Research

Almost everything published about how mid-sized companies handle technology risk comes from vendors surveying their own customers, which produces the finding the vendor needed. These surveys ask executives directly, publish the method next to the answers, and put the raw responses where anyone can check the arithmetic.

Surveys

• The 2026 CEO Technology and Cyber-Readiness Survey

  An annual survey of how executives actually decide technology and cyber questions. Fourteen questions, your own scored result, and the findings published open.

  14 questions · findings unpublished

  Method and status

What gets published

• Every figure with the number of responses behind it, so nothing has to be assumed about the denominator.
• Nothing at all below a minimum sample. A percentage from a handful of responses is not a finding, and a number published as research is the kind that gets repeated without checking.
• Any group too small to report withheld and listed, rather than rounded until it looks safe.
• The raw responses, as a CSV with labelled answers, so a disagreement about the conclusion can be settled against the data.
• The limits stated on the page: self-reported, self-selected, unweighted.

Why annual

A single year's answers describe a moment. The same questions asked again a year later describe a direction, which is the more useful thing and the harder thing to fake. So each year is its own instrument with its own URL, and the question wording is frozen once the first response arrives — a question edited mid-survey quietly makes the year incomparable with itself.