From Risk to Resilience: Why Incident Response Now Starts Before the Incident

Cyber security leaders are facing a paradox: threats are evolving fast, yet many of the most damaging incidents still succeed through familiar gaps. In its annual Cyber Incident Insights Report 2026, S‑RM draws on data from 800+ incidents in 2025 to show why resilience is no longer an outcome of security programs, often focused on risk assessment. Resilience is a business capability that must be engineered, tested, and rehearsed.  

Eye opening takeaways from the report

Ransomware still dominates as the number 1 attack type and it’s getting less predictable. 

Ransomware accounted for 45% of incidents S‑RM responded to, but the bigger story is fragmentation: 67 distinct ransomware groups were involved across cases, up from 58 the year before. That splintering matters because it erodes predictability. Established RaaS operations still drive volume, but newer and less mature actors can cause disproportionate disruption — sometimes even damaging systems accidentally during exfiltration.  

The uncomfortable truth: many resilience failures are basic. 

Despite years of awareness campaigns, common entry vectors remain stubbornly consistent: exposed or poorly managed VPN infrastructure, misconfigured or unenforced MFA, and inconsistent endpoint protection. One of the most striking data points: only 22% of ransomware victims had fully deployed and actively monitored EDR across their estate. In other words, it’s not just about buying tools — it’s about operationalising them. 

Extortion has intensified, shifting from focus on decryption to managing fallout.

Backups are improving (69% of victims had “mostly viable” backups), but attackers have adapted: data exfiltration featured in 80% of ransomware incidents, enabling double and even triple extortion (decryption, data suppression, plus additional pressure tactics). Payment rates rose to 24%, yet many organisations engage not to pay, but to understand what was taken and buy time to recover. 

Communications is now more integrated in IR coordination. 

This is where resilience becomes broader than technology. Boards need a pre-agreed decision-making framework on paying ransoms, including named decision owners and rehearsals, because plans for the pay/don’t pay question can collapse under real-world pressure. Similarly, communications is now part of incident response. Threat actors increasingly brief journalists, comment on updates, and directly contact customers/employees for added disruption. Good comms discipline is becoming a resilience control. 

AI raises the stakes – mostly because of what organisations are deploying themselves.

While fully autonomous ransomware isn’t yet the norm, AI is accelerating the attack lifecycle and lowering the barrier to entry. The more immediate risk is internal by way of insecure enterprise adoption. AI agents and automated workflows introduce new non-human identities with broad privileges, expanding the attack surface and complicating forensics when something goes wrong.

How to improve incident response 

Speed is the primary IR objective.  

S‑RM’s data shows that attack timelines are compressing; what once took weeks now takes days or hours. Faster tooling, streamlined playbooks, and selective use of AI mean responders have less time to analyse and decide. Decisive action requires a careful balance of transparency during incomplete information along with the speed and accuracy of a company’s response. 

Prepare in advance 

Incident response outcomes are largely determined before the incident. There are ways to be more prepared. Optimise for early detection and rapid containment. Build escalation paths and define decision authority before an incident occurs. Developing detailed scenario plans and testing is a key factor of stronger resilience. 

Operationalise controls 

Efficient and active enforcement needs to be fully operational and integrated into response workflows so that alerts translate quickly into action. Controls in place and deployment of tools alone do not protect you. For instance, only 22% of ransomware victims in 2025 had fully deployed EDR that was actively monitored. Therefore, it is process and clear hand-off between tooling and humans that drives resilience. 

Detect earlier in the attack lifecycle 

The most effective incident response increasingly happens before an incident escalates into full business disruption. S‑RM highlights that a growing number of cases where fast triage prevented major impact when detected early at the network intrusion stage. Early detection – at the intrusion or lateral‑movement stage – gives responders the opportunity to contain threats before encryption, data theft, or extortion occurs. Improving visibility across identity, endpoints, and network activity shifts response ‘left’ and dramatically reduces downstream impact. Prioritise telemetry, lateral movement and rapid containment playbooks. 

Integrate incident response with business continuity and recovery 

Cyber incidents rarely remain technical events. They rapidly become business continuity challenges. Incident response plans must therefore be tightly integrated with business continuity and disaster recovery frameworks. Recovery priorities should be driven by business‑critical services, and not just systems. IR and BCDR plans must be tested together to ensure technical response, operational recovery, and executive decision‑making work as a coordinated capability. 

Prepare incident response for AI and non‑human identities 

As organisations adopt AI agents, automations, and API‑driven workflows, incident response must evolve to account for non‑human identities with broad system access. When these identities are compromised, responders need to understand what the system accessed, what actions it took, and what data it processed. Applying the same identity, privilege, and monitoring discipline to AI systems as to human users is becoming essential to AI security. 

Strengthen your cyber resilience, mitigate risk and contain attacks in your enterprise

Our end-to-end adaptive cyber security services enable you to outsource all or part of your cyber security function. In addition to an extensive suite of managed services that release your IT teams from having to do any heavy lifting, our comprehensive offerings also include cyber security strategy and advisory services that help you strengthen your defences and improve your security posture, identify and manage risks, and comply with regulations. Learn more.

To learn more about our cyber security services, get in touch with Billy Weatherall, Sales Specialist Manager at bweatherall@bell-integration.com or +447785 311652. 

Arsalan Khan
Principal Consultant – Bell Integration

Arsalan Khan is a Principal Consultant and security subject matter expert at Bell Integration, with over 24 years of experience across cyber, cloud, network, and information security. He holds MSc and BSc degrees and certifications including CISSP, CCSP, CISA, and CCIE Security. Arsalan has led complex consulting engagements across Oil & Gas, Finance, Healthcare, and the Public Sector, helping organisations design secure, scalable architectures that strengthen resilience, support compliance, and align modern security with business goals.