Every organisation eventually has a bad day — a breach attempt, an outage, a supplier compromise, a mistaken deletion. What separates the organisations that recover in hours from those that lose weeks is almost never what they did during the incident. It is what they put in place before it. Resilience is a property you build in the quiet periods and spend during the loud ones.
Prevention is necessary but not sufficient
Strong prevention — patching, hardening, access control, email defence — reduces how often bad days happen. It does not eliminate them, and a security programme that assumes it will is fragile by design. Mature organisations invest in prevention and in the assumption that prevention will sometimes fail.
The four things worth rehearsing
Resilience becomes real when four things are ready before they are needed. Detection: you can see something is wrong quickly, not weeks later. Response: a known plan with named roles, so no one improvises under pressure. Recovery: backups that are isolated, recent and — critically — tested by actually restoring them. Communication: who is told what, and when, including regulators and customers. Each of these is cheap to prepare and expensive to invent mid-crisis.
Test the plan, not just the theory
An untested recovery plan is a hypothesis. The only way to know your backups work is to restore from them; the only way to know your response plan works is to run the drill. Organisations that rehearse discover their gaps on a calm Tuesday instead of during a live event.
Resilience is an operating posture
Cyber resilience is not a product you buy once. It is an operating posture that spans people, process and technology, reviewed as the business and the threat landscape change. It sits alongside the rest of your security and data practice — and it is worth building before the day you need it, because by then it is too late to start.
The best time to build resilience is a period when nothing is wrong. That is also, unfortunately, when it feels least urgent. Treating it as ongoing operational hygiene rather than a project is what keeps a bad day from becoming a bad quarter.