At Risk or Future-Ready? New UK Business Resilience Research Reveals Most Firms Still Focus on Defence, Not Growth

Independent “Business Resilience Index” research – commissioned by Six Degrees, supported by Microsoft – finds UK organisations still equate resilience with cyber defence, despite automation and AI now being seen as the strongest drivers of resilience.

London, UK, Thursday 22^nd January 2026 – New independent research – the Business Resilience Index – commissioned by Six Degrees and supported by Microsoft reveals a significant shift in how UK organisations are beginning to think about resilience. But it also finds that maturity remains low overall – with continuity and security still fragile, and only a small minority of organisations designing resilience as a platform for advantage.

The research, conducted among 600 senior UK IT and security leaders, defines a five-tier maturity model for business resilience – from At Risk through to Strategically Resilient. It benchmarks performance across five pillars: Continuity, Security, Scalability, Efficiency, and Innovation – and highlights what is driving, and blocking, maturity.

When asked to define business resilience in their own words, 71% referenced something security-related – confirming that the dominant mental model today is still protection and defence. Yet 91% of respondents said they learnt something new from the fuller definition used in the research, showing market appetite to move beyond cyber-only thinking.

The single clearest break point in the data is that automation and AI now rank as the top drivers of resilience. These score ahead of incident response, recovery, and continuity planning – signalling a pivot from “minimise loss” to “maximise speed of decision and competitive advantage”. In other words: the organisations who are progressing fastest are those who treat resilience as opportunity readiness – a foundation for what comes next, not just protection against what exists today.

In the Index, Continuity is the most fragile pillar. Almost one in three organisations (28%) are categorised as At Risk – with average uptime across critical business services over the past 12 months just 73%. Exploring industry sectors, tech sector mean time to recover (MTTR) averages 9.7 hours – three hours slower than retail – evidence that operational readiness is weaker than perceived.

Security faces a similar pattern: despite quarterly penetration tests being common, only 5% are classified as Strategically Resilient – meaning fully proactive, governance-led security. Third-party resilience is materially undervalued, despite recent UK supply chain incidents.

Overall, the organisations most advanced in the Index behave differently: they view resilience as a platform for speed, innovation, and market responsiveness – not a contingency function. Protecting today is vital, but if that’s all resilience is, it becomes the ceiling; the leaders use resilience to unlock automation, adopt AI faster, and build advantage into the future.

“True resilience isn’t simply about avoiding failure; it’s about enabling your organisation to move faster, scale faster, and recover faster,” said Vince DeLuca, CEO at Six Degrees. “We commissioned this study because the market needs objective data. Boards may believe they are resilient, but the data tells a different story. Real competitive advantage only comes when resilience is treated as a strategic priority and reinforced by advanced technologies – such as AI, automation and cost insight.”

Barriers differ sharply by sector and role. Manufacturers point to budgets; retail to culture; public sector to skills. IT cites scenario planning and capability gaps, while security teams point to silos and under-investment. Leadership alignment remains the greatest unlock – under-investment in risk and technology is the top barrier overall, yet only 8% blame financial health. Board commitment sits tenth.

The Business Resilience Index – available for download – provides the full benchmark and enables organisations to self-assess against peers.

To download the Business Resilience Index, click here: https://www.6dg.co.uk/whitepaper/business-resilience-index-2026/

About the Research

Findings contained in Six Degrees’ Business Resilience Index are based on a robust sample of 600 senior UK IT and security leaders across six sectors: Financial Services, Retail, Manufacturing, Tech/Software, Legal/Professional Services, and the Public Sector. This is supplemented by qualitative insight from eight C-suite interviews.