The 2026 CEO Technology and Cyber-Readiness Survey
Draft copy — questions and report copy need Nathan's approvalFourteen questions, and the findings published in the open
For Owners, chief executives, and the finance or operations leaders who sign technology decisions
Your result below is yours to keep. Separately, and only if you say yes, your answers join the aggregate that becomes this year's published findings — which is the point of running this as a survey rather than a quiz.
The questions
Your result
Tier
—
The full report
The full report adds the category breakdown, what your tier means, and the three things worth doing first. Email it to yourself and you will have it when you need it in a meeting.
Report
Result
—
Most of these questions came back as "I would have to ask", which is not a failure of diligence — it is what happens when technology decisions get made by whoever noticed the problem. The exposure here is not any single gap. It is that nobody can currently tell you what would happen if something went wrong.
Where to start
- Pick the single question above you could not answer and find the answer this month.
- Ask for a restore test you watch, not a report saying backups completed.
- Write down who is allowed to change where money goes.
The decisions are being made and mostly made well, but the evidence for them lives with your provider rather than with you. That works until the day you need to make a judgement call about their advice and have nothing independent to weigh it against.
Where to start
- Ask your provider for evidence against the contract, not a status report.
- Get your recovery time in writing, from a test rather than an estimate.
- Inventory which vendors hold your data.
You own these decisions and you can explain them. What is usually missing at this level is rhythm: the tests, reviews, and inventories exist but happen when someone remembers rather than on a schedule that outlives their attention.
Where to start
- Put the restore test on a calendar with a named owner.
- Set written guidance on AI tools before an incident sets it for you.
- Review the vendor data inventory annually.
This is the level most companies are told is normal and few reach. The decisions are yours, the evidence is current, and the checks happen whether or not anyone is worried that week. The risk from here is drift — a routine that stops being followed rarely announces itself.
Where to start
- Ask what would have to be true for last quarter's answers to have changed.
- Test a recovery scenario nobody has rehearsed.
- Compare your answers against the published findings for companies your size.
By category
Weight ×0
Weight ×3
Weight ×3
Weight ×2
Weight ×2
Weight ×2
The same scores as a table
| Category | Weight | Points | Score |
|---|---|---|---|
| Your company | ×0 | — | — |
| Who decides | ×3 | — | — |
| Recovery | ×3 | — | — |
| Access | ×2 | — | — |
| Vendors and providers | ×2 | — | — |
| AI governance | ×2 | — | — |
What this is, and is not
Your result below is yours to keep. Separately, and only if you say yes, your answers join the aggregate that becomes this year's published findings — which is the point of running this as a survey rather than a quiz.
Next steps
Related