Abstract The study investigates the effect of cyber resilience on cyber incidents outcomes. Though this relationship is intuitive, there is a lack of empirical evidence indicating that higher levels of organizational cyber resilience mitigate cyber incidents. We address this lack of evidence by collecting and analysing organizational data from 110 cyber practitioners using logistic regression, Kruskal–Wallis and Mann–Whitney tests. Our findings indicate that nonattacked organizations have higher levels of cyber resilience. More precisely, they have higher levels of prevention, education, strategy and planning, and accountability for cyber resilience. However, our findings do not support that a higher level of cyber resilience leads to a lower level of postincident outcomes. This study has implications for researchers by illustrating how cyber resilience may relate to cyber incidents—an area that can be further explored in future cyber resilience research.