As Artificial Intelligence reshapes both cyberthreats and cyberdefence, security leaders including Justin Henkel, CISO at SolarWinds; John Bruce, CISO at Quorum Cyber; Joseph Rooke, Director of Risk Insights at Recorded Future’s Insikt Group; Tom Burton, vCISO Associate at Cyberhash; Jason Manar, CISO at Kaseya; Chris Cochran, Field CISO at SANS Institute; Ellen Benaim, CISO at Templafy; Mike Riemer, Senior Vice President, Network Security Group and Field CISO at Ivanti; Attila Török, CISO at GoTo; Patricia Titus, Field CISO at Abnormal AI; Adam Dimopoulos, CISO at Entrust; John Podboy, CISO at Semperis; Mandy Andress, CISO at Elastic; Martin Kraemer, CISO Advisor at KnowBe4; Richard Ford, CTO at Integrity360; Shane Read, CISO at Goldilock Secure; Dom Glavach, CISO at Black Duck; Jack Thompson, Field CISO at Cynomi; Erika Dean, CISO at Tricentis; Clayton Peddy, CISO at ABBYY; Andy Grayland, CISO at Silobreaker; Jonathan Nguyen-Duy, CTO at Arqit; and Brad Bowers, Lead Field CISO Global at SHI, explain why the next generation of cyber-resilience depends less on preventing every breach and more on building resilient organisations through visibility, identity security, Zero Trust, trusted software, governance and continuous preparedness.
For years, organisations measured success by the strength of their defences and their ability to prevent attacks. Today, security leaders increasingly accept that breaches are inevitable. The question is no longer whether attackers will gain access but whether organisations can continue operating while under attack and recover before disruption becomes a business crisis.
Artificial Intelligence is accelerating this shift. Threat actors can identify vulnerabilities faster than ever, automate phishing campaigns, exploit identities at machine speed and compress the time between vulnerability disclosure and active exploitation from weeks to hours. At the same time, organisations are embracing AI, expanding cloud estates, deploying autonomous agents and becoming more dependent on increasingly complex digital ecosystems.
Against that backdrop, cyber-resilience is becoming less about individual security controls and more about organisational readiness. Technology remains vital, but the organisations that emerge strongest will be those that understand their business, continuously manage risk and prepare for disruption before it occurs.
Prevention alone is no longer enough
Perhaps the biggest shift is one of mindset.
Justin Henkel, CISO at SolarWinds, believes organisations must stop measuring resilience by the number of attacks they prevent.
“If you’ve worked in cybersecurity long enough, you know no organisation is completely immune from attack,” he said: “For me, the next generation of cyber-resilience is not about preventing every incident. It is about how quickly you can identify a problem, contain it, keep critical services running and recover with confidence.”
John Bruce, CISO at Quorum Cyber, argues that boards are beginning to recognise the same reality.
“For years, cyber-strategy has been built around a flawed premise: that with enough investment in prevention, breaches can be stopped at the perimeter,” he said.
Instead, directors are beginning to ask a different question.
“‘How quickly can we get back up if we’re not?'”
Bruce believes that change should redirect investment towards recovery readiness, tested backups and rapid detection rather than continually adding another preventative layer.
Joseph Rooke, Director of Risk Insights at Recorded Future’s Insikt Group, has also seen resilience move beyond the security team.
“Rather than asking, ‘can we stop a breach?’, CISOs are prioritising strategies and plans for keeping operations running when a breach is happening.”
As a result, cyber-resilience has become a boardroom issue spanning business continuity, insurance, supply chains, dependency mapping and contingency planning.
Tom Burton, vCISO Associate at Cyberhash, believes Artificial Intelligence makes this evolution unavoidable.
“My preferred phrase from that report is ‘assume breach’,” he said, referencing the UK National Cyber Security Centre’s latest annual review.
However, Burton believes organisations should go one stage further.
“Because of the acceleration of AI, I believe that the next generation of cyber-resilience is based on an updated principle called ‘Assume breach, assume vulnerabilities’.”
Once attackers gain an initial foothold, organisations should assume they will rapidly identify and exploit every available weakness. Resilience therefore depends on segmentation, Zero Trust, contingency planning and operational visibility rather than perimeter security alone.
Understanding what really matters
If attacks are inevitable, resilience starts with identifying the business services that matter most.
Jason Manar, CISO at Kaseya, believes too many organisations focus on technology before understanding the business processes they are trying to protect.
