The 78/17 Gap: Why Most Companies Underprepare for Digital Risk

78% of executives. 17% of companies. A 61-point gap.

According to Resolver's 2024 Reputational Risk Report, 78% of executives acknowledge that responding to digital risks too late will harm their brand's reputation. Only 17% of companies maintain an active risk management plan. The gap between those two numbers is not a survey artefact. It is the operational shape of how digital risk is currently mismanaged at the executive level — across geographies, sectors, and company sizes.

This article does three things. It states the gap precisely. It explains the four structural reasons the gap exists. And it sets out what closes it — not as a marketing claim, but as the operational difference between knowing a problem exists and knowing where, specifically, the company is exposed.

What the numbers actually say

The two numbers measure different layers of the same organization.

• 78% — executive awareness. The board-and-C-suite level recognition that late response to digital risk is harmful. This is the easiest layer to capture in a survey because the answer is intuitive once the question is asked.
• 17% — operational plan. The actual existence inside the company of an active, maintained, named risk management plan. Not a slide. Not an intent. A plan with owners, cadence, scope, and review process.

The 61-point gap is not the difference between fast companies and slow ones. It is the difference between companies that know digital risk matters and companies that have translated that knowledge into operational structure. The translation is where most companies stop.

Four structural reasons the gap exists

The gap is not explained by lack of resources or low priority. Companies with significant budgets and explicit board attention to reputation still land on the 17% side. The reasons are structural.

1. Reputation lacks a designated owner

Financial risk is owned by the CFO. Cyber risk is owned by the CISO. Compliance risk is owned by Legal. Operational risk is owned by the Chief Operating Officer or operational leadership. Reputation risk is owned, in most companies, by no one — or by everyone, which is functionally the same thing.

Without a designated owner, no one is accountable for a plan, no one is accountable for measurement, and no one is accountable for closing the gap. Awareness is everyone's problem. Action requires a name on the org chart.

2. The category lacks measurable structure

A CFO can walk into a board meeting with a quarterly P&L. A CISO can present CVE counts and remediation timelines. A General Counsel can map active matters and exposures. Reputation has, in most companies, no equivalent. Sentiment dashboards produce mood scores. Mention trackers produce volume. Neither answers the question a board actually asks: where, structurally, are we exposed?

Without measurable structure — named zones, traceable factors, severity-tagged findings — reputation cannot be governed in the same way other risks are governed. It can only be discussed. Awareness without measurable structure is a stalled state by design.

3. Existing tooling answers a different question

A decade of marketing technology has built tools for monitoring brand mentions, tracking sentiment, and routing customer service responses. These tools are useful for the questions they were built for. They were not built for risk governance.

When companies attempt to use sentiment-stream tooling as their reputation risk function, they end up with quarterly reports of green and red arrows — useful for marketing, useless for governance. The 17% figure includes companies that have purchased sophisticated monitoring tools and still do not have a reputation risk plan, because monitoring is not a plan.

4. The risk is structural, but most responses are reactive

Reputation risk in 2026 lives in the structure of the public information environment around a company — what dominates search results, how AI systems describe the business, how trust signals distribute across review platforms, how external parties shape narrative. This is a structural surface that accumulates exposure whether the company acts or not.

Most existing responses are reactive: a crisis communications plan that activates when something goes wrong, a media monitoring service that flags negative coverage, a PR retainer that handles incidents. Reactive responses do not close awareness-to-action gaps. They convert awareness into capacity to respond once damage is already happening — which is, in operational terms, still the 17% side.

What closes the gap

The 17% figure is not a moral failure. It is a structural one — and structural problems require structural answers. Three operational shifts move a company across the gap.

Shift 1 — Assign the owner

Reputation risk needs a named function inside the organization, with a defined scope, cadence, and reporting line. The exact role varies by company size and structure: in some organizations it sits with the Chief Communications Officer; in others with the Chief Risk Officer; in pre-IPO contexts it often sits temporarily with the CFO or with a board-level subcommittee. The specific assignment matters less than the existence of a single accountable owner.

Shift 2 — Adopt a measurable methodology

Awareness becomes governance when reputation risk decomposes into named factors that can be measured, tracked, and reported on. The Risk Constellation methodology, developed by Reputation House, defines four interconnected zones — Narrative Hijackability, SERP Control, AI Distortion, and Trust Volatility — each producing a measurable layer of exposure. The output is a Composite Risk Score with traceable factor weights and a structured list of severity-tagged Issues Detected. Boards can govern with this format. They cannot govern with sentiment scores.

