Security and risk
Cyber security
This benchmark asks the people responsible for security how they decide what to fix first, who signs off the spend and what makes them trust a supplier.
What we’re researching
Three questions for 2027.
Findings publish once 100 qualified people have taken part. Until then, this page shows what we’re asking rather than what we’ve found.
- Q1
Which security priorities make it into this year's budget, and which keep slipping?
- Q2
How much of security buying is driven by frameworks and audits rather than threats?
- Q3
When do teams choose a managed service over building in-house?
Who should take part
- CISOs and heads of security
- IT directors
- Security engineers
- Risk and compliance leads
And anyone else shaping a cyber security decision for their organisation, in any country.
Areas the benchmark covers
Industries we research this with
Related guides
- Questions to ask a technology supplier before you sign
- What is DORA? The Digital Operational Resilience Act explained
- What is NIS2? The EU cybersecurity directive explained
- What is Cyber Essentials? Controls, cost and the April 2026 changes
- What is ISO/IEC 27001? The 2022 standard explained
- What is SOC 2? Type 1, Type 2 and the Trust Services Criteria
FAQ
Questions people ask
Who can take the cyber security benchmark?
Anyone shaping a cyber security decision for an organisation, in any country and any industry. It is written for people answering in a professional capacity, such as cisos and heads of security, it directors, security engineers.
How long does it take?
About 7 minutes. There are 21 questions and no free-text answers.
Is it free?
Yes. Taking part is free and you see your scored result on screen straight away.
What happens to my answers?
Answers are stored without your name, email or IP address and combined into anonymised research. No figure is published for a group smaller than 10. Nobody contacts you unless you tick the box asking us to.
When will the cyber security findings be published?
Once 100 qualified people have taken part. Until then this page shows the questions we are asking, not findings.