In a world where cyberattacks are increasingly common, it’s no wonder cybersecurity leaders are losing sleep. This is largely due to the fact that protecting against every cyberattack these days is an impossible task. Eventually the worst will happen. Establishing a strategy for operational resilience is a must.

If every organization will suffer an attack sooner or later, ensuring your incident response plan is up to scratch is a no–brainer. But with attacks becoming more complex, current incident response strategies need to evolve with the times if they are going to promise operational resilience. 

At our recent Security Insights Summits, we were joined by industry experts who shared their approach to building operational resilience in our rapidly changing world.

A changing landscape 

While business continuity and disaster recovery will always be important, security leaders need to expand their understanding of what it means to be resilient.  

Third-party risks, physical security, crisis communications – these should all be part of any modern resilience strategy. 

How security leaders understand third-party risk is also due for a rethink. It’s no longer enough to treat third-party data as out of your control. All data, regardless of whether it is within the network or kept by third-parties, is the business’ responsibility to secure.

“Third party risk is being redefined. We are returning to the approach of a single infrastructure. One infrastructure. One strategy. One methodology. One architecture.”

– Michael Woodson, former Information Security & Privacy Director at Sonesta Hotels 

Where risk assessment and operations have been separated in the past, today they need to be brought together. Security teams should no longer be the sole stewards of operational resilience. Everybody has a part to play. 

Building your response plan for resilience 

Flexibility 

It was Mike Tyson who said it best – “Everyone has a plan until they get punched in the face.”  

In the spirit of Iron Mike, security leaders need to ensure their plans are flexible enough to roll with the punches. 

Staying locked in on an incident response strategy, regardless of the situation, will allow more flexible attackers to run rings around defenses. Keeping incident response plans in–line with operational reality based on the data available is critical to responding to modern attacks.

AI 

With a massive and diverse information landscape, extracting actionable data is becoming increasingly untenable for your human staff. Humans don’t scale. That’s where AI can help. 

Cyber–incidents have a lifecycle, with security teams slowly piecing together the events as they gather more data. The more you understand, the easier it is to adapt your strategy. Having that data early can make all the difference. Understanding what happened will also impact your Recovery Point and Recovery Time Objectives (RPO & RTOs). 

But AI isn’t the be-all and end-all. You can use AI to capture actionable data, but decision making should remain with the team.

“There’s too much data for humans to sift through, even with a huge team of analysts, so using AI there makes sense. But when it comes to full decision making, it has to revert to human intuition.”

– Eric Sanchez, Global CISO at Orrick, Herrington & Sutcliffe LLP

Culture 

If a security incident is going to impact the entire business, any good response plan needs to include the entire business. 

Speak with stakeholders, work with front line operators, be transparent and clearly communicate the importance of security and their role in it. 

By running role-based training exercises and tabletops that include wider business stakeholders, not only can security teams get a clearer understanding of their incident response strategy, but the wider business can see where they fit in as well. 

It’s also worth remembering that if you want to foster a positive culture of security awareness, offer encouragement when they succeed, not criticism when they fail.

By running role-based training exercises and tabletops that include wider business stakeholders, not only can security teams get a clearer understanding of their incident response strategy, but the wider business can see where they fit in as well. 

It’s also worth remembering that if you want to foster a positive culture of security awareness, offer encouragement when they succeed, not criticism when they fail.

Operational Resilience in 2025 

Resilience is a conversation that is constantly evolving. Discussions around what resilience means to organizations, how success can be measured, and best practices for ensuring operational resilience will continue to help security leaders shape their strategies for the future. 

To continue the conversation on resilience, make sure you check out our upcoming Security Insight Summits.