Overconfidence blamed as teams stumble through cyber sims.

"Immersive's latest Cyber Workforce Benchmark, which draws on 1.8 million exercises from the Immersive One platform and a survey of 500 cybersecurity leaders, paints a picture of an industry that has become more confident but no more capable. Immersive says 94 percent of organizations believe they can "effectively detect, respond to, and recover from a major incident," yet real-world performance in controlled drills has remained stubbornly flat."

"According to the report, resilience scores haven't improved since 2023, with the median response time to complete critical cyber threat intelligence labs still coming in at 17 days - despite what Immersive describes as "record investment" and growing pressure from boards and cyber insurance carriers. James Hadley, Immersive founder and chief innovation officer, argues that organizations are failing not for lack of effort, but because they are training for the wrong fights."

"Across the company's crisis-simulation drills, which involved 187 professionals in 11 global exercises, performance was consistently poor. Participants achieved just 22 percent accuracy, averaged 60 percent confidence, and took 29 hours to contain an infection, a combination the report describes as evidence that "when tested under pressure, most teams didn't fail for lack of knowledge, they failed for lack of practiced coordination.""

Data drawn from 1.8 million platform exercises and a 500-leader survey show industry confidence rising while measurable capability remains flat. Resilience scores did not improve since 2023, and the median time to complete critical cyber threat intelligence labs stayed at 17 days despite record investment and rising board and insurer pressure. Crisis-simulation participants achieved roughly 22 percent accuracy, averaged 60 percent confidence, and required about 29 hours to contain infections. More than 60 percent of sectors experienced slower response times year-over-year. Shortfalls reflect practiced coordination and exercise design gaps rather than simple lack of technical knowledge.

Read at Theregister