Cyber resilience: perception versus reality

IT- & Cloud-Security 2027 Study: Technology Alone Isn’t Enough to Keep Companies Secure

Many companies feel confident in their cybersecurity – until a security incident challenges that perception: The study "IT- & Cloud-Security 2027" by COMPUTERWOCHE Research Services in collaboration with Lufthansa Industry Solutions shows that there is often a gap between self-assessment and reality. In the study, you will also learn how AI agents are secured and why security is not just a technology problem.

Major Incidents Despite Seemingly Strong Cyber Protection

81% of the companies surveyed rate the quality of their cyber protection at six out of ten or higher. 24% even consider it very good or excellent. This suggests a high level of confidence in their own security posture.

The operational reality is far more sobering: 47% report at least one serious IT security incident over the past two years. There is a significant gap between perceived and actual IT security maturity levels.

AI Agent Adoption Is Outpacing Security Controls

59% of companies already use AI agents or have concrete plans to deploy them. At the same time, 54% cite potential data leaks as their primary concern, while 36% fear loss of control due to autonomous agents.

Security controls are not keeping pace: Only 23% of surveyed IT decision-makers have full visibility into the AI tools in use. 34% have clear policies for AI agents, and only 29% can trace their actions at any time. This means AI security is a matter of governance—not just technology.

Brief insight into "IT- & Cloud-Security 2027" study
Free Download of the Study “IT- & Cloud-Security 2027”

In the new “IT- & Cloud-Security 2027” study, learn how companies assess their cyber resilience, how cloud and AI risks are managed, and where organizational structures, skills, and responsibilities need to catch up.

These and Further Insights Are Provided by the Study “IT- & Cloud-Security 2027”:
  • How companies secure AI agents
  • Who is responsible for IT security in companies and who is involved in decision-making processes
  • How IT decision-makers assess the risk of industrial espionage, ransomware, or supply chain attacks
  • How well companies monitor their cloud security
  • Which security areas companies plan to invest in – and what role training plays
Two infographics on cybersecurity in businesses (n = 307). When asked, “Overall, how well do you feel your company is protected against the threats of cybercrime?” respondents predominantly gave high ratings on a scale from 1 (completely inadequately protected) to 10 (first-class protection). The most common ratings were 8 (24.9%), 7 (20.0%), and 9 (16.7%). Respondents answered the question “Has your company experienced a security incident in the past two years?” as follows: 33.2% reported only minor incidents, 24.8% reported one major incident, and 22.1% reported several major incidents. 17.6% had no security incidents, and 2.3% did not know.
Many companies feel well protected – yet major security incidents still occur: There is a gap between perceived and actual IT security.
  • Self-assessment and incident records do not align
    81% rate their cyber protection at six out of ten or higher. At the same time, 47% experienced at least one serious IT security incident in the past two years.
  • Cloud adoption is outpacing oversight
    70% use cloud services; another 23% plan to adopt them. However, only 30% monitor cloud configurations, content, and SaaS services very closely and comprehensively.
  • AI changes security priorities
    51% expect protection against AI-driven attacks to become significantly more important. However, only 37% offer mandatory AI-related security training.