While traditional cybersecurity strategies have focused heavily on prevention and detection, today’ s environment demands a more proactive and comprehensive approach. Building genuine cyber-resilience means preparing for the inevitable, minimising disruption and ensuring Business Continuity, even in the face of a significant security breach.

For CISOs, this requires more than investing in the latest security technologies. It involves strengthening incident response capabilities, implementing robust backup and recovery strategies, regularly testing resilience plans and fostering a security-conscious culture across the organisation. Crucially, it also means aligning cybersecurity priorities with wider business objectives and securing board-level support.

With the stakes higher than ever, how can CISOs move beyond simply defending their organisations to building the confidence and capabilities needed to withstand, respond to and recover from emerging threats?

We hear from three industry experts who share their perspectives on the strategies and priorities shaping cyber-resilience today.

James Blake, VP Global Cyber Resiliency Strategy and Consulting Services, Cohesity

Recovery confidence is decided before the incident

CISOs are asked how quickly their organisations can recover. The better question is who decides, on what authority, and whether anyone can prove it afterwards.

The tempo mismatch

CrowdStrike’ s 2026 Threat Report puts average breakout time at 29 minutes, with the fastest observed at 27 seconds. Set that against a typical crisis decision. Somebody notices, somebody escalates, a bridge call is convened, counsel is consulted. On a good day that takes two hours. On a Sunday in August it takes considerably longer.

Asking people to move faster will not close the gap. Moving the decision earlier will.

Borrow from the exchanges

Stock exchanges halt trading automatically when an index breaches a defined threshold. No committee sits. The judgement was made years earlier, in daylight, by people who thought carefully while nothing was on fire. The accountability sits with whoever set the threshold. That is the model worth importing.

Sort your decisions into three classes

Some actions must execute automatically, because no human is fast enough to help: suspending a credential being used to move laterally, or halting replication so corruption does not reach the copies you intend to recover from. These need defined triggers, defined limits and a named owner who reviews them quarterly.

Some need one person with standing authority and no obligation to consult, such as declaring a major incident or invoking recovery. What usually goes wrong is that nobody at three in the morning believes the call is theirs.

Some belong to the Board: paying an extortion demand, suspending a regulated service, speaking publicly. The Board needs a rehearsed route to a quorum inside an hour, weekends included.

Automation is not a blank cheque

Automated containment can destroy availability as efficiently as it preserves integrity. Every automated action needs a stated blast radius, a maximum duration before a human confirms it, and a documented answer for when it fires on a false positive at the worst possible moment.

Build the record beforehand

Regulators, insurers and litigants ask the same four questions. Who decided? On what information? Under what authority? At what time? Organisations that assemble the answers during a crisis produce

What usually goes wrong is that nobody at three in the morning believes the call is theirs.

James Blake, VP Global Cyber Resiliency Strategy and Consulting Services, Cohesity

WWW. INTELLIGENTCISO. COM 25