The Agility Gap

This demonstrates that almost a third of companies don’t focus on human reliance in their cyber defence strategies, despite the aforementioned increase in social engineering attacks. At the same time, it’s encouraging to see that the majority of companies we surveyed do include human resilience as a central part of their cybersecurity approach.

However, hackers do not operate in fixed review cycles. Phishing campaigns can be created and refined within hours. A 19-day adaptation cycle highlights a clear imbalance between attacker agility and organisational response.

This also introduces an important contradiction. Many organisations describe themselves as adaptive, yet their reported response timelines suggest that adaptation is still measured in weeks rather than days. If updates require significant time to deploy and validate, then adaptiveness may be procedural rather than dynamic.

It should be a case of "we have done it", rather than "we can do it". For leadership teams, the more important question may not be whether the organisation can adapt in 19 days, but whether that timeframe is strategically sufficient in a threat landscape that evolves daily.