Qnap’s Global Enterprise Cyber Resilience Report 2026 shows that half of the 1,838 organisations surveyed are at high risk or still developing their resilience. Many companies still see backup as an end point rather than as part of resilience.
Qnap, a supplier of storage, networking and data protection solutions, has published the Global Enterprise Cyber Resilience Report 2026. The report is based on self-assessments by 1,838 organisations from 93 countries. Of these, 922 fall into the Developing or High Risk maturity levels. The survey assessed eleven controls across four domains: data protection and backup, identity and access control, threat monitoring and active defence, and business continuity and recovery.
Backups remain vulnerable
According to the report, 83 percent of organisations keep offsite backups. Almost half of them (49%, or 896 organisations) leave those copies permanently online, with no protection against modification or deletion. If administrator credentials are compromised, attackers can delete, alter or encrypt those backups. A backup therefore does not guarantee a safe recovery.
Identity and internal networks
Identity also remains a weak point. 24 percent of companies protect their core storage with only a username and password. Internal networks also remain a blind spot. 29 percent of organisations have no internal threat detection, and only thirteen percent have rolled out enterprise-wide detection. That is the lowest score of all eleven controls. Undetected intruders can move laterally before they steal or encrypt critical data.
Jack Liou, CEO of Qnap, says most organisations are aware of the risks, but that many investments do not match the way attackers operate. In his view, three things determine whether an organisation survives an attack: protected backups, proactive interception of internal threats and a fast recovery of core activities.
Three measures
Qnap advises organisations to assess their maturity and to prioritise one to three high-impact measures. For backup, the company suggests automating offsite backups with HBS 3 and isolating copies with Airgap+. WORM immutable storage in QuTS hero should prevent backups from being erased or modified, even by attackers with administrator rights.
For identity, Qnap recommends multifactor authentication (MFA) and role-based access control (RBAC). For monitoring, the company offers ADRA NDR X. This agentless solution detects lateral movement, lures out hidden threats with Threat Trap technology and automatically isolates compromised devices. According to Qnap, those blind spots are invisible to traditional endpoint detection and response (EDR).
For business continuity, Qnap points to its High Availability architecture. It should cut Recovery Time Objectives from days or hours to a virtually seamless failover.