The end of the perfect-defence illusion
Modern cybersecurity has been built on a promise that was always too tidy for the systems it sought to protect. Build stronger perimeters, patch faster, collect more telemetry, automate more response, and the worst outcomes might be avoided. Those things still matter. But they do not alter a deeper reality: large digital systems fail in ways that are difficult to predict, impossible to model completely and often unrelated to the last attack pattern that dominated boardroom discussion.
This is not a counsel of despair. It is a demand for a more serious doctrine. Public institutions, hospitals, utilities, financial infrastructures and logistics networks now depend on software supply chains, cloud architectures and interconnected vendors whose complexity exceeds any single organisation’s direct control. In such an environment, cybersecurity cannot be judged only by how much is blocked. It must also be judged by how well essential services continue when something slips through, a dependency collapses or an internal control fails at the worst possible moment.
The central strategic shift is from protecting every system equally to preserving the functions society cannot afford to lose.
That shift is visible in policy. The National Institute of Standards and Technology’s Cybersecurity Framework 2.0 places governance and organisational outcomes at the centre of cyber risk management, not merely technical controls. The Cybersecurity and Infrastructure Security Agency has pushed a similar logic through its work on resilience, secure-by-design incentives and critical infrastructure preparedness. In Europe, the NIS2 Directive and the Digital Operational Resilience Act are signs that regulators increasingly care about continuity, recovery and accountability as much as perimeter defence.
Opinion pieces on cybersecurity often treat resilience as a fashionable synonym for robustness. It is more demanding than that. Robust systems resist disturbance; resilient systems absorb it, adapt around it and restore function without collapsing into paralysis. In a world of persistent intrusion, software monocultures and operational interdependence, that distinction matters.
Why resilience has moved to the centre
Three forces are pushing resilience from a secondary concern to the organising principle of security strategy. The first is interdependence. A single incident rarely stays local. Weakness in one supplier can disable hundreds of downstream organisations; a failure in identity infrastructure can ripple across entire enterprise estates; corruption of data can outlast the initial intrusion and poison recovery itself. The lesson of the past decade is not simply that attacks are more frequent. It is that digital failure propagates.
The second force is asymmetry. Defenders must protect sprawling estates under budgetary and political constraint. Attackers need only find one neglected interface, one poorly segmented environment or one trusted channel that no one thought to question. No serious strategist now believes that vigilance alone closes that gap. The sensible response is to reduce blast radius, simplify recovery and ensure that critical services degrade gracefully rather than catastrophically.
The third force is social expectation. Citizens do not experience cyber incidents as abstract compromises of confidentiality, integrity and availability. They experience cancelled appointments, delayed benefits, grounded transport, unavailable banking and silent emergency lines. What matters publicly is not the elegance of a security architecture but whether institutions can still perform their basic obligations under stress.
The World Economic Forum has repeatedly ranked cyber insecurity among the major systemic risks to economies and societies. Yet even that language understates the issue. Cyber incidents are not a separate class of disturbance sitting neatly beside geopolitical tension, climate stress and supply disruption. Increasingly, they are the medium through which those other crises are amplified.
Resilience is not the opposite of prevention
A common mistake is to hear the case for resilience as an argument against prevention. It is not. Prevention remains cheaper than recovery; strong identity controls, secure configuration, network segmentation, multifactor authentication and disciplined patch management still reduce risk materially. The problem is that prevention on its own encourages a brittle conception of success. If leadership assumes that enough controls will eliminate severe disruption, then continuity planning becomes performative and recovery capabilities atrophy.
The central strategic shift is from protecting every system equally to preserving the functions society cannot afford to lose.
A better frame is layered failure management. Good security lowers the likelihood of compromise. Good resilience lowers the consequence of compromise. The two reinforce each other when designed together. Asset inventories improve both patching and restoration. Segmentation constrains lateral movement and makes recovery more manageable. Tested backups support ransomware response, but they also expose where data governance is weak, where dependencies are opaque and where leadership has mistaken policy documents for operational readiness.
Seen this way, resilience is not what happens after security fails. It is part of security’s architecture from the start. The Centre for Internet Security, the UK’s National Cyber Security Centre and the US Cybersecurity and Infrastructure Security Agency all stress practical controls that amount to this same principle: know what matters, minimise unnecessary trust, prepare for compromise and rehearse recovery in realistic conditions.
The problem with compliance-driven comfort
Many organisations remain trapped in a comforting but increasingly dangerous pattern: they treat cyber preparedness as evidence collection for auditors rather than as a capability for surviving disruption. Compliance has value. It can raise baseline standards, clarify accountability and force boards to discuss risks they would otherwise neglect. But checkbox thinking tends to optimise for what can be evidenced easily, not for what must work under pressure.
