2025 State of Disruption Report

From IT protection to business resilience

IT resilience keeps systems, networks and data secure, stable and recoverable. Business resilience connects those capabilities to the organization’s ability to absorb disruption, adapt and continue delivering value.

The IT estate includes hardware, software, networks, data, cloud services and virtualized environments. CIOs and infrastructure leaders must connect asset visibility, financial planning, risk mitigation and continuity across that estate rather than treat resilience as the security team’s responsibility alone.

Make risk a business conversation

Disruption can originate in vulnerable suppliers, outdated systems, unpatched devices, negligent employees or departing executives taking sensitive information. Distributed contractors and unmanaged personal devices create further exposure; attacks that interrupt availability can become board-level business risks.

The report cites Gartner’s finding that 93% of non-executive board members see cybersecurity threats as a direct risk to shareholder value. It also cites Accenture research indicating that nearly 90% of organizations are not resilience-ready, including 63% in an exposed zone. The response should focus on measurable outcomes such as uptime, workforce productivity and customer trust, not simply the number of tools deployed.

Consolidate fragmented tools into integrated platforms

The report identifies tool sprawl as a source of redundant spending, limited visibility and fractured defenses. It says three in four enterprises are pursuing vendor and tool consolidation, compared with 29% in 2020.

Research cited from IBM associates unified platforms with incident detection 72 days faster, containment 84 days sooner, security teams that are 34% more efficient and annualized security-related platform costs that are 10% lower. Separate IBM research associates mature platformized security capabilities with a 43% higher five-year revenue growth rate and a greater likelihood of security investments benefiting revenue. These findings support evaluating integration as a business capability, rather than treating consolidation as a licensing exercise alone.

Use desktop as a service to strengthen the user edge

Desktop as a service, or DaaS, can move high-risk user groups into centrally managed, cloud-delivered environments. The report highlights geographically distributed call center contractors using older personal devices as a practical use case.

• Apply consistent patching and updates without depending on individual endpoint maintenance.
• Centralize policy enforcement to reduce compliance and data-handling risk.
• Support flexible access for contractors and remote employees while protecting business information.

Recognize AI’s access, scope and consumption risks

AI can accelerate both attacks and defense. The report identifies three management risks: excessive privileges, initiatives expanding beyond their approved purpose, and resource consumption that creates unexpected financial and sustainability costs.

Deloitte research cited in the report finds that 58% of organizations report employees using generative AI without restrictions, while only 20% express confidence in securing their generative AI models against cyber risks. Leaders need clear access boundaries, reassessment of expanding use cases and oversight of infrastructure consumption.

Deploy AI as an advisor and an apprentice

As an advisor, AI can summarize incidents, identify likely root causes, prioritize business impact and turn large volumes of alerts into actionable information. In IT support, it can categorize tickets, explain technical issues in business language and recommend next steps.

As an apprentice, AI can support repetitive, well-defined work such as patching, log analysis, monitoring and backup validation. The report cites IDC research associating AI-driven resilience tools with 20–30% faster restoration of critical systems after outages. Governed automation can reduce pressure on overstretched teams and free specialists for higher-value work.

The report also cites IBM’s 2025 breach research linking extensive security AI use to $1.9 million in savings per breach and breach lifecycles shortened by 80 days. Its broader lesson is to measure AI’s operational contribution alongside the risks of unsanctioned use, phishing and deepfake impersonation.

Build governance before scaling AI

The report presents Gartner’s AI TRiSM (Trust, Risk and Security Management) as a framework for transparency, accountability and continuous oversight. Both generative and agentic AI require governance that follows systems from approval into live operation.

• AI governance: establish cross-functional ownership, acceptable-use policies and an enterprise AI catalog.
• Runtime inspection and enforcement: monitor live use and enforce policies against harmful activity.
• Information governance: classify data, control access and manage its lifecycle.
• Infrastructure security: apply zero-trust protections to APIs, model weights and runtime environments.

Balance performance, resilience and agility

The leadership mandate has three connected priorities. Performance means removing duplicated tools, improving utilization and using automation without overlooking staff burnout. Resilience means protecting critical assets first, sharing accountability across departments and suppliers, and designing operations to adapt rather than fail catastrophically.

Agility means revisiting roadmaps as threats and regulations change, updating data governance and building flexibility into cloud strategies and vendor contracts. Together, these priorities help CIOs answer executive questions about readiness, AI exposure, safe cost reduction, compliance, and whether the right people and processes are in place.

Capture the resilience dividend without weakening controls

Cost reduction becomes a resilience dividend when organizations remove waste while improving their ability to withstand, recover and adapt. Indiscriminate cuts, deferred security investment and underused platforms can instead create hidden exposure.

The report points to the Australian Cyber Security Centre’s Essential Eight as practical controls connecting infrastructure management with risk reduction. It also cites Accenture research associating resilience embedded in operations with disruption costs up to 30% lower after an attack.

• Application control, application patching and user application hardening.
• Microsoft Office macro configuration and restricted administrative privileges.
• Operating system patching, multifactor authentication and regular backups.

Use independent advice to connect architecture with business value

Trusted advisors can simplify complex choices, assess platform versus point-solution trade-offs and translate technical requirements into an ROI-led business case. AVANT’s own market research, cited in the report, finds that 68% of companies rely on trusted advisors for the security component of cyber resilience.

The objective is not to promise that incidents will disappear. It is to choose an integrated, cost-conscious approach that helps the business keep operating when cyberattacks, insider threats or operational mistakes cause disruption.