The State of Cyber Risk 2025: Business Context Needed | Qualys
Summary: A Qualys-commissioned Dark Reading survey of over 100 IT and cybersecurity leaders found that 49% report having a formal cyber risk program, yet most of those programs remain focused on compliance checklists or technical assessments rather than business context. The report also found that 71% of organizations believe their cyber risk levels are rising or holding steady despite continued growth in security spending, and that 68% of respondents use integrated risk scoring combining threat intelligence or cyber risk quantification with forecasted loss estimates.
What you should know: Nearly half of surveyed organizations claim a formal risk program while 71% say risk is flat or rising - a signal that the programs are not moving the number that matters. Qualys CEO Sumedh Thakar frames the board's question as 'Are we reducing risk? How much? Where should we focus next?' - and the report's finding that 90% report findings to the board without translating them into business terms leaves directors answering that question with incomplete information.
Read the original at Qualys Blog ↗
- Topics
- Governance, Risk & Compliance
- Related
- Upcoming Speaking Engagements Cyber Risks · Nov 14, 2026Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters Cyber Risks · Nov 13, 2026AI Doesn’t Have to Go Rogue to Break the World Cyber Risks · Nov 13, 2026