity solution