01 · Diagnosis
The confidence gap
Companies operate in a permanent state of uncertainty, complexity and change pressure. Digitalisation, cloud adoption and AI increase the value of corporate data – and expand the attack surface at the same time. Yet most organisations believe they are well prepared.
High confidence, sobering reality
Confidence is rarely tied to a consistent target picture: only about two thirds of companies have fully aligned their RTOs with business continuity objectives.
Confidence
90%
very to extremely confident in meeting RTOs. Source: Veeam Data Trust and Resilience Report 2026.
Alignment
69%
RTOs fully aligned with business continuity. Source: Veeam 2026.
Follow-up cost
>40%
customer or financial damage after an incident. Source: Veeam 2026.
Ransomware incidents test recovery processes under real pressure – not in the planned drill, but in the real event. Almost 3 in 10 organisations experienced a cyber incident with data loss, downtime or business disruption in the past twelve months.
Attack
56%
ransomware attacks with successful encryption or exfiltration. Source: Veeam 2026.
Recovery
28%
full data recovery after ransomware. Source: Veeam 2026.
Loss
44%
recovered less than 75% of affected data. Source: Veeam 2026.
Core
Confidence often stems from the mere existence of backups, policies or insurance – not from regularly tested recovery validated under real conditions. This gap is the starting point of any serious resilience strategy.
02 · AI risk
AI accelerates the confidence gap
AI is moving from experimentation into everyday execution. Security leaders report that AI is already embedded in core processes. AI risk therefore becomes a governance and resilience topic – not just a question of model security. New data paths across users, applications, APIs and third parties amplify data sprawl, inconsistent access controls and unclear responsibilities.
Pace
43%
AI adoption outpaces the ability to secure data and models. Source: Veeam 2026.
Visibility
42%
limited visibility into the AI tools and models in use. Source: Veeam 2026.
Policy
40%
security policies not yet extended to AI risks. Source: Veeam 2026.
In addition, 25% cite shadow IT and unauthorised AI use as their primary concern. AI expands the scope of what needs to be protected and recovered – data, pipelines, identities and the systems AI depends on.
Consequence
AI is not an add-on project but an integral part of the organisational operating system – including governance and compliance logic.
03 · Governance
Why policy alone is not enough
To reduce rising AI and data risks, companies need governance approaches that go beyond pure statements of principle and are backed by enforceable controls. One indicator: 48% already deploy data loss prevention (DLP).
| Metric | With DLP | Without DLP |
|---|---|---|
| Limited visibility into AI tools and models | 39% | 45% |
| AI adoption outpaces security controls | 38% | 48% |
Source: Veeam Data Trust and Resilience Report 2026.
Who is accountable?
Responsibility for AI governance is rarely shared across the leadership team – it usually sits with a single role.
CISO
38%
AI and data risk governance sits with the CISO. Source: Veeam 2026.
CIO
27%
sits with the CIO. Source: Veeam 2026.
Committee
17%
cross-functional committee. Source: Veeam 2026.
Concentrated responsibility in a single role can create blind spots: AI risk sits at the interface of cyber security, data protection, infrastructure, compliance and business operations. This matches the Resilience Bakery governance model of preventive, proactive, detective and reactive AI compliance.
04 · Practices
Four practices for proven resilience
No single policy, leadership role or technology guarantees recovery readiness. But four practices consistently correlate with stronger recovery outcomes.
1. Extend accountability beyond security
37% of companies without an incident use cross-functional policy approval bodies, compared to 31% of companies with an incident. Source: Veeam 2026.
2. Operationalise AI governance
Companies with budget increases are significantly more likely to have a formal AI risk policy (about two thirds vs. 27%) and model validation, testing and drift monitoring (43% vs. 26%). Source: Veeam 2026.
3. Report cyber risk to leadership regularly
56% (no incident) report to the board monthly or more often, vs. 50% (with incident). Advanced reporting: 40% vs. 35%. Source: Veeam 2026.
4. Track the right KPIs
Most frequently tracked: restore and recovery tests (57%), mean time to recover (56%), time to isolate/contain (42%), fully automated recovery (23%). Source: Veeam 2026.
05 · Investment
Investment shows measurable effect
49% of organisations increased their cyber security budget year-over-year, 51% kept it flat or reduced it. This split explains a significant part of the differences in resilience outcomes.
| Metric | Budget increased | Budget not increased |
|---|---|---|
| RTO tracking as KPI | 78% | 56% |
| Immutable storage prioritised | 38% | 11% |
| Ransom paid (ransomware) | 32% | 52% |
| 100% of data recovered | 40% | 16% |
Source: Veeam Data Trust and Resilience Report 2026. Correlation, not causation.
Regulatory pressure is rising too: cyber attacks remain the most likely risk to data resilience over the next twelve months at 36%, closely followed by regulatory requirements (33%); 58% name data residency and sovereignty as the most important factor for data placement. Compliance and resilience thus overlap increasingly – matching the preventive-proactive-detective-reactive governance model of Resilience Bakery.
06 · Conclusion
From confidence to proven resilience capability
Organisations that overestimate their resilience are exposed to higher data risk. Real resilience shows in validated recovery performance – backed by strong data governance, cross-functional accountability and disciplined execution. Those who begin systematically diagnosing, prioritising and validating their resilience today gain a structural lead that late movers can only close with significant effort.
For executive leadership
- Anchor recovery capability on the CEO agenda
- Establish quantified cyber-risk reports to the board
- Set up AI governance across functions
- Prioritise budget for recovery tests and immutable storage
For managers
- Schedule restore and recovery tests under real conditions
- Make AI tools in your area visible and documented
- Actively track RTO, MTTR and time-to-contain
- Define fallback processes for critical AI workflows
Resilience Bakery supports this path – from diagnosis (Resilience Check, Early Warning Canvas) through the AI compliance strategy to scalable implementation in the operating system of the organisation.