Fusion Risk Management just published five years of market data, and buried inside it is an admission you rarely hear from a software company: the tools are not the constraint. Adoption is.
The Enterprise Resilience Report draws on 4,571 intake conversations with 1,765 organizations evaluating resilience software between 2021 and 2025. It is vendor data from a self-selected sample of active software buyers, so read it with that in mind. But five years of structured conversations is a real signal, and the signal is uncomfortable: the resilience maturity gap is widening, and buying a platform has not closed it.
What the Data Shows
Three findings stand out.
Buyer priorities flipped. From 2021 to 2023, organizations wanted consolidation and integration. Too many systems, too many silos, not enough visibility. In 2024 and 2025, automation and efficiency took over as the top priority. Organizations connected everything and are now asking whether the investment delivers real value.
Visibility and compliance never improved. Across all five years, organizations reported the same limited visibility across operations and the same difficulty proving compliance with confidence. No sustained improvement. Not in 2021, when the platforms were less capable. Not in 2025, when they were far more capable.
Manual tools persist. In 2021, 70 percent of North American conversations cited spreadsheets, shared drives, and static documents as part of the problem. That number improved for three years, then started climbing again in 2025.
Fusion’s own conclusion, in their own words: “Technology availability has outpaced cultural adoption.”
Read that sentence again. A software company with every incentive to tell you to buy more software is telling you the software already exists and organizations cannot absorb it.
Why the Resilience Maturity Gap Keeps Widening
The prevailing view in our field is that maturity is something you purchase. Pick the right platform, migrate the plans, integrate the data feeds, and the program matures on the vendor’s roadmap.
Five years of the vendor’s own data says otherwise.
The organizations stuck at the bottom of the maturity curve did not fail to buy technology. Many of them own capable platforms. They stalled on the unglamorous work that makes technology matter. Nobody owns resilience end to end, so the platform becomes another silo. The BIA data feeding the system went stale eighteen months ago, so every automated output inherits the staleness. Escalation paths exist in the tool but have never been exercised, so nobody trusts them under pressure. Executives receive dashboards instead of decisions.
| Old view | New view |
| Buying the platform is the milestone | Adoption is the milestone |
| Maturity is a feature set | Maturity is how the organization behaves under pressure |
| Compliance is proven at audit time | Evidence comes from how you actually operate |
| The plan documents the program | The exercised capability is the program |
A platform can hold your dependency maps, sequence your recovery, and produce evidence on demand. It cannot decide who owns the program, force two functions to plan together, or give your executives the muscle memory to make a hard call at 2 a.m. Those come from governance, exercising, and leadership. That is the gap, and it is widening precisely because the technology keeps improving while the organizational work stands still.
The Quiet Finding That Should Worry You
One trend line in the report points down: concern about incident response and reporting declined steadily from 2021 to 2025. Fusion frames it generously. Playbooks are standardized, tools are in place, and teams feel confident handling the disruptions they have already experienced.
That last clause is the problem. Confident against the disruptions they have already experienced.
The next five years will not replay the last five. AI-accelerated vulnerability discovery, SaaS concentration risk, and cascading third-party failures do not fit playbooks written for the incidents of 2021 through 2025. Declining concern can signal maturity. It can also signal a field that has stopped imagining unfamiliar failure.
In the tabletop exercises we run, the scenarios that break teams are never the ones in the plan.
What to Do With This
Three moves. None requires a new platform.
Audit adoption, not features. Ask who actually uses the tools you already own. Is the BIA data current? Are recovery procedures structured so a responder can act on them at 2 a.m., or are they narrative documents someone has to interpret in the middle of an incident? If your platform is a filing cabinet with a login, you own a documentation tool, not a capability.
Give the program one owner with real authority. Visibility stayed flat for five years because fragmentation is structural. It builds one tool and one regulatory response at a time, and no department volunteers to fix it. A formal program does not equal operational integration. Someone has to own resilience across business continuity, disaster recovery, and crisis management, with the standing to make integration happen.
Exercise a scenario that is not in your plan. In the next 90 days, run a tabletop exercise built around a disruption your team has never faced: an AI-driven vulnerability storm, a simultaneous outage across two critical SaaS vendors, a third party failing during your peak season. The goal is not to validate the playbook. The goal is to find out what your team does when the playbook does not apply.
The tools exist. The vendors will keep making them better. The maturity gap lives in the space between buying capability and building it, and no license fee closes that distance.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
- Run the exercise your plan can’t answer. Exercise in a Day builds and delivers a full tabletop in a single day, including scenarios your team has never faced.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
Executive Buy-In for Business Continuity: Being Liked Is Not the Same as Being Believed