The shift from protection to resilience
For years, cybersecurity was framed largely as a defensive contest: build stronger perimeters, detect intrusions early and prevent malicious access. That logic still matters, but it no longer captures the full problem. Modern organisations depend on sprawling digital estates made up of cloud services, remote devices, outsourced software, industrial systems and third-party data flows. In such environments, it is difficult to know every asset, harder still to secure every connection, and nearly impossible to guarantee that a determined adversary will never get in.
That is why cyber resilience has moved to the centre of policy and operational planning. Resilience is broader than security. It includes prevention, but also absorption, response, recovery and adaptation. A resilient organisation expects disruption at some point and is built to continue essential operations through it. This approach is increasingly visible in guidance from public authorities and standards bodies, including the National Institute of Standards and Technology, which treats governance, response and recovery as core parts of cyber risk management.
Cyber resilience begins with an uncomfortable premise: some failures are inevitable, so the decisive question is how much damage they are allowed to cause.
The distinction matters because the consequences of cyber incidents now spill far beyond stolen data. A ransomware attack can halt medical appointments, delay payroll, interrupt logistics or shut down fuel distribution. A software compromise can ripple across thousands of customers at once. A denial-of-service campaign can undermine trust even when no systems are permanently damaged. In each case, the strategic issue is not merely whether a control failed, but whether institutions can sustain critical functions under stress.
Seen this way, cybersecurity and resilience are not rival agendas. Security reduces the frequency of incidents; resilience reduces their impact. Mature organisations need both.
Why prevention alone is no longer enough
Three structural trends have made a prevention-only model less realistic. The first is complexity. Enterprises now run hybrid infrastructures across on-premises systems and multiple cloud environments, often with legacy applications still tied to newer services. Complexity creates hidden dependencies, broadens attack surfaces and leaves defenders with an incomplete picture of risk.
The second trend is concentration. A relatively small number of software components, service providers and identity platforms underpin large parts of the digital economy. This improves efficiency but also creates systemic vulnerabilities. When one widely used provider or tool is compromised, the effects can cascade across sectors and borders. Recent warnings from cyber authorities have consistently emphasised supply-chain and dependency risk as a defining feature of the current landscape.
The third trend is asymmetry. Attackers do not need to defeat every control. They need only one workable route in, one unpatched server, one stolen credential, one poorly secured supplier connection or one employee deceived by a convincing message. Defenders, by contrast, must sustain discipline across all these fronts, every day.
None of this makes strong prevention obsolete. Basic controls still have extraordinary value, especially patching, multi-factor authentication, network segmentation, offline backups and rigorous identity management. But these measures are not sufficient on their own. A resilient posture assumes that even well-run organisations may suffer compromise and therefore prepares for degraded operations, alternative workflows and rapid restoration.
What cyber resilience actually includes
The term resilience is sometimes used so loosely that it risks becoming a slogan. In practice, it has several concrete elements. The first is anticipation: understanding critical assets, likely threats, key dependencies and the consequences of failure. This requires more than an asset inventory. It means knowing which systems are essential to mission delivery, which suppliers are indispensable, and how long an interruption can be tolerated before harm becomes severe.
The second element is resistance: the security controls that make attacks less likely to succeed. These include secure configuration, least-privilege access, vulnerability management, endpoint monitoring and tested incident detection. Resilience is not softer than security; it rests on serious security hygiene.
Cyber resilience begins with an uncomfortable premise: some failures are inevitable, so the decisive question is how much damage they are allowed to cause.
The third element is recovery capability. Backups must not simply exist; they must be protected from tampering, recoverable within realistic timeframes and tested against plausible scenarios. Incident response plans must be specific enough to guide decisions under pressure, including legal, technical, communications and executive responsibilities. Business continuity planning should identify what must stay running, what can be paused and what manual workarounds are feasible.
The fourth element is adaptation. After-action reviews, threat-informed exercises and lessons learned from incidents should alter architecture, policy and training. Resilience is cumulative when organisations treat disruption as feedback rather than as an isolated embarrassment.
In this sense, resilience is a management discipline as much as a technical one. It depends on governance, operational clarity and institutional memory.
The role of boards and senior leadership
One reason resilience has gained traction is that it gives senior leaders a clearer frame for decision-making than purely technical risk language. Boards may struggle to weigh the significance of a particular malware family or exploit chain. They are better placed to judge questions such as: which services are mission-critical; how much downtime is tolerable; what legal and contractual obligations apply; which dependencies create concentration risk; and what trade-offs exist between efficiency and recoverability.
