19% of CISOs are concerned about their organisation's ability to handle a cyber crisis because of a lack of realistic, stress-tested crisis simulations.