A security dashboard can look like a success story while the business remains dangerously exposed. Thousands of threats blocked, suspicious e-mails quarantined and alerts investigated create the impression that the organisation is in control.
But ask how quickly it could restore payroll, e-mail or a critical production system after a serious attack, and the confidence can disappear rather quickly. The uncomfortable truth is that stopping threats and surviving an attack are two very different capabilities.
Cyber security has spent years measuring success through prevention and detection, yet neither tells a board whether the business can keep operating when those defences fail. That distinction matters because even sophisticated security controls cannot guarantee that an attacker will never get through.
Resilience is not about claiming the breach will not happen. It is about knowing what happens next, who makes the decisions and how quickly the organisation can recover.
The investment is substantial, but the risk remains firmly on the boardroom agenda. IDC forecasts global security spending of $310.42 billion in 2026, while its February CEO Survey identified cyber security as the leading anticipated technology risk, ahead of AI itself.
The figures point to an uncomfortable disconnect between the money organisations are spending and the confidence they have in their ability to manage the consequences of an attack. More security investment does not automatically translate into a business that can withstand disruption.
The problem begins when organisations confuse activity with readiness. A dashboard showing 10 000 blocked threats says something about prevention, but very little about whether critical services can be restored after a successful attack.
Boards should be asking how quickly an incident can be contained, which business operations will be affected, what dependencies must be restored first and whether the recovery process has been tested under realistic conditions. When an incident occurs, the measure that matters is not the number of alerts closed, but the time the business spends unable to operate.
AI is adding another dimension to this challenge, particularly as security teams look to automate responses to attacks that unfold faster than people can reasonably react. Keeping a human involved in every decision might appear prudent, but it can also introduce delays precisely when speed matters most.
The answer is not to hand unrestricted authority to AI, nor to require manual approval for every action. It is to give automated systems authority that reflects the potential consequences of their decisions.
Isolating a compromised laptop is a strong candidate for automation when the conditions are understood and the action can be reversed. Taking a critical production system offline is a different proposition, because the security benefit must be weighed against the operational consequences.
That decision may require knowledge of production schedules, customer commitments, safety requirements and the availability of alternatives. AI can help establish what is happening and execute an appropriate response, but the organisation must determine where its authority ends.
This is where many businesses still have work to do. They may have sophisticated endpoint detection and response tools, e-mail security and a security operations centre monitoring activity around the clock, yet remain poorly prepared to restore operations after a major incident.
Recovery plans can depend on the assumption that identity systems, DNS and backup infrastructure will remain available, even though attackers may target those very services to prevent an organisation from recovering. A plan that has never been tested under those conditions offers considerably less reassurance than its existence might suggest.
Recovery therefore needs to become part of the security conversation from the outset, rather than something handed to IT after an incident has already unfolded. Organisations need to understand which services are essential, how those services depend on underlying infrastructure, which systems must be restored first and who has the authority to make difficult operational decisions.
They also need to rehearse those decisions, including scenarios in which normal administrative access and recovery tools are unavailable. Finding an attack is only the beginning; the real test is whether the business can contain the damage and return to operation.
As AI becomes more deeply embedded in security operations, governance must keep pace with its growing authority. Organisations need clear boundaries around what automated systems may do, named accountability for those decisions and reliable records of actions taken.
The level of autonomy should reflect the confidence in the proposed response, the criticality of the affected system, the potential scale of disruption and whether the action can be reversed. Human oversight remains essential where consequences are significant, but human involvement should provide meaningful judgment rather than become an obstacle to timely action.
Security platforms have become remarkably effective at collecting telemetry, correlating events and accelerating investigations. The next step is to use those capabilities to improve containment and recovery, not simply to produce faster alerts and more impressive dashboards.
Organisations that understand their dependencies, test their recovery plans and establish sensible boundaries for automation will be better placed to withstand the inevitable failures of prevention. Detection tells you that something has gone wrong. Resilience determines how much the business loses, and how quickly it can get back to work.
Share
Editorial contacts