Resilience has become one of the hottest business talking points of recent years, but according to the Business Resilience Index 2026, commissioned by Six Degrees, nearly three-quarters of organizations view resilience mainly through a security lens. Yet the reality is much broader and more nuanced. Cyber security is essential, but true resilience requires a holistic approach that considers how the organization maintains operations and responds to change.
To an extent, the fundamental challenge comes down to mindset. Beyond operational teams, there’s often limited awareness of resilience gaps and, even when activities exist, they may not support strategic decision-making. This can lead organizations to overestimate their maturity and preparedness, a dangerous assumption without clear benchmarking data.
The Business Resilience Index study, based on research with 600 senior UK IT and security leaders, found that most organizations sit in the middle of the maturity curve. They can respond to disruption but lack the consistency and foresight to move beyond reactive measures. Strength in one area can mask weaknesses in another, creating fragile points that only become apparent under pressure, and continuity is the pillar that appears to be the area most at risk.
The five stages of resilience maturity
Resilience is a spectrum, not a fixed state. Organizations generally operate across five stages of maturity:
- At Risk: highly vulnerable, with fragmented processes, limited planning, and mostly manual recovery.
- Reactive: able to respond to incidents but not anticipate them, leading to repeated disruptions.
- Stable: controls are in place, major failures are less likely, but resilience remains process-driven rather than fully embedded.
- Agile: organization can pivot rapidly; people, processes, and platforms are aligned to support responsiveness.
- Strategically Resilient: resilience is embedded across the business, aligned with leadership priorities, and supports both operational performance and decision-making.
Progression across the maturity curve depends on consistent application across five pillars: continuity, security, scalability, efficiency, and innovation:
Continuity: the most fragile pillar
The benchmark clearly identifies continuity as the weakest pillar across UK organizations. It is the foundation of business resilience, the capability to maintain operations during disruption, yet many businesses are not sustaining it effectively. The Business Resilience Index study reveals:
- Almost one in three organizations (28%) are At Risk, the highest risk of all five pillars.
- Fewer than one in ten (9%) reach Strategically Resilient, showing that few have embedded continuity into everyday operations.
This fragility leads to productivity drag, delayed revenue, and operational vulnerability, highlighting that continuity cannot simply be a disaster recovery plan on a shelf. It must be embedded, tested, and coordinated across all teams, not just IT.
Scalability
Scalability is a relative strength for many organizations. While 14% remain At Risk and another 18% are Reactive, a combined 54% fall into Agile (37%) and Strategically Resilient (17%) tiers, showing that the ability to scale operations reactively and proactively is improving.
Efficiency
Efficiency is an area of untapped potential. Only 7% reach Strategically Resilient, while 39% are Agile, showing that about half of businesses are actively streamlining operations and using digital tools to enable faster, smarter decision-making.
Innovation
Innovation reflects future readiness but is unevenly embedded. While 48% are Agile in innovation, only 2% are Strategically Resilient, suggesting experimentation exists, but embedding innovation into culture and governance is rare.
Security
Only 5% reach Strategically Resilient in security, while 8% remain At Risk. Most (51%) cluster in Agile, showing that security is taken seriously, but integration and agility remain limited.
Variants across sectors
Resilience does not look the same everywhere. Different sectors face different pressures, from regulatory scrutiny in financial services to operational intensity in retail and manufacturing, to the digital complexity of tech and the resource constraints of the public sector.
For example, financial services are among the strongest resilience profiles, with better governance, tighter processes, and stronger investment. Manufacturing, on the other hand, faces operational intensity, but resilience remains stuck in the middle, with twice the level of At Risk organizations overall (14% vs 7%) and fewer Agile firms (29% vs 38%) than the benchmark of all organizations.
The resilience playbook: turning resilience into a platform for growth
The research shows a consistent pattern: organizations that frame resilience primarily as security tend to stall. Those that treat resilience as a platform capability, a way to unlock growth and future-readiness, accelerate. The top performers in the dataset consistently do five things differently and these provide a practical roadmap for any organization looking to move up the maturity curve:
Design for opportunity, not just defence
Most dashboards today monitor threat and exposure. High-performing organizations go further: they sense emerging demand, leading indicators, and operational friction, using resilience not just to survive disruption but to identify opportunities for growth.
Treat continuity as everyday operating hygiene
The biggest gap in resilience is not tooling. Organizations that reach Strategically Resilient status rehearse continuity in flow, test live systems weekly using real-time data, and ensure responsibility is distributed across the business, not siloed in IT. Continuity is embedded as routine operating hygiene, not a plan on a shelf.
Build scalability into the design, not the budget
If scaling still requires approvals and tickets, tempo is already lost. High performers engineer elasticity into systems: autoscale, self-serve capabilities, and delegated change allow the organization to pivot and grow with minimal friction.
Use cost transparency to accelerate, not restrain
Efficiency isn’t about cost-cutting; it’s about clarity. Resilient organizations invest where they can see a direct impact on outcomes, using transparency in cost-to-value to accelerate decisions rather than constrain them.
Ring-fence innovation as future-readiness
Innovation loses when it has to fight for attention against business as usual every quarter. Leading organizations treat experimentation as a protected allocation, ensuring innovation is embedded into governance, culture, and daily decision-making, driving long-term agility and competitive advantage.
By following these five areas, organizations can transform resilience from a defensive safeguard into a strategic platform for growth. Combined with strong continuity, integrated security, scalable operations, efficient decision-making, and a culture of innovation, these practices move businesses from Reactive to Strategically Resilient, ready not just to survive disruption, but to thrive and grow in the face of it.
The author
Rhys Sharp, Solution Director, Six Degrees
