Sophos today released findings from a global, vendor-agnostic study (based on responses from 5,000 organisations across 17 countries), examining one of cybersecurity’s most urgent and overlooked necessities: trust. The Cybersecurity Trust Reality 2026 report is one of the most comprehensive studies of trust in cybersecurity and the impact on operational risk and board-level decision making. It reveals a critical challenge facing CISOs: Trust in cybersecurity vendors is fragile, difficult to measure, and increasingly shaping risk posture at both operational and board levels. At a time of relentless cyber threats, heightened regulatory scrutiny, and accelerating AI adoption, trust has become a defining factor in cybersecurity decision-making. Yet new research reveals that nearly all organisations report lacking full confidence in their cybersecurity vendors, and many struggle to assess vendor trustworthiness in the first place. The independent study found that: – 95% of respondents said they do not have full trust in their cybersecurity vendors – 79% struggle to assess the trustworthiness of new cybersecurity partners, and over six in ten (62%) even find it challenging for their existing vendors – More than half (51%) report increased anxiety about the likelihood of a significant cyber incident as a direct result of lack of trust These findings underscore a critical reality: cybersecurity effectiveness cannot be measured by technological performance alone, but also by the confidence that organisations have in the partners defending their business. For CISOs, trust gaps create operational friction, slower decision-making, and higher vendor turnover. Trusted cybersecurity partners reduce risk and build more resilient organisations. “Trust is not an abstract concept in cybersecurity, it’s a measurable risk factor,” said Ross McKerchar, CISO at Sophos. “When organisations can’t independently verify a vendor’s security maturity, transparency, and incident handling practices, that uncertainty flows directly into boardrooms and security strategies.” The survey identifies verifiable security