CISOs Boost Crisis Simulation Budgets Amid High-Profile Cyber-Attacks

Most CISOs plan to enhance their crisis simulation capabilities in 2025 to better prepare for potential full-scale cyber crises, according to a new study by Hack The Box.

Of the 200 UK and US-based CISOs surveyed, 74% said they plan to increase their crisis simulation budgets in 2025. 

According to Hack The Box, this decision reflects growing concerns around rising attack volumes, lack of incident response planning and inadequate stress-testing of crisis scenarios. 

These concerns are heavily influenced by the wave of high-profile cyber-attacks that occurred in 2024, including national and global organizations like 23andMe, Cencora, the UK’s National Health Service  (NHS) and Transport for London (TfL).

The study shows that a majority of CISOs believe that crisis simulations are key to improving cyber preparedness, with almost three-quarters of respondents (73%) considering cyber incident live drills as their top business priority for 2025. Furthermore, 16% of security budgets are being reallocated to crisis preparedness.

Finally, 77% of CISOs said they would be willing to focus on cyber crisis simulations if they were more realistic and actionable. 

Haris Pylarinos, CEO and Founder of Hack The Box, commented: “There is a need for these [crisis simulation] exercises to be increasingly realistic and engaging, to equip both technical and non-technical teams of all levels with the confidence needed to decisively defend against evolving threats.” 

He added that the “next evolution of crisis simulation” will be powered by a combination of expert knowledge and AI systems.

“Highly realistic and tailored scenarios […] will unite previously disparate business units as one and allow real-world performance to be benchmarked in a controlled environment,” Pylarinos concluded.

The Hack The Bock study was published on January 27, 2025. The survey was conducted by Censuswide between December 4 and 9^, 2024.

Read now: EU Ramps Up Cyber Resilience with Major Crisis Simulation Exercise