Cyber resilience is no longer just about how fast an organization can come back online after an attack – it’s now defined by whether you can continue operating while under attack. It’s a shift in mindset that business leaders can no longer ignore.
A single breach can ripple through the organization, disrupting production, transactions, supply chains and more, leading to financial loss and reputational damage – all within a few hours.
The latest research highlights how almost half of CISOs who have experienced a cyber incident reported operational shutdowns as a direct consequence (47%), more than data (41%) or revenue loss (40%).
Global Director of Executive and Board Cyber Services at Sygnia.
One of the biggest challenges facing CISOs today is no longer about retrieving stolen data or bearing the brunt of lost income; rather, it’s ‘keeping the lights on’ for the business functions that matter the most – which can limit the damages to the business and its supply chain overall.
What makes matters worse is that despite increasing efforts to bolster defenses by investing in new tools and solutions, it boils down to a lack of cyber preparedness: 73% of CISOs are not confident that they could effectively manage a major cyber incident if it happened tomorrow.
From a lack of resources and visibility to disconnects between teams, this gap has become increasingly prevalent. I remember working with a large international bank during a tabletop exercise where I had asked the security operations team to rate the level of risk based on the evidence in front of them.
Looking at the IP address, they had assessed it to be a 2 out of 5. I then turned to the business owners and asked them the same question – they felt it was 5 out of 5 because that IP address was the bank’s data lake, containing all of its critical data.
The most important thing to remember is that integrated risk management spans different swim lanes, including cyber, IT, legal, communications, and more. It cannot happen in silos, and business context is king. Understanding what is at risk to the business and having a plan to keep the business running is critical to planning.
Fundamentally, cybersecurity is 1000% about risk, and cyber incidents are when and how all of those stakeholders need to come together, understand the risk from their respective perspectives, and work collectively to reduce it. This needs to be continuously in practice so that there is no longer a block to effective cyber management.
Business continuity plans for the modern environment
The cyber landscape is rapidly transforming with technologies like AI and Frontier AI, removing the need for threat actors to be highly sophisticated or hire various resources to carry out large-scale attacks at speed and cause operational chaos.
While modern ransomware campaigns involving deepfake impersonations and AI-enabled malware continue to make headlines, more importantly is the way AI is being used by attackers to accelerate reconnaissance, identify vulnerabilities, create convincing social-engineering content, and pursue multiple attack paths in parallel.
Now threat actors can thrive by doing far more with less, grinding not one business to halt, but hundreds and this creates a sense of urgency for businesses to pay ransoms rather than just stealing information alone.
It’s made organizations realize that their once solid business continuity plan will break down when they need it the most, not because of their security technology stack but because they aren’t coordinated and quick enough to lock down their most valuable data and move to recovery.
The most mature customers not only have RPOs and RTOs and business impact analysis on their crown jewels, but they have also created a vision of “Minimal Viable Business Objective.” The bank I was working with called it “MVB” (minimal viable bank). During a crisis, communicating the vision quickly of what it takes to get the business back up and running is fundamental to removing risk and lowering the overall impact of the cyber-attack.
According to the research, legal and communication teams and executive leadership continue to be hurdles with different priorities that can lead to delays in responding to an attack. As a result, 90% of organizations would struggle to coordinate stakeholders during a significant incident, and 75% say delays or uncertainty around legal and communications involvement slow down decision-making when it happens, ultimately slowing down recovery.
One of the key values of tabletop exercises is to have major debates while discussing priorities, role responsibilities, and more so that when you are in a real crisis, the risk-based decision-making is faster. It removes as much friction as possible so the company can respond as an integrated, full business response.
Cyber resilience must be seen as a foundational business function across all departments and people to be truly effective – particularly during the upheaval of a cyberattack.
Why preparing differently will help you to recover faster
The most successful businesses are the ones that continue to operate while managing an incident. They haven’t started from the day of attack, but rather have been strategically and continuously adapting, updating and rehearsing their cyber resilience plans and communication paths all along.
They regularly test to see how well the organization will react and perform in the event of a breach – simulating the urgency and pressure each role may face in decision-making and communicating.
To shorten the breach exposure time and operate while recovering, every organization needs to:
- Regularly carry out a cyber posture assessment to discover the gaps and blind spots in their security posture. 78% of security leaders agree blind spots in their environment increase the risk of persistent attacker access and repeat incidents.
- Simulate breach attacks with executives and business stakeholders, testing internal and external communication pathways to train staff and build confidence in managing a chaotic breach attack so that it no longer isn’t. Confirm what you do well and what areas you can improve upon.
- Continuously update containment and decision-making playbooks to remove uncertainty – this will help speed up the path to recovery far sooner and potentially in tandem with the attack. We are working with clients who are not only continually updating their paper-based SOPs (standard operating procedures) but then moving to the next level and integrating them into a customized AI application that assembles the right modules, with the right actions, by role and time for a just-in-time action plan.
- Measure recovery by metrics: The most cyber-ready organizations track how quickly they can respond and recover from an incident. The board and regulators will want to know that the organization has done everything in their power to contain a breach and operate as quickly to avoid a lengthy and costly recovery.
This means measuring mean time to containment broken out by incident type, the gap between detection and executive notification measured against actual disclosure deadlines, and the percentage of past incidents that led to a real, documented change in the IR plan rather than just a retrospective meeting.
Cyber resilience is a business continuity discipline
Cyber resilience can no longer be a lip service exercise. With recovery costs bankrupting businesses and even impacting market share, organizations need to know whether they can operate, service clients, and communicate to the board in the midst of a cyberattack.
As AI increases the flow of data and organizations interconnect with various teams in and outside of the company, cyber resilience will be seen as a competitive advantage. Operating through disruption will be the true indicator of modern business continuity planning – one where cyber resilience plays a critical role in protecting customer trust and minimizing financial impact before a breach becomes a full-blown crisis.
We've featured the best endpoint protection software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit