Moving from Cybersecurity to Cyber Resilience: Improving board-level communication and understanding
In this blog, I make the case for extending cybersecurity to include social, cultural and organizational aspects to improve overall resilience. This is also the main point in recent work on Cyber Resilience, which for some is another buzzword the cybersecurity industry already has plenty of. However, I believe that cyber resilience can actually be achieved if we start to fund and develop non-technical capabilities that can enhance resilience, such as communication, training, exercising, and organizational learning.
Why has cybersecurity not delivered the expected resilience despite decades of investment?
Most organizations approach cybersecurity through a mechanistic lens: they identify threats, map them to (mostly technical) controls, implement those controls, and demonstrate compliance. That model is deeply embedded in frameworks, audits, and even how we structure our teams. It has value, but it assumes that risk behaves in a relatively linear and predictable way. This is not the case, as cyber risk is dynamic, unpredictable and ambiguous in nature.
Cyber risk emerges from complex socio-technical systems. Security incidents are usually not caused by a single missing control; they result from (missing) interactions between technology, people, processes, and organizational constraints. Academic work increasingly points out that most cybersecurity frameworks are still overly techno-centric and fail to account for these socio-technical dynamics.
So, what we have done well historically is build controls to mitigate known, predictable risks. What we have not done equally well is ensure that those controls collectively produce resilient behaviour under stress, such as a data breach or cyber attack. Partially, this is because we forgot to include the human element in security design. This is highlighted by the various methods of multi-factor authentication we have seen over the past 10 years, ranging from SMS codes to passkeys. All these methods work technically well, but adoption is lacking because security professionals are not good at communicating why security controls are needed and how they work. Our tools should guide secure behaviour, but we have failed to implement that adequately in the past. This is partially why we have so many academics and practitioners working on Human-Computer Interaction (HCI).
In this sense, the discipline hasn’t failed due to a lack of investment. Rather, that investment has been disproportionately focused on technical controls, while underinvesting in the broader socio-technical conditions that determine and improve resilience.
Where does the disconnect between cybersecurity and executive decision-making originate?
I believe this originates in how we translate cyber risk into something decision-makers can work with. Many security professionals still talk technically to their business leaders. We talk about threats like phishing and ransomware, but we forget to accentuate the actual risk these threats pose to the business.
Besides that, when we do include a sound risk management process, we usually communicate risks in qualitative manners: “high probability, medium impact.” This is great for internal discussions, but the risk evaluation process is not grounded in evidence. There is a nice book on cyber risk quantification by Tony Martin-Vegue called From Heatmaps to Histograms that highlights this gap fantastically.
Additionally, there is also a capability gap. Many boards recognize cyber as a business risk, but relatively few have deep expertise, and governance structures are not always set up to bridge that gap effectively. CISOs and other security directors need to communicate cyber risk more effectively in terms of business risk, including financial impact in actual euros (or whatever currency you use), without overstating their confidence in either qualitative or quantitative methods. The beauty of good cyber risk management lies in between and balances both methods to create a good narrative that resonates with boards. So, the current disconnect lies with poor cyber risk management, communication, and reporting capabilities.
The reductionistic approach to root-cause analysis
Another good example of this reductionistic approach and technical over-reliance is the way we do Root-Cause Analysis. The instinct to find a root cause is understandable, but it is fundamentally a reductionist approach to what is often a systemic problem.
Traditional failure analysis assumes linear causality: something went wrong because a component failed, and if we fix that component, we prevent recurrence. This is the classic “Safety-I” perspective described by Hollnagel, where safety is defined as the absence of failure.
In complex systems, that assumption does not hold up. Failures emerge from actions (or lack thereof) by people, failed internal processes, system or technology failures, or external events (see the work of Cebula et al.). But in most cases, it is a combination of the above factors that causes the risk to cascade, so it’s difficult to point to one single failure. There are just too many unknown factors involved. This means that we need to look further than system and technology failures and include people, organizational, cultural and process factors. This will lead to changes in the security architecture and underlying processes that are more sustainable and systemic, eventually improving resilience.
Making the case for (cyber) resilience without lowering the bar
Everyone needs to understand that resilience implies that something can and will go wrong. This also means that we can’t over-rely on prevention alone. Cyber resilience is about anticipating, withstanding, recovering from, and adapting to shocks caused by cyber events.
What helps in making that case is moving away from abstract concepts and focusing on tangible organizational capabilities. In practice, more resilient organizations invest in a number of structural and behavioural elements that go way beyond technical controls.
First, they pay deliberate attention to the people side. That includes selecting, training, and retaining individuals who can operate under pressure and deal with ambiguity. Second, they invest in communication. Resilient organizations treat communication as a primary control. Enterprise Architecture is a good mechanism to improve communication. Third, they design and rehearse playbooks. I have seen so many incident response and business continuity plans that look good on paper but break down in real crises. Finally, resilient organizations invest in a culture of continuous learning and feedback loops that feed back into security architecture and strategy. So, lowering the bar and solely focusing on prevention is not an option if you want to be able to navigate the complex world we live in.
Why are human and organizational factors still underfunded?
Technical controls are easier to define, procure, implement, and audit. They map to frameworks and can be somewhat expressed in measurable terms. Organizational dynamics are a lot messier because they are dynamic and you have to deal with the perspectives, norms, values, and beliefs of other people. Socio-technical research highlights that vulnerabilities emerge precisely at the intersection of human behavior and system design, not in isolation. I strongly believe that it is very hard, if not impossible, to accurately quantify security investments from a human, organizational and technological perspective when the (cyber) landscape is continuously changing and on the move.
Until we treat cybersecurity as a socio-technical system, that gap will persist. This is where the difference lies between cybersecurity and cyber resilience; cybersecurity is mostly about preventing attacks from happening, while cyber resilience aims to ensure organizations are still able to perform acceptably under pressure.
This paradigm shift indirectly implies that we cannot know it all and must be able to adapt under ever-changing circumstances.
Author’s note
This article is an updated and expanded adaptation of my article “Communicating Cyber Risk in dollars boards understand”, originally published on the website of Helpnet Security in 2026. Several changes have been made to translate the article to this blog.