Resilience starts before an attack
Even organizations with mature, sophisticated security controls can be successfully attacked. For that reason, resilience is less about avoiding every attack than about continuing to operate when safeguards are compromised. Much of that depends on decisions made long before an incident.
For multinationals, those decisions carry an added layer of complexity. Regulatory expectations around cyber resilience continue to expand and diverge between jurisdictions. The infrastructure on which a business runs may be global, but accountability to regulators remains local. Structures that work across the business also need to meet the expectations of authorities in different markets.
Rather than survey every regime, this series uses developments in key markets around the world to show where expectations are heading. The same shifts are visible in many other jurisdictions, and the patterns described are likely to apply well beyond the examples given.
The cost of disruption is rising
The financial consequences of a serious incident can be considerable. The average data breach now costs businesses almost USD5 million, and more than twice that (USD11.5m) in the United States. However, the most significant costs often come from interrupted operations, unfulfilled sales, customer churn, and reputational damage as a result of encryption events. When IBM asked organizations that had reported an attack in 2026 whether they had recovered completely, fewer than half (42%) said they had.
That exposure does not stop at an organization’s own systems. Big businesses depend on extensive networks of suppliers (including cloud providers, software vendors, and outsourcing partners) that can span dozens of jurisdictions. The World Economic Forum reports that 65% of large enterprises see third-party and supply chain vulnerabilities as their greatest challenge in building cyber resilience. A single compromised supplier can affect many of its customers at once.
Attacks are also getting faster. CrowdStrike reports an 89% increase in attacks by adversaries it classes as AI-enabled. Once inside, attackers take an average of 29 minutes to move beyond the first system they compromise. More often than not, the way in is through people and accounts rather than technical flaws.
Palo Alto Networks found that in 65% of its incident response cases, initial access came through identity-based techniques such as social engineering and the misuse of legitimate credentials. An attacker using a genuine account can look much like an ordinary user. The result is less warning and less time for executives to make their first decisions, which puts more weight on what is already in place before an attack begins.
Regulators are asking harder questions
These conditions have changed the questions boards and management teams face in relation to cyber risk. The focus is increasingly on what happens if an attacker gets through, a critical supplier is hit, or essential systems have to be taken offline.
Authorities are focused on similar issues; a growing number of regulatory regimes look at how businesses would get back up and running after an attack and how their boards exercise oversight, rather than only assessing the quality of preventative controls. The detail differs between jurisdictions, but the principles are broadly consistent.
Pressure on individuals is intense during a live incident
In a live incident, these questions stop being hypothetical and they tend to arrive together. The same individuals trying to contain the attack and keep the business running are often also explaining what has happened to regulators, law enforcement officials, customers and suppliers, each of whom will have different concerns. Often the attacker is in contact, too. Those tasked with the response may also be doing so without email or their usual communications channels, and before it is clear who has the authority to make which decisions.
Choices made in those first hours, often before the facts are known, may be examined for months or years afterwards. Forensic teams need evidence preserved at the same moment the business needs its systems back. The people leading the technical response may be working 18 hours at a time, sometimes for several days or weeks in a row. Leaders are often asked to place their trust in specialists they have never met at one of the most difficult moments of their professional lives. Complete certainty rarely arrives, so the practical question is usually what level of assurance is enough to act on.
The organizations that find this hardest are rarely unprepared. Most have governance structures and plans in place. The difficulty lies in putting those arrangements into practice when systems are down, information is incomplete and each choice may later be examined with the benefit of hindsight.
Legal questions must be answered from the start
Legal questions tend to materialize just as quickly. For listed companies, the incident itself may be information that the market needs to know. In the UK, for example, the Financial Conduct Authority has said it “may be prudent to begin from the assumption” that information about a cyber incident could be inside information.
In the U.S., a material cyber incident must generally be disclosed within days of the company determining that it is material. Privilege and evidence matter from the outset because an incident can lead to regulatory enforcement, data protection claims, commercial litigation, insurance coverage disputes, and shareholder actions. In each, what a business said about its governance and cyber defenses before the incident may be revisited.
Test the plan under pressure
War-gaming exercises are often where these pressures are first felt, although no dry run can fully recreate a real incident. A short annual session can confirm that a plan exists without showing whether it works when systems are down for days rather than hours.
Regulators increasingly expect exercises that go further, with senior leadership involved and lessons fed back into plans. The most useful simulations are run by people with direct experience of live incidents and recreate the conditions leaders are likely to face. Making sure the chosen facilitator truly has that first-hand experience is therefore critical.
Ultimately, no single control, plan, or governance structure provides the answer. Resilience shows itself across the full life cycle of an incident, from the preparation undertaken before an attack to the first hours of the response, the way recovery is managed and how an organization responds to scrutiny.
In the articles that follow we will look at each of these stages in turn, drawing on what we see repeatedly across our work on the front line of incident response.
