IT folks will already want to download Cohesity’s new 2026 Report on Cyber Resilience, but here’s why Business Continuity and Risk Management folks ought to also.
The report measured what those of us in resilience have known for a while: (1) the importance of building your plan around your MVC and (2) quantifying the gap between IT ‘restoring systems‘ and the business ‘resuming operations.’
As someone who spends as much time (and research) among BC/DR leaders as tech vendors/partners, here’s what stood out to me.
video transcript
Most analyst firms shy away from talking about research that they didn’t produce … DPM is not your typical analyst firm.
Cohesity just released its 2026 Cyber Report. While I’m usually a little suspect of vendor-based research, Cohesity used Vanson Bourne as their panel company, which I’ve used too, especially when surveying 3,200 international respondents. As one might expect, there’s a heavy focus on cyber resilience within the report, so most IT leaders will already be inclined to download it.
But, let me point out a few things for the real resilience folks, those folks whose titles include business continuity, risk or emergency management, as well as disaster recovery and cyber resilience. Business resilience folks often lament that there is a disconnect in the strategies between what operational stakeholders are looking for and what IT teams are focused on. In fact, the Cohesity report measured that 78% of folks admit their plans focus more on restoring systems than on business operations. And while the BC and Risk folks are probably screaming “AMEN”, you should also look at how the report measured organizational alignment around the Minimum Viable Company (MVC). For context, when you step out of the IT bubble and spend time on business resilience, you look at:
- What really are the key business processes that have to continue?
- (and then) Which IT systems do they depend on?
Then, build your tier 1 resilience plan around that, because that is what gets senior leadership understanding and support for real continuity of operations. This is what prioritized resilience planning really ought to look like; and yet, according to the respondents in Cohesity’s report, 63% of folks haven’t even formally defined their MVC yet, much less built their plan around it or tested its resilience capabilities.
Of course, there’s also some interesting (more like unsettling) stats around AI in production, where a lack of confidence shows up around protecting, governing, and rolling back errant AI, on top of the more familiar worry over AI-fueled threat actors. DPM will have more to say on those topics within our own research later this fall, but until then let me just say “I didn’t write this report, but I did read it cover to cover … and you might want to, also.”
Leave your thoughts on the LinkedIn article.
Leave a Reply