Onyxia Cyber has published its third annual CISO research report, ‘Industry Divides: Uncovering the CISO’s Resilience Priorities Across Sectors’. Based on a survey of 300 chief information security officers across financial services, healthcare, critical infrastructure, technology, and retail, the report identifies significant differences in the cyber security control and performance targets that sectors consider acceptable.
What one sector treats as an unacceptable control-performance threshold, another seems to accept as routine. Most security leaders have no reliable way to know where they stand.
Nowhere is this divide more apparent than in patch management, one of the most fundamental measures of cyber hygiene. Just 31.3% of critical infrastructure organizations target the resolution of critical vulnerabilities within three days, compared with 61.4% in financial services and 69.0% in technology.
“What this research makes clear is that acceptable risk isn’t universal – the variation across sectors is striking, and those discrepancies have real consequences,” said Sivan Tehila, founder and CEO of Onyxia Cyber. “Security leaders need cross-domain, context-aware data to benchmark their programmes continuously, not just against their own industry, but against the full picture of what good looks like elsewhere – that’s what proactive operational cyber resilience actually requires.”
Additional key findings include:
- Healthcare’s compounding exposure: healthcare organizations reported the highest phishing click-through rate, at 5.53%, nearly double the 3.13% reported by financial services organizations. Healthcare also reported the highest percentage of inactive privileged accounts, at 3.42%, representing a significant access risk.
- Financial services lead on selected cyber hygiene measures, but not everywhere: financial services organizations reported the lowest rate of unmanaged devices, at 1.76%, and the lowest percentage of inactive privileged accounts, at 1.05%, of any sector. Yet the sector with the strongest results on these two measures also reported the highest acceptable SOC false-positive rate, at 13.23%, compared with 7.23% in healthcare – approximately 83% higher – which may indicate that even mature programmes can normalise noise.
- Technology sets the highest human-layer expectations: IT and technology organizations reported the highest phishing-reporting expectation, with employees expected to report 78.8% of phishing emails, compared with 59.9% in critical infrastructure. The gap reflects different assumptions about workforce cyber security culture across sectors.
- Critical infrastructure’s identity blind spot: in critical infrastructure, zero CISOs reported that organizations in their industry demand 100% MFA coverage for user accounts. By contrast, 35% of financial services CISOs reported that this standard is expected in their sector. For a sector responsible for power grids, water systems, and transport networks, this survey result indicates a potentially significant identity-control weakness.
- Retail’s compliance gap: patching strength, identity exposure. Retail and e-commerce organizations patch 62% of critical vulnerabilities within three days. However, the same compliance framework has not closed the identity risk gap: retail’s MFA coverage gap of 3.72% is more than double the financial services benchmark, and its average phishing simulation reporting rate is 78.9%, the second-lowest rate in the survey.
The data point to a consistent theme: organizations can make their cyber resilience posture more explicit by setting measurable targets, benchmarking themselves against relevant peers, and treating acceptable risk levels as deliberate governance decisions rather than defaults.