“The next generation of cyber-resilience won’t be defined by what you buy,” he said. “It will be defined by how well you understand the services your business cannot lose, everything they depend on, and how you keep them running the day something goes wrong.”
Drawing on his experience, Manar recalled helping investigate an incident in which an organisation transferred millions of dollars to criminals following what appeared to be a legitimate executive request.
“There was no malware or security hurdle to overcome. The attackers used the path money already travels.”
The organisation had never mapped that business process.
“Nobody had ever mapped that path, so nobody was defending it.”
For Manar, resilience starts by identifying where the organisation would suffer most if operations stopped.
“Start where the money moves, or wherever your business would bleed first.”
Security leaders should then identify every dependency supporting that critical service.
“Build the dependency map for that one service: not just the systems, but identities, suppliers and the people who make the calls.”
Although dependency mapping is rarely straightforward, particularly in organisations with legacy technology and competing priorities, Manar believes the effort pays dividends.
“The work is unglamorous and hard.”
“Resilience isn’t a product you buy; it’s a discipline you keep.”
Chris Cochran, Field CISO at SANS Institute, agrees that resilience depends on mastering the fundamentals.
“The next generation of cyber-resilience will be defined by how well organisations execute on the fundamentals.”
That begins with understanding assets, identities and third-party dependencies before moving to risk-based vulnerability management and well-rehearsed incident response.
“You cannot protect what you don’t know you have.”
Ellen Benaim, CISO at Templafy, believes many organisations still struggle with those same fundamentals despite increasingly sophisticated threats.
“What will define the next generation of cyber-resilience isn’t yet another new technology, but getting the basics right at the speed the threats demand.”
Maintaining accurate asset inventories, enforcing access controls and patching vulnerabilities remain difficult for many organisations, yet the shrinking window between disclosure and exploitation has made those disciplines more important than ever.
“The cost of getting those basics wrong has gone up substantially because the time between a vulnerability existing and someone exploiting it has collapsed from weeks to hours.”
AI is accelerating both sides of the battle
While our contributors consistently stressed the importance of strong fundamentals, they also agreed that Artificial Intelligence is fundamentally changing the pace of cybersecurity.
Mike Riemer, Senior Vice President, Network Security Group and Field CISO at Ivanti, believes traditional patch management is struggling to keep pace.
“AI is accelerating the discovery and exploitation of vulnerabilities, with threat actors now able to reverse engineer a patch within hours.”
He warned that security teams are facing what many describe as a ‘Patch Apocalypse’, with critical updates arriving faster than many organisations can deploy them.
Rather than relying on static severity ratings, Riemer argued that resilience increasingly depends on continuous visibility, risk-based prioritisation and autonomous remediation.
“Attackers are already operating at machine speed. Defenders need the intelligence and tools to know what to fix first and the automation to act before it’s too late.”
Attila Török, CISO at GoTo, sees a similar future.
“The next generation of cyber-resilience will be defined by three things: machine-speed incident detection and response, patching instantly instead of in weeks or months, and true Zero Trust that is designed for breach.”
He believes organisations should automate wherever possible while ensuring Artificial Intelligence itself is introduced with appropriate governance and secure-by-design principles.
Patricia Titus, Field CISO at Abnormal AI, also views AI as both the greatest challenge and one of the strongest defensive opportunities.
“What protected organisations yesterday won’t be enough tomorrow.”
Rather than replacing security professionals, she believes AI should automate repetitive investigations, reduce alert fatigue and allow analysts to focus on the highest-risk threats.
“The most resilient enterprises will be those that view AI as a force multiplier for their security teams, not a substitute for them.”
Benaim believes organisations face what she describes as an AI paradox.
“The thing that could save you is also the thing you’re trained to distrust.”
Security teams recognise AI’s potential to strengthen defence, yet every deployment introduces new governance challenges. Organisations that successfully balance innovation with sensible guardrails, she argued, will gain an advantage over those waiting for perfect certainty before adopting AI.
Identity becomes the new frontline
If there is one area where contributors see cyber-resilience evolving most rapidly, it is identity.
For years, organisations concentrated on protecting networks and endpoints. Increasingly, however, attackers are bypassing traditional defences by exploiting legitimate credentials, compromised accounts and the growing population of machine identities operating across enterprise environments. As AI agents become embedded within business processes, contributors believe identity will become the defining battleground of cyber-resilience.
Adam Dimopoulos, CISO at Entrust, argued that while AI-driven attacks, software supply chain risks and emerging cryptographic threats all present significant challenges, identity remains the common thread linking them.
“The next generation of cyber-resilience will be shaped by a convergence of risks, from AI-driven attacks and software supply chain exposure to emerging cryptographic threats. But what consistently determines the real-world impact for these risks is often identity.”
He warned that identity sprawl is already a significant challenge and will accelerate as organisations deploy increasing numbers of AI agents and other non-human identities.
“Getting a handle on all your identities, whether human, non-human, or agentic will be foundational.”
Traditional authentication methods also need to evolve.
“Passwords still sit at the centre of too many environments,” Dimopoulos said, arguing that phishing-resistant authentication, passkeys and continuous verification should become standard practice.
John Podboy, CISO at Semperis, believes organisations have underestimated how quickly AI is changing identity management.
“AI is changing the way businesses operate and cybersecurity has to adapt just as fast.”
Many organisations grant AI agents broad permissions so they can perform useful work but fail to revisit those privileges afterwards.
“The risk is that AI is being placed too close to sensitive identity infrastructure with little preparation for the potential consequences.”
If compromised, those agents could gain privileged access to critical identity platforms.
“With access to these Tier-0 systems, attackers have the keys to the kingdom.”
Rather than treating AI agents as extensions of human users, Podboy believes organisations must recognise them as an entirely new category of identity.
“It’s important that organisations treat agents explicitly as non-human identities (NHIs) in the identity fabric.”
Mandy Andress, CISO at Elastic, reached a similar conclusion.
“The next generation of cyber-resilience won’t be defined by how well organisations secure their people alone. It will be defined by how well they secure the AI agents now acting alongside them.”
As organisations deploy increasing numbers of autonomous systems, she believes security teams face fundamental questions they currently struggle to answer.
“What agents exist and where are they running? What can they access? What actions can they take? Who is accountable for them?”
Without that visibility, organisations cannot hope to govern AI safely.
“The priority for CISOs is clear: establish continuous visibility before pursuing autonomous security.”
Martin Kraemer, CISO Advisor at KnowBe4, believes this transformation extends beyond technology.
“The key to resilience is building trust into a digital workforce to behave securely.”
As employees increasingly supervise teams of AI agents rather than carrying out tasks themselves, governance models based solely on human oversight will become less effective.
“Organisations must find holistic governance and risk management solutions to reap the benefits of AI and maintain trust with their workforce.”
Visibility becomes the foundation of resilience
Identity is only one part of a broader challenge.
Throughout the discussion, contributors argued that resilience depends on understanding technology environments as they change, not simply documenting them periodically.
Richard Ford, CTO at Integrity360, believes visibility should become every CISO’s first investment.
“You cannot protect assets you don’t know exist, whether that’s cloud services, machine identities, AI agents, third-party integrations or legacy systems.”
As businesses expand across cloud platforms and interconnected services, resilience can no longer depend on periodic assessments.
“The result is an environment where exposure changes continuously.”
Instead, Ford argued, resilience itself must become ‘a continuous discipline’.
Justin Henkel also placed visibility at the heart of resilience planning.
“Visibility and observability should be among the first areas CISOs invest in.”
Security teams need visibility not only across networks and applications but also identities, cloud platforms, third-party dependencies and business-critical services.
“They also need the business context to understand what matters most and where an issue could have the greatest impact.”
Chris Cochran believes comprehensive asset management remains one of cybersecurity’s most important disciplines.
“You cannot protect what you don’t know you have.”
Maintaining accurate inventories of hardware, software, data and third-party relationships provides the foundation for understanding an organisation’s attack surface.
Benaim echoed that point, arguing that many organisations still struggle with surprisingly basic security practices.
“Simple things like knowing what assets they have, patching known vulnerabilities in time, enforcing basic access controls.”
Without those foundations, she warned, more advanced technologies provide little benefit.
Building resilience into the architecture
While visibility provides understanding, several contributors argued that resilience ultimately depends on designing infrastructure capable of containing attacks when preventative controls fail.
Shane Read, CISO at Goldilock Secure, believes organisations should look beyond software controls alone.
“The next generation of cyber-resilience will be measured by how effectively organisations continue operating when attacks inevitably occur.”
As AI accelerates the speed of compromise, resilience must increasingly be engineered into infrastructure through multiple layers of protection.
Read believes Deep segmentation should become a strategic priority.
“By extending security beyond software-defined controls and enforcing boundaries at the infrastructure layer, organisations gain deterministic control over critical connectivity.”
Even if privileged credentials or management platforms are compromised, those physical boundaries continue limiting attacker movement.
“This creates enforceable boundaries around their most critical assets.”
Tom Burton also considers segmentation fundamental.
“If you have to choose one place to start investing. Start with segmentation.”
He acknowledges that implementing effective segmentation is rarely simple.
“It’s hard, time-consuming and foundational.”
However, Burton argues that segmentation should sit alongside Zero Trust, continuous patching, contingency planning and improved situational awareness.
“Segmentation without Zero Trust is little more than an expensive flat network.”
Attila Török similarly believes organisations should “design networks for breach rather than assuming it can be prevented, so that any compromise is contained to something small.”
Rather than trying to build impenetrable defences, the objective is to contain attacks before they become business crises.
Continuous assurance replaces periodic reviews
As attacks accelerate, contributors consistently argued that annual audits and periodic assessments are no longer sufficient.
Dom Glavach, CISO at Black Duck, believes resilience is increasingly defined by speed.
“The next generation of cyber-resilience will be defined by speed: how fast an organisation can move from risk identified to acting decisively.”
That requires more than technology.
“The first investment for CISOs is the resilience operating model.”
Risk ownership, governance, escalation procedures and executive decision-making must evolve alongside technical capabilities.
Only then should organisations expand visibility across identities, cloud environments, software supply chains and third-party ecosystems while introducing AI-driven automation.
“Lastly, test it.”
Executive simulations and technical exercises, Glavach argued, transform resilience from an aspiration into an operational capability.
Mike Riemer also believes continuous operations must replace reactive security.
Rather than relying on vulnerability scores alone, organisations require continuous risk prioritisation based on exploitability, threat intelligence and business impact.
Jack Thompson, Field CISO at Cynomi, believes proactive verification fundamentally changes security operations.
“Continuous verification of your environment reduces the volume of alerts that need human eyes.”
Combined with User Behaviour Analytics, organisations can improve detection quality while reducing alert fatigue.
The message from our contributors is consistent: resilience is no longer something organisations assess annually but a capability they continuously measure, validate and improve.
Software resilience becomes business resilience
While much of the cyber-resilience conversation centres on attackers, identities and infrastructure, several contributors argued that organisations also need to rethink how they build, validate and trust the software and data driving every business process.
Erika Dean, CISO at Tricentis, believes Artificial Intelligence is fundamentally changing software development and creating a new balance between speed and assurance.
“Cyber-resilience has always required the management of both internal and external risks,” she said: “What has changed is the speed at which AI is enabling software to be created, and the difficult subsequent trade-offs between speed and assurance this creates.”
As AI coding tools become widely available, software development is expanding beyond traditional engineering teams, creating new risks when inexperienced users generate production code without fully understanding secure development practices.
Dean noted that enterprise applications are increasingly custom-built, yet software quality processes have failed to keep pace with AI-assisted development.
For CISOs, that reinforces the importance of embedding security throughout the software development lifecycle rather than relying on testing at the end of a project.
“As AI accelerates software delivery, security and software quality can no longer operate as separate disciplines.”
Clayton Peddy, CISO at ABBYY, believes organisations must also rethink where cyber-resilience begins.
Rather than focusing exclusively on endpoints and networks, businesses should pay closer attention to the information entering their systems.
“The next generation of cyber-resilience won’t be defined solely by stronger perimeter defences or faster incident response. It will be defined by an organisation’s ability to trust the data flowing into its business before automated decisions are made.”
As financial institutions and other organisations automate document processing, manipulated files can contaminate fraud detection, compliance processes and business analytics before conventional security controls detect a problem.
“The answer isn’t simply deploying more AI,” Peddy said: “It’s investing in purpose-built AI designed for document intelligence and authenticity verification.”
By validating documents before they enter automated workflows, organisations create what he describes as “a trusted foundation for every downstream security control.”
Intelligence moves beyond cybersecurity
Another clear theme emerging from our contributors is that cyber-resilience increasingly depends on understanding risks extending beyond traditional cybersecurity.
Andy Grayland, CISO at Silobreaker, believes organisations need to broaden both the scope and audience of threat intelligence.
“The next generation of cyber-resilience will not be defined by better firewalls or faster detection. It will be defined by intelligence scope.”
Many cyberthreat intelligence programmes remain heavily focused on indicators of compromise, threat actor tactics and vulnerability data.
While valuable, Grayland argued that this provides only part of the picture.
“Nation-state actors do not choose one domain; they operate simultaneously across cyber, physical and geopolitical space.”
Political developments, economic sanctions, supply chain disruption and geopolitical tensions frequently provide early indicators of future cyber-campaigns.
For that reason, he believes resilience depends on combining intelligence from multiple disciplines and ensuring it reaches decision-makers beyond the security team.
“Cyber-only intelligence is a cost centre. Business risk intelligence is a strategic asset.”
Joseph Rooke also believes resilience depends on understanding today’s threat landscape rather than yesterday’s.
“There’s little point in CISOs dwelling on what cyberthreats they caught last year or even last month.”
Testing and exercising incident response plans should instead reflect the techniques adversaries are using now.
“They need to know what adversaries are doing this week or they risk testing becoming outdated and building cyber-resilience on foundations of sand.”
Threat intelligence, he argued, enables organisations to reduce exposure before attacks occur while helping security teams prioritise the risks that matter most.
Preparing for tomorrow’s cryptographic challenge
Although Artificial Intelligence dominates today’s security agenda, several contributors warned that organisations must not lose sight of another major technology transition already approaching.
Jonathan Nguyen-Duy, CTO at Arqit, believes Quantum Computing will redefine resilience planning over the coming decade.
“The next generation of cyber-resilience will be defined by whether organisations can maintain operations in the face of traditional and emerging cyberthreats, while keeping pace with new developments in quantum technology.”
Many organisations continue to struggle with cyber-fundamentals such as multi-factor authentication and Zero Trust, yet Nguyen-Duy believes they must also begin preparing for Q-Day, when quantum computers become capable of breaking current encryption standards.
“The first investment they must make is one to improve crypto visibility and control.”
Without understanding where cryptography exists throughout their environments, organisations cannot develop effective post-quantum migration strategies.
Patricia Titus also believes Quantum Computing should already feature in resilience planning.
Looking beyond today’s AI-powered attacks, she argued organisations should begin identifying where cryptography is used, engaging suppliers on their quantum readiness and developing long-term migration strategies before the technology matures.
Technology alone will never deliver resilience
Despite discussing Artificial Intelligence, Zero Trust, software supply chains and Quantum Computing, contributors repeatedly returned to one conclusion: cyber-resilience is ultimately a people and governance challenge.
Brad Bowers, Lead Field CISO Global at SHI, believes resilience extends well beyond an organisation’s ability to recover from breaches.
“It’s important that the industry doesn’t just define resiliency as the ability to recover from data breaches.”
Instead, organisations must continue strengthening cyber-hygiene, employee awareness, incident response planning and third-party risk management while ensuring AI itself operates transparently and under appropriate governance.
“The future of cyber-resiliency will require a collaborative approach.”
Martin Kraemer also believes trust will become one of the defining challenges of the AI era.
“The key to resilience is building trust into a digital workforce to behave securely.”
As organisations increasingly supervise AI agents rather than carrying out every task manually, governance models based solely on human oversight will become increasingly difficult to sustain.
“Organisations must find holistic governance and risk management solutions to reap the benefits of AI and maintain trust with their workforce.”
Chris Cochran believes investing in people remains just as important as investing in technology.
“Burned-out, under-resourced teams can’t sustain resilience no matter how good the tools are.”
He argued that communication, rehearsed incident response, risk-based decision-making and continual skills development remain among the strongest indicators of a resilient organisation.
Building resilience before the crisis
Although contributors approached cyber-resilience from different perspectives, they consistently described a future where security becomes inseparable from business strategy.
Artificial Intelligence is accelerating both attack and defence. Identity is replacing the traditional network perimeter. Continuous visibility is overtaking periodic assessments. Software quality, trusted data, threat intelligence and Quantum Computing readiness are all becoming integral components of resilience planning.
Yet perhaps the strongest message is that resilience cannot be purchased as a product.
Whether discussing dependency mapping, software assurance, Zero Trust, identity governance, segmentation, threat intelligence or executive decision-making, our contributors consistently emphasised preparation over reaction.
As Jason Manar observed: “The only choice is whether that happens now, on a whiteboard, or at 2am, mid-incident, with the wire already sent.”
The organisations that will define the next generation of cyber-resilience will not necessarily be those that prevent every attack. They will be those that understand their business, continuously adapt to changing risks, rehearse for disruption and recover with confidence when the inevitable incident occurs.
Increasingly, cyber-resilience is becoming a defining measure of organisational maturity in an AI-driven world.
