The Illusion Of The Industry Standard: Cyber Resilience Across Sectors
Sivan Tehila is the CEO and Founder of Onyxia Cyber and Cybersecurity Masters Program Director at the YU Katz School of Science and Health.
gettyFor years, “industry standard” has done a great deal of quiet work in cybersecurity. In boardrooms and vendor briefings alike, it has become shorthand for “safe enough,” a way to settle a hard question by pointing to what everyone else appears to be doing. But when we surveyed 300 CISOs across financial services, healthcare and pharma, critical infrastructure, IT and technology, and retail and e-commerce for our latest research report, the data told a different story. There is no single bar. What one sector treats as an unacceptable exposure, another absorbs as the cost of doing business, and most security leaders have little visibility into where they actually sit within that range.
Consider one of the most fundamental tasks in security: patching a critical vulnerability. In IT and technology, 69% of leaders prioritize closing that window within three days. In critical infrastructure, the sector behind our power, water and transportation systems, only 31% do. The threat is identical, and the clock is the same, yet fewer than half keep pace.
This is not an outlier. It is the pattern that runs through nearly every metric we measured. Not a single CISO in healthcare or critical infrastructure reports that their sector demands 100% MFA coverage—compared to 35% in financial services who do. The average acceptable phishing simulation reporting rate stands at over 78% in IT and technology but falls to 59.9% in critical infrastructure.
Yet even the strongest performers carry hidden costs: Financial services sets the pace on speed and hygiene, yet posts the worst security-operations signal-to-noise of any sector, with false-positive rates above 13% that bury its analysts in alerts. There is no single industry standard. There are industry divides.
These divides matter more than they used to because attackers do not organize themselves by industry. The same commodity techniques, such as credential stuffing against accounts without MFA, lateral movement through unmanaged devices or a single unpatched flaw, translate across every vertical.
When an entire sector agrees that a given level of exposure is acceptable, it is, in effect, agreeing on where the easiest entry points will be. And as the attack surface undergoes a massive, AI-driven expansion, that agreement grows more dangerous: Automated reconnaissance and exploit tooling let adversaries find the slowest sector and the open window faster, and at lower cost, than ever before. Because our infrastructure is interconnected through shared vendors and supply chains, one industry’s definition of “acceptable” rarely stays contained to that industry.
The deeper problem is that most of these numbers are invisible to the people living inside them. “Acceptable risk” is rarely a decision anyone set out to make. More often, it is an inherited default, the level of exposure that came to feel normal because the organizations nearby appeared to tolerate it. No one formally signed off on running 4% noncompliant devices; the number simply accumulated. That is what makes these benchmarks so consequential. It is hard to defend a threshold no one ever consciously chose.
So what should security leaders do? Three things, in order.
“Industry standard” is only useful once you know which industry you are measuring against and whether its norms hold up next to a tougher bar elsewhere. Frequently, they do not.
A healthcare CISO who matches the healthcare average of 4.41% noncompliant devices is matching a number more than 50% higher than the 2.91% financial services holds itself to, on the exact same control. That gap needs to be explained at the business level, not inherited silently.
If an organization tolerates a percentage of accounts without multifactor authentication, or a degree of patch-SLA slippage, that figure should be one a leader chose deliberately and can defend, not a gap discovered after an incident. Naming the number is what converts a blind spot into a managed risk.
Resilience is not a snapshot assembled for an audit; it is a posture an organization holds under pressure. These divides persist in large part because too many teams see their own position only periodically, in fragments, well after the data has gone stale. It is difficult to challenge an inherited standard that you can only glimpse once a quarter. The leaders who close the gap will be those who replace occasional self-assessment with continuous, quantified and increasingly AI-driven insight into where they stand, the kind that surfaces a weakening control before an adversary does.
The most important finding in this year’s research is not any single statistic. It is that the reassurance of “industry standard” is largely an illusion, and an increasingly costly one. Having spent years as a CISO, I understand its appeal; a benchmark makes a hard call feel settled. But our responsibility was never to match the room.
By benchmarking against real risk, naming the exposure you are willing to accept and measuring it without interruption, you stop inheriting a standard and start setting one. This turns visibility into actionability and the kind of operational cyber resilience your organization actually depends on. The sooner we raise that bar together, across every sector, the harder we make the adversary’s work and the better we do our own.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