Public guidance increasingly reflects this broader governance view. Cyber risk is now treated by many regulators and standard setters as an enterprise risk, not merely an information-technology concern. That means resilience should be discussed alongside operational continuity, financial exposure, safety and reputation. The objective is not to make board members security engineers, but to ensure they can scrutinise assumptions about preparedness and accountability.
The hallmark of a resilient institution is not that it avoids every incident, but that leadership can make disciplined decisions when systems are degraded and time is short.
This raises a practical challenge. Many organisations still measure cybersecurity through activity rather than outcomes: number of alerts reviewed, number of staff trained, number of vulnerabilities scanned. These indicators can be useful, but resilience demands measures tied to operational consequence. How quickly can identity systems be restored? Can payroll run if a core platform is unavailable? How long would it take to rebuild an environment from trusted images? Which suppliers would create single points of failure if they went offline?
Such questions push resilience into the realm of executive planning. They also expose where institutional confidence may be misplaced.
Critical infrastructure and the problem of cascading failure
The resilience lens is especially important for critical infrastructure. Energy, transport, healthcare, water, finance and telecommunications increasingly rely on interconnected digital systems, including operational technology that was not always designed with contemporary cyber threats in mind. An incident in one organisation can therefore generate knock-on effects for others, either through direct dependency or because disruptions spread through tightly coupled supply chains.
Hospitals provide a clear example. A cyber incident may begin as an information-systems problem, but the consequences can quickly become operational: cancelled procedures, delayed diagnostics, ambulance diversion and reduced administrative capacity. Similar patterns appear in logistics, where software outages can interrupt routing, warehousing and customs processing, and in utilities, where billing, control systems and field operations may be intertwined.
These interdependencies make resilience harder because recovery is not always fully within one organisation’s control. If a key supplier is unavailable, a customer may have robust internal processes and still be unable to restore normal service. That is one reason authorities in Europe, North America and elsewhere have placed greater emphasis on incident reporting, supply-chain assurance and operational continuity obligations for essential entities.
The larger lesson is that systemic cyber risk behaves differently from isolated technical failure. It spreads through concentration, dependency and synchronisation. Resilience planning must therefore consider not only internal weaknesses but the wider ecosystem on which an organisation depends.
Ransomware as a stress test for resilience
The hallmark of a resilient institution is not that it avoids every incident, but that leadership can make disciplined decisions when systems are degraded and time is short.
Few threats have done more to sharpen interest in resilience than ransomware. Its significance lies not only in encryption or extortion, but in the way it tests an organisation’s ability to function under acute disruption. In many cases the immediate question is not forensic attribution but continuity: can the organisation isolate affected systems, preserve evidence, communicate with staff and customers, and restore priority services without compounding the damage?
Ransomware also reveals the difference between backups on paper and recovery in practice. Backups may be incomplete, connected in ways that allow attackers to corrupt them, or too slow to restore critical functions within acceptable time. Authentication systems may fail in ways that complicate recovery. Documentation may be outdated. Manual workarounds may exist for only a fraction of essential processes.
This is why mature preparation involves tabletop exercises and technical recovery drills, not just policy documents. Exercises should test senior decision-making as well as engineering capacity: who authorises shutdowns, when are regulators informed, how are law-enforcement requests handled, what messages go to staff, and which services receive priority if capacity is constrained?
Ransomware demonstrates a broader truth. The damage from cyber incidents often stems less from the initial intrusion than from uncertainty, delay and brittle operations during the response. Resilience reduces that fragility.
Supply chains are now part of the attack surface
It is no longer credible to define an organisation’s cyber perimeter by its own network alone. Software suppliers, managed service providers, cloud infrastructure, open-source libraries and specialist contractors all shape cyber exposure. The compromise of one trusted update mechanism or remote management tool can affect thousands of downstream users simultaneously. In such cases, even organisations with comparatively strong internal controls can become victims of inherited risk.
Supply-chain resilience requires a balance between due diligence and realism. No customer can fully inspect every line of code used by every vendor. But organisations can identify critical dependencies, require basic security practices, segment third-party access, monitor for anomalous activity and maintain contingency plans for provider outage or compromise. Procurement and security teams need to work together, because contractual leverage often determines how much visibility and assurance can be obtained.
Open-source software complicates the picture further. It underpins a vast share of modern development and offers substantial benefits, yet responsibility for maintenance and security can be uneven. Public agencies have increasingly called for better software transparency, memory-safe development practices and stronger security-by-design principles across the technology ecosystem.
In a networked economy, resilience depends as much on managing dependencies as on defending devices.
The implication is sobering. Cyber resilience is not simply a property of individual organisations. It is partly a property of the supply chains and digital commons they inhabit.