Shift 3 — Run the diagnostic before the crisis

The 17% figure is, in part, a definitional artefact: many companies treat their crisis communications plan as their reputation risk plan. The two are not the same. A diagnostic run before any crisis — when the company can see its current digital risk surface across four zones, by named issues, at a stable moment — is what produces the active management posture the 17% category actually describes.

What crossing the gap looks like in practice

Illustrative scenario, composite pattern from Risk Check diagnostics — not a specific company.

A B2B SaaS company with $60M ARR has been on the 78% side for two years. The board acknowledges digital risk in every quarterly meeting. There is no plan. The company has a media monitoring service, a quarterly sentiment report, and a PR retainer for crises. By the survey definition, the company is part of the 83% without an active plan.

The company runs a Risk Constellation diagnostic. Composite Risk Score 67. Two zones — SERP Control and AI Distortion — at High severity. Eleven Issues Detected, each with named source signals and severity tags. The board now has a structured assessment with a measurable starting point.

Three weeks later: the Chief Communications Officer is named as the operational owner of reputation risk. A quarterly review cadence is set against the Composite Risk Score and the Issues Detected. Remediation work focuses on the four highest-severity issues across the two High zones.

The company is now part of the 17%. The change is not budget. It is not headcount. It is structure: an owner, a methodology, a diagnostic that produced a starting point. The 78-to-17 distance closed in three weeks once the structural pieces were in place.

Where to start

Risk Check by Reputation House is the diagnostic implementation of the Risk Constellation methodology. It runs the four-zone analysis in minutes and produces the three artefacts that distinguish the 17% from the 83%: a Composite Risk Score with named factor weights, a structured list of severity-tagged Issues Detected by zone, and a separate Hijackability score for narrative drift.

It is a one-time diagnostic, not a continuous monitoring tool — and that is deliberate. The first task is not to monitor more. It is to make the current digital risk surface visible enough that a real plan can be built around it.

Run a free Risk Check at checkmyrisks.com — three scans per account, results in minutes, no setup.

FAQ

What is the 78/17 gap in reputation risk?

The 78/17 gap is the difference between executive awareness of digital reputation risk and operational preparedness for it. According to Resolver's 2024 Reputational Risk Report, 78% of executives acknowledge that responding to digital risks too late will harm their brand's reputation, while only 17% of companies maintain an active risk management plan. The 61-point gap is the operational shape of how digital risk is currently mismanaged at the executive level.

Why do most companies underprepare for digital reputation risk?

Four structural reasons. Reputation lacks a designated owner inside most companies — unlike financial, cyber, or legal risk. The category lacks measurable structure that boards can govern with. Existing sentiment-driven tooling answers a different question than risk governance requires. Most responses are reactive (crisis communications, media monitoring) rather than structural (a measurable surface assessed before any crisis).

Are other research reports finding similar gaps?

Yes. Willis Towers Watson's Global Reputational Risk Readiness Survey 2024/25 reports that 82% of organizations rank reputation among their top 3–5 risks, but only 30% have strong capabilities to model the financial impact of reputational damage (up from 11% in the prior survey). Aon's Global Risk Management Survey shows a parallel pattern in people risk: 78% awareness against approximately 11% quantification. The structural shape of the gap — high awareness, low operational preparedness — is consistent across multiple independent sources.

What does an "active risk management plan" actually mean?

In the 17% sense, an active plan is not a slide deck or an aspirational policy. It has four operational properties: a named owner inside the organization, a measurable methodology with traceable factors, a regular review cadence, and a diagnostic baseline that the plan tracks against over time. A crisis communications plan, a PR retainer, or a media monitoring subscription are useful but do not, individually or in combination, meet this definition.

How do companies move from the 78% to the 17%?

Three operational shifts. Assign a named owner for reputation risk inside the organization. Adopt a measurable methodology — the Risk Constellation methodology, developed by Reputation House, defines four zones with traceable factor weights and a structured Issues Detected output. Run the diagnostic before any crisis, so that the active management posture is built on a measurable starting point rather than on reactive capacity. The change is structural, not budgetary — many companies cross the gap in weeks once the structural pieces are in place.