A new centre of gravity for cyber policy
For years, cybersecurity strategy was dominated by the language of prevention: harden the perimeter, patch vulnerabilities, detect intrusions early and keep adversaries out. That logic still matters. But the policy centre of gravity is changing. Governments, regulators and operators of essential services are increasingly confronting a more difficult reality: sophisticated attacks, software faults and supplier compromises will sometimes bypass even well-funded controls. The pressing question is what happens next.
The answer is cyber resilience. In practical terms, resilience means preserving critical operations during digital disruption and restoring them quickly when systems fail. That makes it broader than information security alone. It spans technical architecture, governance, procurement, crisis management, back-up arrangements and communications with the public. It also shifts attention from isolated incidents to systemic dependencies, especially where a single software provider, cloud platform or managed service can transmit disruption across many organisations at once.
Resilience begins where prevention reaches its limit: the issue is not only how to stop compromise, but how to keep essential functions running when compromise occurs.
This is not a rhetorical turn. It is visible in the way public institutions now frame cyber risk. International guidance is increasingly focused on continuity of operations, supply-chain assurance and recovery planning. The implication is stark: cybersecurity can no longer be treated as a specialist IT concern. It is becoming a core component of economic security and institutional reliability.
The numbers point to persistence, not exception
The wider threat environment remains unforgiving. The annual data collected by the FBI’s Internet Crime Complaint Center shows both the scale and persistence of cyber-enabled harm in the United States. Its 2023 report recorded hundreds of thousands of complaints and billions of dollars in reported losses, with ransomware, business email compromise and fraud continuing to impose large costs across sectors. Such datasets have well-known limits: they understate true losses, blend very different types of cyber crime and depend on voluntary reporting. Still, the direction is unambiguous. Cyber incidents are not rare shocks; they are a regular feature of the operating environment.
European evidence points in the same direction. The European Union Agency for Cybersecurity’s threat landscape assessments have consistently highlighted ransomware, attacks against availability, social engineering and software supply-chain compromise as durable patterns rather than episodic anomalies. That matters because repeated exposure changes what good governance looks like. When incidents are persistent, boards and public authorities cannot treat them as one-off exceptions to normal operations. They must plan as if some level of digital disruption is inevitable.
That planning challenge is intensified by asymmetry. Attackers need only find one exploitable pathway, while defenders must sustain patching, monitoring and access controls across sprawling estates of legacy systems, outsourced vendors and cloud services. In such an environment, absolute prevention is an unrealistic benchmark for judging performance. A more serious benchmark is whether essential services can continue under stress.
Critical infrastructure is the proving ground
Nowhere is this shift clearer than in critical infrastructure. Energy networks, hospitals, transport systems, water utilities and public administration all rely on interconnected digital systems, many of which were not originally designed for hostile environments. Their exposure is not just a matter of confidentiality or stolen data. It is a matter of physical and social continuity.
Guidance from the US National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency increasingly reflects this operational framing. NIST’s Cybersecurity Framework 2.0 places governance and continuous improvement alongside the traditional identify-protect-detect-respond-recover model, while CISA’s cross-sector guidance emphasises resilience planning, incident reporting and risk management for essential services. In Europe, the NIS2 Directive similarly expands cybersecurity obligations for essential and important entities, underlining governance, supply-chain risk and incident handling.
Resilience begins where prevention reaches its limit: the issue is not only how to stop compromise, but how to keep essential functions running when compromise occurs.
The practical meaning is significant. Operators are being pushed to identify which functions truly matter, what minimum digital capability is needed to sustain them, and how manual workarounds or degraded modes can be used if primary systems fail. That often exposes uncomfortable truths. Many organisations know their asset inventories imperfectly, depend on remote management tools they scarcely scrutinise, or lack tested procedures for operating without core software platforms. Resilience planning forces these dependencies into the open.
Software supply chains have become strategic risk
If the first decade of cyber policy focused on networks and endpoints, the current phase is preoccupied with software supply chains. Modern organisations rarely build or control the full stack on which they depend. They assemble services from code libraries, cloud-hosted applications, identity providers, remote administration tools and managed service firms. Efficiency improves; concentration risk grows.
Guidance from agencies such as CISA and NIST, alongside the Secure Software Development Framework, reflects a recognition that software assurance is no longer a narrow engineering matter. It is a strategic dependency question. A flaw in one widely deployed product, or a compromise at one supplier, can create simultaneous exposure across hospitals, local authorities, manufacturers and logistics firms. Recovery then becomes harder because many victims are contending with the same outage, the same patches and the same shortage of specialist support.