The distinction is crucial. A policy stating that backups exist is not the same as proving they can be restored at scale when identity services are degraded. A business continuity plan filed in a repository is not the same as demonstrating that executives can prioritise essential functions amid incomplete information and public scrutiny. An incident response retainer is not the same as having internal teams who understand manual workarounds, supplier dependencies and regulatory notification duties in a fast-moving crisis.
Too many organisations can prove they are compliant; too few can prove they are recoverable.
This is where operational resilience becomes a useful discipline rather than a slogan. The Bank of England, the UK Prudential Regulation Authority and the Financial Conduct Authority have pushed firms to identify important business services, set impact tolerances and test their ability to remain within them. That approach deserves wider attention beyond finance. It begins with service outcomes, not technology stacks. It asks what must continue, for whom and for how long, before asking which controls support that objective.
Such a shift also changes the board conversation. Instead of asking whether the organisation has “adequate cyber”, directors should ask which services are intolerable to lose, what single points of failure threaten them and how quickly the institution can reconstitute them if digital trust breaks down. Those are harder questions. They are also the only ones likely to matter in the first 48 hours of a major incident.
Critical infrastructure needs functional thinking
The stakes are highest in critical infrastructure, where cyber failure can cascade from digital inconvenience to physical disruption. Yet the sectoral discussion often remains too technical, too asset-centric or too narrowly focused on nation-state threat reporting. What matters strategically is function: power distribution, water treatment, clinical care, payment settlement, food logistics, telecoms continuity. Systems should be organised around preserving those functions under duress.
This implies a more granular understanding of dependencies. Which operational technologies rely on shared corporate identity systems? Which remote management tools create concentrated risk? Which vendors have privileged access? Which manual overrides still exist, and are staff actually trained to use them? In many sectors, those questions reveal an uncomfortable truth: modern efficiency programmes have quietly removed the buffers that once made continuity possible.
The International Monetary Fund has warned that cyber incidents can become a threat to financial stability as digitisation deepens. The same logic applies elsewhere. Efficiency gains achieved through centralisation, standardisation and just-in-time operations can produce hidden fragility. A network can be cheaper, faster and more integrated, yet far less capable of operating in degraded mode when a key digital dependency fails.
Resilience therefore requires a modest rehabilitation of redundancy, diversity and fallback procedures. These are not glamorous investments. They can look inefficient on quarterly spreadsheets. But for essential services, the question is not whether spare capacity is elegant. It is whether society is willing to discover the price of optimisation only after a systemic outage.
The boardroom must learn to think in services, not systems
Too many organisations can prove they are compliant; too few can prove they are recoverable.
Executives often receive cyber reporting that is either too technical to guide decisions or too abstract to test preparedness. Dashboards full of vulnerabilities, phishing rates and mean time to detect can create the impression of rigour while obscuring the issue that matters most: what happens to the organisation’s essential services if controls fail in combinations no one planned for?
Boards need a service-based view of risk. Which business services are most critical? What digital and third-party components underpin them? What is the maximum tolerable disruption for each? How many recovery paths exist if the primary route is unavailable? Which assumptions underpin restoration, and have they been tested under realistic conditions such as compromised administrators, unavailable suppliers or corrupted data?
This approach improves incentives. Technical teams are no longer rewarded solely for preventing incidents, a metric partly hostage to attacker behaviour. They are also rewarded for shortening recovery time, improving observability, rehearsing degraded operations and reducing concentration risk. Security leaders become translators of organisational survival, not custodians of a specialised compliance function.
In the next phase of cyber governance, the strongest institutions will be those that can operate in degraded mode without losing public legitimacy.
Public legitimacy is the overlooked variable. When a hospital or local authority is disrupted, people judge not just the breach but the steadiness of the response. Clear communications, predefined prioritisation and visible continuity measures can preserve trust even amid serious technical failure. Confusion, denial and improvisation erode it quickly.
Exercises should test decision-making, not theatre
Most organisations now run cyber exercises. Many are still too polite to be useful. They validate communications trees, walk participants through familiar playbooks and end before difficult trade-offs emerge. Real incidents are murkier. Logs are incomplete. Legal advice conflicts with operational instinct. Vendors are themselves impaired. Executives face pressure to restore quickly even when restoration paths may reintroduce compromise.
Exercises worth the time should test those tensions. They should begin with business services, not technical artefacts. They should include loss of visibility, failed assumptions, media pressure, regulatory deadlines and degraded third parties. They should force leaders to prioritise among bad options: restore a critical service with partial assurance, delay restoration for deeper forensic confidence, or shift to a slower manual process with immediate service consequences.
There is growing official guidance in this direction. Agencies in Britain, the United States and Europe have all emphasised exercising, incident coordination and resilience planning. But the true value of simulation lies less in the scenario than in the institutional learning it produces. Which decisions were delayed because authority was unclear? Which dependencies surprised the room? Which manual workarounds were fictional? Which executives understood the operational consequences of taking systems offline?
Preparedness is not the possession of a plan. It is the reduction of surprise.
Third-party risk is now first-party risk
No credible resilience strategy can stop at the enterprise boundary. Outsourcing, software dependence and managed service relationships have dissolved that boundary in practice. A supplier outage, compromise or integrity failure can become an immediate operational crisis for customers who have little direct visibility into what went wrong and even less leverage during the first critical hours.
Traditional third-party risk management has tended to emphasise due diligence questionnaires, contractual clauses and annual reviews. These are necessary but plainly insufficient. What matters in a crisis is whether an organisation knows which suppliers underpin which critical services, whether alternatives exist, whether privileged connections are constrained, and whether the organisation can continue operating if a key provider becomes unavailable without warning.
In the next phase of cyber governance, the strongest institutions will be those that can operate in degraded mode without losing public legitimacy.
This does not mean every institution must bring every capability in-house. That would be unrealistic and often counterproductive. It means dependencies should be treated as design variables rather than as procurement afterthoughts. Diverse suppliers, portable data, segmented access, tested exit pathways and clear communication channels matter more than glossy assurance statements. The question is not whether a vendor can be trusted in peacetime. It is how quickly an institution can adapt when that trust is shaken.
Public policy is beginning to reward resilience
Regulators are moving, if unevenly, towards a more resilience-centred stance. In the European Union, NIS2 broadens obligations around risk management and incident reporting for essential and important entities. The Digital Operational Resilience Act goes further in financial services by focusing on ICT risk management, testing and third-party oversight. In the United States, the evolution of federal cyber guidance increasingly ties security to governance, software assurance and infrastructure resilience.
These developments are imperfect. Reporting burdens can overwhelm smaller operators; prescriptive requirements can ossify practice; and legal mandates cannot compensate for weak leadership. Yet the direction is sound. Governments are recognising that in digitised societies, the failure of basic services is not merely a private misfortune for affected firms. It is a public resilience issue.
That recognition should encourage policymakers to think beyond minimum standards. Incentives matter. Procurement rules can reward recoverability and secure design. Sector exercises can improve coordination. Transparency requirements can sharpen executive accountability. And public investment in cyber workforce development, infrastructure modernisation and emergency response capacity can strengthen the wider ecosystem in ways no single organisation can achieve alone.
What a resilient institution actually looks like
Resilience can sound abstract until one specifies its visible traits. A resilient institution knows its essential services and the dependencies behind them. It has current asset inventories and clear ownership for recovery priorities. Its identities are tightly governed, privileged access is constrained and segmentation reflects operational reality rather than network diagrams drawn for auditors. It has offline or otherwise protected backups, and it has proved restoration under adverse conditions.
More importantly, it can operate in degraded mode. Staff understand manual or alternative procedures for the most critical tasks. Leadership has agreed in advance what must be restored first and what can wait. Communications plans are plain, fast and honest. Supplier relationships include escalation routes that function in crisis. Post-incident reviews are candid and lead to structural changes rather than ritual lessons logged and forgotten.
None of this guarantees safety. Resilience is not invulnerability. It is the capacity to limit strategic surprise and social harm when the unexpected happens anyway. That may sound less heroic than promises of total protection. It is also more credible.
From cyber maturity to civic durability
The next stage of cybersecurity will be less about perfecting a technical discipline in isolation and more about integrating it into the durability of institutions. That is especially true where digital systems mediate essential public functions. Hospitals, schools, councils, utilities and banks do not need cyber programmes that merely look mature in annual reports. They need operating models that preserve continuity when software, identity, connectivity or suppliers fail abruptly.
This requires a cultural change as much as a technical one. Leaders must accept that incidents are not aberrations from an otherwise stable baseline but features of a contested, interdependent digital environment. Security teams must be empowered to shape architecture, procurement and service design, not just react to inherited complexity. Regulators must continue shifting from paper compliance towards demonstrable recoverability. And boards must learn that resilience is a strategic asset, not an admission of weakness.
There is a larger democratic point here. In a deeply digitised society, resilience is part of state capacity and civic trust. Citizens may forgive disruption more readily than opacity, drift or visible unreadiness. Institutions that can continue operating, communicate honestly and recover with discipline do more than protect themselves. They help stabilise the public realm.
Cybersecurity, then, should be judged not only by the sophistication of defences but by the steadiness of essential services when certainty disappears. That is a sterner standard. It is also the one the coming decade will impose.
