Image credit: Pexels
Why leadership, preparation, and disciplined risk management are separating resilient organizations from vulnerable ones.
As cyber threats grow more complex and frequent, the gap between resilient organizations and vulnerable ones is widening. Yet resilience isn’t measured by how many security products a company has purchased; it’s determined by culture, strategy, and leadership commitment. Across industries, companies that treat cybersecurity as a business function, rather than an IT checkbox, are the ones that not only survive but thrive when attackers come knocking.
Looking Beyond the Next Attack
Dawn Hersey, CEO of Ferndon Consulting, approaches cybersecurity through the lens of intelligence and anticipation. As a former military intelligence officer, she applies the same analytical rigor that once informed battlefield decisions to help business leaders navigate modern threats.
Her firm’s core thesis suggests resilience is proactive, not reactive. Prevention can become a static checklist built around what has already happened. Resilience requires organizations to anticipate what adversaries could do next. When Iran’s conflict escalated, Ferndon clients were already prepared for a shift from profit-driven ransomware to destructive state-sponsored wipeware.
Hersey explained: “If you’re talking about just preventing attacks, you take a checklist and check off everything on it. The problem is that checklists are created in a reactive manner; this has already happened. Someone who’s resilient is looking forward. One small change can save millions of dollars, depending on your architecture, and we’ve seen this repeatedly.”
That forward-looking approach also depends on understanding how geopolitical events can change cyber behavior.
“We’ve seen the evolution from just ransomware to wipeware. When it was ransomware, they just wanted profit. When we started triggering the Iranians, right after Iran was attacked, there were literal starts of wipeware, because people who were just criminals previously are now at the hurt. That’s how you predict what your adversaries will do next.”
For Hersey, however, anticipation is difficult when intelligence remains trapped inside corporate silos.
“The silos that exist in corporate America, especially with intel processing, are not organized. Nearly every intelligence professional I’ve seen who’s gone into corporate America is frustrated and horrified. You need to break down those silos to get information from one side to the other; there’s a language barrier, a terminology barrier, and even a bandwidth barrier.”
Turning Strategy Into Action
Ed Correia, Founder and CEO of Sagacent Technologies, sees a similar divide between organizations that prepare and those that merely respond. In his experience, the problem is rarely a shortage of technology. It is often a lack of strategic maturity.
Organizations that already plan their business direction, establish budgets, and define strategic initiatives are more likely to approach cybersecurity as part of broader risk management.
According to Correia: “If you see a business that has an executive group that sits and discusses where the business is going, builds a strategy plan, builds a budget, has strategic initiatives — that kind of company, because they’re forward-thinking, they’re also going to want to do things that mitigate risk. Those are flags that tell me this organization has high maturity.”
Correia advocates structured simplicity, including adopting a recognized framework such as CIS and following a documented implementation path. He says full CIS implementation can reduce breach risk to as low as 7%.
“CIS from the Center for Internet Security has 153 requirements, done in three implementation groups. If you roll out implementation group one, which is just 73 things, we drop your risk precipitously. If you implement all of CIS, you can lower your risk down to like 7%.”
The need for this preparation becomes clearer when you consider how long attackers can remain inside a network before an organization realizes what is happening.
“The average hacker is not detected for three to four months; most people don’t know they’re in there. They spend significant time looking at your business, looking at how you operate. I think of hackers like a poker player: what card am I going to play against you? Oh, you don’t have anything of real value? Boom, I play the ransomware card.”
Practice Before the Crisis
Bryan Sevener, CEO of ValorTech, shifts the focus from strategy to execution. For him, resilience doesn’t necessarily require organizations to buy more security tools. It requires them to understand and repeatedly test the tools and processes they already have.
Tabletop exercises, which simulate breach scenarios, are central to that approach. In one exercise, participants discovered that no one knew the company lawyer’s phone number. The issue took five minutes to fix, but Sevener points out that the same gap during a real breach could have cost millions.
“Just because you take a quick cybersecurity awareness test and pass it one time a year doesn’t mean you’re safe for the rest of the year. Are you ensuring your backups are good? Have you actually tested those backups to make sure you can recover? Have you done tabletop exercises? If you’re working with a good cybersecurity firm, they should be including those, going through a scenario and finding the holes in your SOP,” Sevener revealed.
