Preventative incident response planning confirmed as key cyber security control – Marsh

While much of the focus around cyber security incidents is given to post-breach activities, preventative incident response planning should be an equally important and valuable part of firms’ cyber security controls.

This is according to a new report from Marsh McLennan’s cyber risk intelligence centre (CRIC), published on 27 August 2025, which found that firms that regularly engage in tabletop exercises and scenario-based breach response drills are 13% less likely to experience a material cyber event than firms that do not.

Endpoint detection and response (EDR) and multifactor authentication (MFA) remained important technical controls in mitigating serious cyber events, Marsh added, as are logging and monitoring, cyber awareness training, patching and vulnerability management.

The report further highlighted that as firms more consistently implement cyber security controls – some nine of the 10 most important control measures, like the aforementioned ones, are implemented by more than 80% of firms – greater focus needs to be placed on the quality of their deployment.

Training and awareness

Regular training and awareness campaigns, the report concluded, are vital to ensuring technical security measures work in the most effective manner.

Tom Reagan, global cyber practice leader at Marsh, said: “Marsh has long advocated proactive cyber incident response planning as a tool to help organisations effectively and efficiently respond to and recover from a cyber attack.

“What our latest research confirms is that thoughtful planning also drives secondary benefits, like positive security behaviours and strong control implementations, which help build more organisational resilience and reduce breach incidents.”

Scott Stransky, managing director and head of Marsh McLennan’s CRIC, added: “Our findings emphasise that simply deploying key cyber security controls is no longer enough – these tools must be properly managed and comprehensively used.”