The two figures answer different questions, which is why one of them cannot carry the weight boards put on it. The 96% is a self-assessment about keeping pace with the volume and complexity of threats [1]. The 63% is a report of something that already happened [2]. Add the 7% who suspect an incident went undetected [3], and 70% of the same respondent pool either confirmed or suspected a significant incident inside twelve months [1].
The strange part is the direction of travel. Among leaders whose organisations had been hit, 57% were very confident; at organisations that had not been hit, 47% were [4]. Being breached carried a ten-point confidence premium [2]. There are two honest readings. An incident is the only real test most security programmes get, so afterwards the answer is grounded in observed performance rather than assumption. Or the answer reflects relief at having survived. Either way, a director treating the confidence rating as a maturity indicator is reading a number that rises after failure.
The duration data is where this stops being a security metric. Of organisations that had a significant incident, 87% lost time or productivity, 48% were disrupted for two weeks or longer, and almost 10% for two quarters or more [5][6][7]. Apply that 48% to the 63% who confirmed an incident and roughly 30 of every 100 leaders surveyed spent at least a fortnight operating in a degraded state [3]. That is a delivery and finance problem being reported inside a security survey.
The mechanism behind it argues the same way. Verizon's 2026 report analysed more than 22,000 confirmed breaches and found identity contributed to 62% of them, with credential abuse in 39% of full breach chains, the most pervasive technique it tracked [8][9][10]. The FBI logged $20.877 billion in reported losses for 2025, up 26% on 2024, with business email compromise above $3 billion [11][12]. Arctic Wolf is careful to say these datasets measure different populations and should not be summed [13], which is the right caveat. But a valid login used by the wrong person is not a prevention failure a board can budget away; it is a detection and response interval, measured in hours or weeks.
Which is where the cost figure lands. IBM put the global average breach cost at $4.99 million, up 12% year over year, and found $1.93 million in average savings for organisations using security AI and automation extensively versus not at all [14][15]. That saving is about 39% of the average breach cost [4], and Arctic Wolf, which sells 24x7 monitoring and detection [16], says plainly that AI alone does not create resilience and that automation generating alerts without advancing an investigation adds cost [17]. Worth noting when the vendor supplying the diagnosis also supplies the remedy.
The survey's own reframing of the question is the useful part: if suspicious activity appeared today, could you detect it, establish what happened, and act before it became material disruption [18]. Those are timestamps, not opinions. When telemetry first showed the activity, when a human confirmed it, when scope was established, when containment closed, when the business function came back. They sit in ticketing and incident records for whatever the last real incident was. Only 29% of respondents were confident they had avoided a significant incident in the year, against 27% the year before [19], so most boards have a recent case to ask about.
