Cyber Resilient Netherlands 2026 Study

Dutch organisations rate their cyber resilience at an average 7.1 out of 10, yet significant gaps remain in preparedness, governance and execution. This is shown by Cyber Resilient Netherlands 2026, a large-scale benchmark study by KPN and Security Innovation Stories.

While 67 percent of organisations say they feel prepared for a cyber incident, only 28 percent regularly practise crisis scenarios. In addition, one in three organisations lacks continuous, organisation-wide monitoring and detection, increasing the risk that incidents go unnoticed or escalate before action is taken.

From awareness to maturity

The research shows that cybersecurity has gained attention at board and executive level, but this is not always reflected in mature implementation. Only 16 percent of organisations have a security roadmap at board level, and just 23 percent report having supply chain security at a mature level. These blind spots are particularly concerning, as attacks increasingly exploit weak links in non-core systems and supplier networks.

Investment is rising, challenges remain

Security budgets are set to increase at 66 percent of organisations in 2026. Still, 38 percent of professionals believe current budgets are insufficient. According to the researchers, improving cyber resilience is not only about spending more, but about making clearer strategic choices, assigning ownership and regularly testing preparedness.

Priorities for 2026

Looking ahead, organisations identify compliance with new regulations (including NIS2, DORA and eIDAS), the secure use of AI, and human behaviour as key focus areas for the coming year. These priorities underline that cyber resilience is as much an organisational challenge as a technical one.

Cyber Resilient Netherlands 2026 is intended as a starting point for dialogue rather than a judgement. Based on input from more than 250 respondents and 19 in-depth interviews with IT and security professionals, the study highlights where organisations can take the next steps towards higher cyber maturity and long-term digital resilience.

Read the full report in Dutch here 

Photocredits: Sasiistock