Survey: CISOs Increasing Budgets for Crisis Simulations in 2025
Today, Cyber Performance Center, Hack The Box, released new data showcasing the perspectives of Chief Information Security Officers (CISOs) towards cyber preparedness in 2025.
In the aftermath of 2024’s high-profile cybersecurity incidents, including NHS, CrowdStrike, TfL, 23andMe, and Cencora, CISOs are reassessing their organization’s readiness to manage a potential “chaos” of a full-scale cyber crisis.
Many CISOs across the UK and US, are concerned about their organization’s ability to handle a cyber crisis. This is owing to a number of reasons – the rising volume of cyber incidents (31%), lack of incident response planning (20%), and a lack of realistic, stress-tested crisis simulations (19%).
This drives CISOs to reallocate budgets towards crisis preparedness, as they seek to maintain security posture.
Key findings include:
- 74% of CISOs reported their organizations are increasing annual budgets for crisis simulation exercises in 2025, motivated by last year’s major incidents.
- 73% identified practical crisis simulations and incident response exercises involving both technical and non-technical teams - as their top business priority for 2025.
- 77% stated they would allocate greater budgets for cyber crisis simulations if the exercises were more realistic and actionable.
The findings highlight a growing recognition among CISOs of the importance of realistic, hands-on crisis simulations to build visibility and ensure their organizations can respond effectively during a crisis. In fact, as much as 16% of 2025 security budgets are being reallocated to simulation exercises following last year’s incidents.
Haris Pylarinos, CEO and Founder at Hack The Box, commented: “Preparedness is the foundation of resilience, and crisis simulations play a crucial role in testing organizations security and workforce performance when it's most critical. Organizations are right to prioritize crisis simulation and must ensure that these are implemented in the right way. There is a need for these exercises to be increasingly realistic and engaging, to equip both technical and non-technical teams of all levels with the confidence needed to decisively defend against evolving threats.”
“The next evolution of crisis simulation is coupling AI with expert knowledge to deliver highly realistic and tailored scenarios that challenge senior management and front-line professionals. These will unite previously disparate business units as one and allow real-world performance to be benchmarked in a controlled environment.”
Lucas Kello, Associate Professor of International Relations at the University of Oxford, said: “With the expansion of artificial intelligence, the escalating cyber arms race is entering a new and more unstable phase. AI can act as both a weapon and a shield; it can enhance threats even as it helps to defeat them. The investment in crisis simulation exercises reflects a growing awareness that future cyber conflicts will transcend current threat models while requiring accelerated responses that outpace human reaction times.”
“Cyber preparedness is now a matter of national and economic security. 2025 will be a critical year for setting new standards in how nations and industries both utilize and protect against AI.”