From cyber security to cyber resilience: Why organizations need to practice for the worst

For years, cybersecurity has been framed primarily as a technology problem. Firewalls, endpoint protection, detection tools and incident response playbooks have dominated the conversation. Organizations invested heavily in preventing attacks and improving their ability to detect and respond.

Prevention cannot be overstated and should be considered the foundation of cybersecurity – it reduces risk, disruption, and cost, limits the blast radius, and ensures business continuity. In an environment where threats are constant and adversaries move fast, strong preventive controls remain the most effective way to reduce harm.

The reality is that it's no longer a question of whether an attack will occur, but when; and any technical defence, even strong ones, can be tested by uncertainty, complexity, and time pressure. Such uncertainty has been exacerbated by the rapid adoption of artificial intelligence, which has aided adversaries as much as it has accelerated defence capabilities.

The organizations that emerge stronger are those that can operate effectively under failure, even when prevention has been challenged. When technology cannot immediately restore certainty, it is the organization’s decision-making discipline and operational coordination that ultimately determine the outcome.

This is where cybersecurity evolves into cyber resilience.

Cybersecurity focuses on protection and response: stopping attacks, reducing dwell time and restoring systems. Cyber resilience asks a broader question: how does the organization continue to operate and make decisions when technology is disrupted, degraded or untrusted?

In that sense, cyber resilience mirrors other business continuity planning disciplines. For example, organizations routinely prepare for natural disasters, supply chain disruptions and operational outages, assuming that systems, people or processes may become unavailable and the business must still function.

Similarly, a severe cyber incident could delay or constrain IT recovery. Systems go down longer than expected and data integrity could become uncertain. External pressure from customers, regulators and the media can also mount. Therefore, the challenge no longer remains purely technical but also organizational.

True cyber resilience requires the entire organization to act in concert.

Legal teams must assess regulatory exposure and contractual obligations. Finance must evaluate operational impact and liabilities. Communications teams must manage messaging to employees, customers, partners and the public. Executives must make time-critical decisions with incomplete, sometimes conflicting information.

If these functions are not aligned, even a technically well-managed incident can escalate into a business crisis: delayed decisions, inconsistent messaging, unmanaged expectations and avoidable reputational damage.

Yet many organizations still “test” cyber readiness almost exclusively within IT. Incident response exercises focus on malware analysis, containment timelines and system restoration. While necessary, this doesn’t test whether the organization can operate under sustained disruption or whether leadership can make confident decisions when the facts are unclear.

Cyber resilience demands a different approach: practice how the organization behaves when prevention reduces risk but cannot eliminate it and when technology cannot instantly resolve uncertainty.

One reason cyber resilience is often discussed but rarely measured is that you can’t measure it with just dashboards.

An agent can’t be deployed to tell you how quickly executives align under pressure, whether legal and communications can synchronize messaging in a fast-moving situation or how effectively teams share information across silos.

Cyber resilience is about decision-making, co-ordination and adaptability. To assess it, organizations need a structured methodology – a way to exercise, observe and measure how people and processes perform under extreme conditions. This is where tabletop exercises become invaluable.

Tabletop exercises are often treated as compliance requirements or basic incident response training. However, when well-designed, they are among the most practical ways to build and measure resilience.

Unlike technical simulations, tabletops focus on people and decisions, placing participants into realistic scenarios and forcing them to navigate uncertainty, trade-offs and competing priorities.

To do this effectively, the scenario should go beyond a “normal” cyber incident, with the goal of testing the organization’s ability to operate when recovery is delayed, data trust is questionable, and external pressure is rising.

A strong resilience exercise escalates gradually:

At a certain point, it becomes clear that technology alone will not resolve the situation quickly.

This is where the exercise becomes revealing.

Legal assesses notification obligations and risk exposure without complete facts. Finance evaluates business impact while systems remain unavailable. Internal communications manages employee uncertainty and rumour control. External communications balances transparency with legal and reputational risk. Executives make high-stakes calls under time pressure.

The value isn’t in finding the “perfect” answer; it’s about whether the organization can work together quickly, coherently and decisively.

A well-designed cyber resilience tabletop exercise surfaces insights that purely technical tests won’t. It also creates measurable indicators you can track over time, such as:

These indicators allow organizations to move beyond “we think we’re ready” and toward concrete improvement plans.

Prevention remains the core of any cybersecurity strategy to reduce the likelihood and impact of incidents, buy time and limit disruption. However, resilience ensures that when prevention is tested by speed, uncertainty and complexity, the organization can still function.

Cyber resilience is not a one-time project. Like any business continuity planning discipline, it requires continuous practice, refinement and leadership engagement. Tabletop exercises should be repeated, adapted and expanded as the organization evolves.

The most resilient organizations are not those with perfect defences but those that have practiced failure and learned from it. If your cyber exercises stop when IT restores systems, you are testing security, not resilience. Build prevention as the foundation, then practice the moment it is not enough.