This is why procurement is moving closer to cybersecurity policy. Questions once seen as technical due diligence now have board-level significance: what visibility exists into third-party code and services; how quickly can a supplier issue fixes; how transparent is incident disclosure; what contractual leverage exists over recovery support; and what contingency arrangements exist if a supplier itself becomes unavailable?
Digital efficiency has created a paradox: the same standardised platforms that lower costs can also transmit failure at industrial scale.
The long-term consequence is a more explicit trade-off between convenience and resilience. Highly centralised digital estates may be cheaper to manage in normal times, yet more brittle under coordinated failure. That does not imply a retreat from shared platforms. It does imply that concentration risk should be analysed with the same seriousness as direct cyber threats.
Ransomware remains a resilience test more than a malware problem
Ransomware is often described as a criminal cyber threat, which it is. But from the standpoint of public policy and organisational continuity, it is better understood as a resilience stress test. The malware itself is only one component. The real damage comes from operational paralysis, loss of access to core systems, delayed service delivery and complex recovery efforts under public scrutiny.
Joint advisories from CISA, the FBI and international partners have repeatedly stressed basics such as multi-factor authentication, segmentation, offline backups and incident response planning. Those controls remain foundational. Yet the persistence of ransomware despite years of guidance suggests that the deeper challenge lies in execution across large and unevenly governed estates. Backups may exist but be untested. Segmentation may be partial. Incident playbooks may not reflect real interdependencies between IT, operational technology, legal teams and external suppliers.
The healthcare sector illustrates the stakes. Guidance from public agencies and analysis from international bodies have shown that cyber incidents can delay care, disrupt scheduling, impede diagnostics and affect patient safety even when no single device is directly sabotaged. In other words, resilience failures emerge through the breakdown of routine administrative and clinical coordination. This is why metrics centred solely on blocked malware or prevented phishing attempts can be misleading. What matters is whether the institution can continue delivering its core mission under degraded digital conditions.
The hidden vulnerability is governance
Digital efficiency has created a paradox: the same standardised platforms that lower costs can also transmit failure at industrial scale.
Technical weakness is only part of the resilience gap. A recurring problem is governance fragmentation. Cybersecurity teams may understand the threat, but finance teams control procurement, business units own operational processes, executives decide risk appetite and boards receive only high-level dashboards. In many organisations, no single forum integrates these perspectives into a coherent resilience strategy.
NIST’s emphasis on governance is therefore more than administrative housekeeping. It reflects the simple fact that resilience failures often stem from unresolved management choices: whether legacy systems can be retired, whether suppliers can be challenged, whether downtime tolerances are realistic and whether crisis exercises include senior decision-makers with budget authority. The same applies to public institutions, where fragmented responsibilities across departments can obscure who owns continuity planning for digital public services.
There is also a measurement problem. Prevention produces apparently tidy metrics: number of vulnerabilities patched, phishing rates reduced, alerts triaged. Resilience is harder to quantify because it concerns organisational behaviour under stress. Useful indicators might include tested recovery time for critical functions, dependency mapping coverage, percentage of key suppliers subject to assurance reviews, or the availability of offline and immutable backups. These are less familiar metrics, but arguably more relevant to real-world disruption.
The weakest point in many cyber systems is not the firewall but the institution: unclear authority, opaque dependencies and untested recovery assumptions.
Regulation is converging on preparedness and accountability
The regulatory direction of travel is becoming clearer across advanced economies. In the European Union, NIS2 broadens the range of sectors covered and raises expectations for governance, reporting and supply-chain risk management. The Digital Operational Resilience Act applies a similarly explicit resilience lens to the financial sector, including ICT risk management, testing and oversight of critical third-party providers. In the United Kingdom, the National Cyber Security Centre has continued to frame cyber security in terms of organisational outcomes and resilience, particularly for critical services and supply-chain risk.
These frameworks differ in scope and enforcement. But they share a common premise: cyber risk is no longer adequately addressed through voluntary technical best practice alone. Boards and senior officials are being asked to demonstrate oversight, not merely delegate the matter to specialists. Incident reporting obligations are also expanding, partly because systemic visibility is impossible if every organisation treats disruption as a private embarrassment.
That said, compliance should not be mistaken for preparedness. Regulatory frameworks can encourage minimum discipline, but they cannot substitute for hard organisational choices about architecture, staffing, supplier diversity and exercise regimes. If taken narrowly, compliance can even create a false sense of security. The more useful interpretation is that regulation is codifying a baseline from which real resilience work begins.
