One eye-catching finding was that more than half of the groups polled do not regularly test their plans for handling attacks.

The “vast” majority of organisations surveyed recently are not prepared for respond to cyber-security threats, with no fewer than 77 per cent of them not having an incident response plan in place, a global report said.

The study, released by IBM Security and carried out by the Ponemon Institute, fires a warning shot across the bows of businesses such as wealth managers, which for obvious reasons are targets for cyber-crooks. 

A problem is a lack of staff skilled in dealing with cyber-security, the study found. In fact, only 30 per cent of respondents reported that staffing for cyber-security is sufficient to achieve a high level of cyber resilience. Furthermore, 75 per cent of respondents rate their difficulty in hiring and retaining skilled cyber-security personnel as moderately high to high.

Studies show that companies that respond quickly to contain a cyber-attack within 30 days save on average over $1 million on the total cost of a data breach.

In the European Union, sweeping new rules (General Data Protection Regulation, or GDPR) were enacted last year, threatening to punish firms which lost client data. Other jurisdictions are likely to be, or are, following suit.

The IBM Security report said that of the organisations surveyed that do have a plan in place, more than half (54 per cent), do not regularly test their plans, which can leave them less prepared to effectively manage the complex processes and coordination that must take place in the wake of an attack.

"Failing to plan is a plan to fail when it comes to responding to a cyber-security incident. These plans need to be stress tested regularly and need full support from the board to invest in the necessary people, processes and technologies to sustain such a program," Ted Julian, vice president of product management and co-founder, IBM Resilient, said. "When proper planning is paired with investments in automation, we see companies able to save millions of dollars during a breach."

The study measured how automation affects cyber-resilience. These technologies depend upon artificial intelligence, machine learning, analytics and orchestration.

When asked if their organisation used automation, only 23 per cent of respondents said they were significant users, whereas 77 per cent reported that their organisations only use automation moderately, insignificantly or not at all.