Search Economist Enterprise
The Technology Resilience Index
Technology resilience enables organisations to operate, adapt, and grow through disruption. Resilience spend is rising. Yet many organisations remain exposed because the fastest-growing threats are increasingly difficult to see, test and control.
Economist Enterprise, supported by AT&T Business, surveyed 1,020 senior technology and operations executives at mid-sized and large US enterprises across seven sectors.
- 1020 executives
Senior technology and operations executives
- 7 sectors
Healthcare, manufacturing, finance, retail and consumer goods, hospitality, professional services and technology
- Mid- and large US companies
Mid-market = 100-1,999 employees, Large companies = 2,000+ employees
The research uncovered
Three weak points account for most of what breaks, and for most of what organisations are least ready to handle.
Third-party vendors: The failure most likely to disrupt operations often originate outside the organisation, in critical dependencies businesses don’t fully control.
Legacy technology: The systems hardest to replace are the ones that break first.
AI and automation: Not yet a leading cause of failure but one to watch closely.
The damage comes from outside the walls
Ask executives what broke last year, and they don’t name a hacker. They name a vendor. The failures that hurt most sit at the edges of the organisation, where business operations depend on vendors, platforms and services beyond direct control.
of respondents ranked third-party failure as the primary cause of technology disruptions in the past 12 months.
Trust stands in for proof
Identifying a dependency is only the first step. Resilience depends on understanding how that dependency performs under pressure. Visibility creates awareness. Testing creates confidence.
Nine in ten organisations only discover a third-party failure once disruption is already underway, or after it's too late.
Reputation isn’t evidence
Firms rely on a supplier's word, then find out what it was worth mid-incident. The organisations recovering fastest increasingly verify resilience through monitoring, testing and continuous assessment rather than assumptions alone.
65% assess the resilience of critical technology suppliers on reputation and assurances rather than on evidence...
...and at the same time 45% of organisations have not tested for a third-party or cloud provider outage in the past 12 months.
But spending does not always match exposure
Resilience spending still follows headlines, not risk. Cybersecurity draws nearly a quarter of the average budget, greater than what goes to connectivity and recovery testing that might have caught the failure early.
Mean share of technology budget dedicated to resilience by category:
- 0.0%Cybersecurity
- 0.0%Network and connectivity
- 0.0%Monitoring and observability
- 0.0%Recovery testing and continuity planning
- 0.0%Legacy system maintenance
- 0.0%AI and automation systems
The weight of legacy
Many recent failures are the cost of legacy technology debt. Outdated technology is often what breaks first.
of organisations cite outdated technology as a top barrier to maintaining and recovering critical technology services
And bigger doesn’t mean safer
Scale increases the number of systems, integrations, and dependencies organisations must manage.
- 0%of large organisations
- 0%of mid-market organisations
Percentage of organisations that have reported at least one major incident in the past year
Untested intelligence, a cautionary tale
AI introduces new resilience challenges, but it can also help organisations anticipate issues earlier, automate responses and strengthen operational awareness. The challenge is ensuring those systems are tested before they are trusted.
Just 21% of organisations have tested for AI failure in the past year.
Resilience is a habit, not a budget line
What separates fast recovery from just looking prepared isn’t budget. It’s habit: learning from failure, rehearsing for disruption, and knowing who’s accountable when something goes wrong. Few organisations do all. Those who do have a competitive advantage.
Learn from failure
Marks & Spencer and Co-op were breached by the same attack tactic within days of each other. One had rehearsed. Fifteen weeks and £300m separated one from a month and £80m.
Cost of breach
Assume failure
A tested incident-response plan saves an average of US$1.49m in a breach. Almost three-quarters of organisations have tested cyber response. Just 15% have rehearsed a geopolitical or trade disruption.
A tested resilience response plan saves
Own it
One in ten organisations say unclear ownership and accountability are the greatest barriers to maintaining and recovering critical technology services. A similar share struggles with a lack of executive alignment.
Explore the research
The cheapest resilience is designed in. The most expensive is improvised during an incident. Organisations that combine visibility, resilient infrastructure and disciplined preparedness are better positioned to recover, adapt and grow. Are you ready?