Cloud concentration sharpens the continuity question
One of the least comfortable issues in cyber resilience is concentration in digital infrastructure. Cloud adoption has brought significant gains in scalability, security tooling and operational efficiency. For many organisations, it has also improved baseline cyber hygiene compared with poorly managed on-premises estates. Yet concentration introduces a different class of risk: correlated failure.
The concern is not only a malicious cyber incident. It includes software bugs, identity outages, misconfigurations, regional disruptions and control-plane failures that can have wide downstream effects. Public authorities such as the Bank of England, alongside financial regulators internationally, have examined this issue through the lens of operational resilience and systemic dependency. The point is not that concentrated services are inherently unsafe. It is that resilience analysis must account for single points of failure created by market structure as well as by technical design.
For organisations, that means understanding which services are genuinely portable, which data can be restored independently, and which processes would fail if authentication, logging or management interfaces became unavailable. Multi-cloud strategies are often presented as a straightforward answer, but they can add complexity and new attack surfaces. The more realistic objective is not maximal diversification at any cost, but clear-eyed mapping of where concentration is acceptable and where fallback arrangements are indispensable.
The weakest point in many cyber systems is not the firewall but the institution: unclear authority, opaque dependencies and untested recovery assumptions.
Exercises and recovery drills are becoming strategic tools
If resilience is about continuity under pressure, then exercises matter as much as controls. Tabletop simulations, restoration drills and cross-functional incident rehearsals expose the assumptions that documents often conceal. They reveal whether executives understand escalation thresholds, whether communications teams can operate amid uncertainty, whether legal and operational priorities conflict, and whether external suppliers are actually reachable when systems are down.
Public guidance increasingly encourages this approach. NCSC, CISA and sector regulators have all underscored testing and exercising as core elements of preparedness. The logic is simple. Plans that have not been rehearsed are often plans in name only. Restoring from backups may be technically possible yet operationally unworkable if dependencies are unclear, credentials are inaccessible or staff are unfamiliar with manual fallback procedures.
The organisations that recover fastest are not always those with the largest security budgets. Often they are those that have identified their most critical functions, simplified dependency chains, rehearsed degraded operations and assigned clear authority for crisis decisions. In that sense, resilience is partly an exercise in organisational discipline. It rewards clarity over complexity.
Public trust now depends on digital continuity
There is a broader civic implication. As public services, finance, healthcare and logistics become more digital, citizens experience cyber incidents less as abstract security breaches and more as interruptions to daily life. Appointments are cancelled, payments delayed, records inaccessible, transport disrupted. The legitimacy cost can be considerable, especially when institutions appear surprised by dependencies that were long visible to specialists.
This changes the politics of cybersecurity. Public tolerance for disruption is shaped not only by the scale of an incident but by whether the affected institution appears prepared, candid and capable of recovery. Communication therefore becomes part of resilience. Authorities and operators need to explain what functions are affected, what workarounds exist and what timelines are realistic. Overconfident assurances tend to age badly during complex restoration efforts.
In this respect, cyber resilience overlaps with democratic resilience. Institutions that can sustain essential services during digital shocks are better placed to preserve trust, reduce panic and deny adversaries the wider social effects they may seek. The resilience agenda is therefore not merely technical or corporate. It is increasingly public and constitutional in character.
What a mature resilience posture looks like
A mature approach to cyber resilience does not abandon prevention. It integrates prevention into a wider operating model built around continuity. In practice, that means five things. First, identifying critical functions rather than treating all systems as equally important. Secondly, mapping dependencies across software, cloud services, identity, telecoms and third parties with enough granularity to support recovery decisions. Thirdly, engineering for degraded modes, including manual alternatives where feasible. Fourthly, exercising restoration and crisis governance regularly. Fifthly, ensuring that boards and senior officials own the trade-offs involved.
None of this guarantees immunity from serious disruption. The digital environment is too complex, and adversaries too adaptive, for that. But it does alter the terms of vulnerability. An institution that can isolate failure, communicate clearly and restore priority functions quickly is much harder to coerce, embarrass or economically damage than one that relies on brittle assumptions of uninterrupted availability.
The strategic conclusion is straightforward. Cybersecurity is no longer best understood as a contest over access alone. It is a contest over endurance. The organisations and states most likely to fare well will be those that assume compromise is possible, dependency is unavoidable and recovery is a core capability rather than an afterthought.
