Cyber Resilience and Your Organization

The talk looks at why cyber resilience, meaning an organization's ability to keep its whole IT estate running and recover it after a disaster, human error or attack, has become harder to achieve. The speaker describes estates that mix mainframes, client-server systems, web and mobile apps, cloud, IoT devices and third-party software. Resilience is framed as a leadership and business concern that reaches beyond the security team to development, operations, finance, facilities and suppliers.

The middle of the talk draws on a vendor-neutral survey of around 150 senior executives in 18 countries and seven industries. Many respondents said innovation outweighs the added risk it brings, and most said their estates had become too complex to know which controls to apply. Only about a third had a formal incident response plan. Security was often described as siloed, underfunded, reactive and added late to projects. Per-project security spending had risen, largely in response to breaches, new regulations and cyber insurance requirements. Ransomware topped the list of attack concerns, followed by business email compromise and deepfake-enabled fraud, while denial-of-service attacks were seen as hard to defend against.

The closing advice is practical. Readers should check whether governance teams understand resilience, add a security budget line and security input to every project from ideation onward, align security spending with business objectives, bring in outside expertise where needed, and use metrics to make the case to leadership.