From compliance to operational readiness
Many sectors now face a growing web of cyber regulation, reporting duties and assurance standards. Properly designed, these can raise the floor of practice, improve visibility and create incentives for board attention. Yet compliance should not be confused with resilience. A control may satisfy an audit requirement and still fail under real operational pressure. A risk register may be complete while recovery plans remain untested. A policy may exist without corresponding authority, staffing or technical implementation.
The more useful question is whether regulatory requirements are being translated into operational readiness. That means rehearsed roles, trusted communications channels, clear escalation paths and recovery objectives that reflect business reality. It also means integrating cyber planning with crisis management, legal counsel, public affairs and supplier management.
Resilience tends to expose gaps that compliance regimes can overlook. For instance, a firm may meet formal security standards but depend on a single administrator with unique system knowledge. It may have business continuity plans, but those plans may assume the availability of identity systems or collaboration tools that would in fact be disrupted by a serious incident. It may report supplier risk annually, yet lack a practical fallback if a critical provider goes down tomorrow.
In short, compliance can support resilience, but it is not a substitute for it. The test is performance under stress.
In a networked economy, resilience depends as much on managing dependencies as on defending devices.
What good resilience planning looks like
Strong resilience planning usually begins with prioritisation rather than comprehensiveness. Organisations should identify their most important services, the systems and data that support them, and the dependencies without which those services cannot operate. This creates a map of what truly matters when time and resources are constrained.
From there, several practices stand out. One is network and administrative segmentation, which can limit lateral movement and reduce the blast radius of compromise. Another is immutable or offline backup architecture, paired with regular restoration tests. A third is identity hardening, because credentials remain one of the most common paths to compromise and one of the biggest obstacles to safe recovery. A fourth is scenario-based exercising, including situations where monitoring tools, email or key vendors are unavailable.
It is also sensible to pre-designate crisis structures. Who takes operational command? Which decisions require executive approval? How are external experts engaged? What legal thresholds trigger disclosure? Which records must be preserved? These are not details to settle for the first time during an active incident.
Finally, resilience planning should account for people. Staff need practical training for degraded modes of working, from manual processing to secure alternative communications. Fatigue management matters during prolonged incidents. So does psychological realism: plans built around ideal performance from exhausted teams rarely survive first contact with reality.
The public sector challenge
Governments face a distinctive resilience problem. They run large, heterogeneous technology estates, often combining modern digital services with ageing legacy systems that are costly and difficult to replace. They also deliver functions that are socially indispensable, from taxation and benefits to healthcare administration and emergency services. That makes disruption politically salient and operationally damaging.
Budget constraints can sharpen the problem. Preventive upgrades and architectural simplification compete with short-term service pressures. Skilled personnel are scarce. Procurement cycles may be slow. Yet the public sector also has strong reasons to lead on resilience, because it often sets expectations for critical infrastructure, incident reporting and continuity planning across the wider economy.
One promising direction is a shift towards service-level resilience thinking. Instead of focusing solely on the technical health of systems, agencies ask what minimum level of public service must be maintained during a cyber incident, and what organisational arrangements are required to sustain that level. This encourages investment in fallback processes, cross-agency coordination and the removal of single points of failure.
The same logic applies locally. Municipal bodies, hospitals and educational institutions may not look like national-security actors, but they often hold sensitive data and provide services whose interruption can have immediate civic consequences. Their resilience matters disproportionately.
The strategic case for resilience
Cyber resilience is sometimes portrayed as a concession to insecurity, as though preparing for failure signals reduced ambition. In fact, it is a more realistic form of ambition. It recognises that digital dependence has become too deep, and adversarial capability too varied, for any serious institution to rely on prevention alone. The aim is not to lower standards. It is to align strategy with the conditions of modern technology.
That strategic case rests on three ideas. First, incidents are not rare anomalies but recurring features of a connected environment. Second, the most serious harm often comes from operational interruption rather than initial intrusion. Third, confidence in digital systems depends not only on their security, but on the visible ability of institutions to withstand shocks and recover credibly.
This has implications for investment. Spending on resilience may appear less glamorous than novel detection tools: backups, architecture simplification, incident exercises, continuity planning, supplier mapping, privileged-access controls. Yet these are often the measures that determine whether a serious incident becomes a manageable setback or a sustained crisis.
As digital systems continue to underpin economic and civic life, resilience will increasingly define institutional competence. The organisations that fare best will not be those that promise invulnerability. They will be those that know what must endure, understand where they are fragile and have prepared, in detail, for the day something important breaks.