Another exercise exposed an even broader communications problem.
“In one tabletop exercise, we discovered that personal information had been compromised and the CEO was not accessible, traveling, phone wasn’t on. No one knew who the legal representation was or had their phone number. And the law firm didn’t know the chain of command. That was fixed within five minutes, but during an actual breach, it could have cost everything.”
The lesson extends to everyday employee decisions, where small moments can have major consequences.
“If it looks suspicious, ask a question before you click on it or do something with it; there’s no harm in that. You might save the organization and save yourself a headache. Nobody wants to get into a position where that two-second extra delay in thinking about something could have prevented a resume-generating event.”
Making Security a Business Risk
Jon Waldman, Co-Founder and President of SBS CyberSecurity, brings governance into the resilience conversation. His GRC firm works with organizations that sometimes discover too late that their security strategies rest on dangerous assumptions.
One of the most persistent beliefs is that small organizations are unlikely to attract attackers. Waldman argues that automated attacks have made that assumption increasingly dangerous.
Waldman revealed: “Cyber attacks are almost fully automated today. Organizations believe they’re small, they’re not interesting, nobody knows who they are, but bad guys don’t care where you are or what you have until they’re in your network. Hackers didn’t hack Target. What they hacked was a small mom-and-pop HVAC company in Pennsylvania that had access to one of Target’s data centers, and that’s how they got in.”
That reality places cybersecurity firmly within the broader responsibilities of business leadership.
“It’s not the IT guy’s problem. Most organizations are in the business of risk management anyways; that’s how you run a business. We compare it to loan risk: a bank makes money by lending money, and you risk assess your loans based on a formula. There’s no 100% risk mitigation in anything, but you want to make good bets.”
The consequences of failing to identify those risks can extend for months before containment.
“The mean time to detect and contain an incident is about 250 days on average; generally about 180 days to detect and around 60 days to contain. The big question we always talk about is: if somebody was in your network, would you be able to tell? If the answer is ‘I’m not sure’ or ‘probably not,’ then you have a significant problem on your hands.”
Round the Clock Cyber Security
Traditional security audits are reactive, project-based, and infrequent. This model is ineffective because new vulnerabilities emerge constantly with frequent code deployments, especially with AI. Javier Juárez Zarruk, CEO & Co-Founder of Secur0, believes attackers need only one weakness, while defenders must secure everything. For him, Secur0’s solution is more practical as it offers continuous, performance-based ethical hacking through a network of ethical hackers.
Zarruk shared that Secur0 evolved from a traditional consultancy to a platform model to address these limitations.
“It’s a platform that unifies a network of hackers to hack companies ethically.”
The platform connects 2,000+ ethical hackers for continuous testing. Businesses can access round-the-clock cybersecurity through a pay-per-vulnerability model, with no charge for time or effort, only for results.
“Because when you do traditional jobs, you are limited to time or your resources because you need to pay by the hour, and smaller companies don’t have a lot of money, so they get bad results or bad hackers, very junior. And with this model, you only paid for valid vulnerabilities, and with a network of, at the moment, more than 2,000 hackers goes to find new vulnerabilities and you only pay per results. So this allows the companies to get better results, paying a little bit more, not less, but it’s not that big of a difference,” Zarruck added.
Hackers at Secur0 also benefit as they are incentivized to find more vulnerabilities. This further strengthens collaboration among the platform, its hackers, and the clients they work for.
Zarruk explained: “Yes, I think that’s one of the best things for us, because nothing is fixed cost for us, so we just charge a percentage of the vulnerability that some percentage goes to the hacker, some percentage goes for us for being the platform that handles the vulnerability, and in the two ways, we have the positive impacts for the hackers, because we only win when they win, so we make them win, we encourage them to find more vulnerabilities, and as well as the company, because if we don’t find anything, we don’t charge them, so if we don’t deliver, the company is safe on that side.”
Resilience Is a Leadership Decision
Cybersecurity leaders have already realized resilience isn’t purchased; it’s practiced. Whether through intelligence-informed risk management, framework adoption, disciplined tabletop exercises, or governance integration, organizations best positioned to survive a breach are those that decided, before the breach happened, that security is a leadership priority, not a technology problem.
