The evidence of the past decade has made this assumption untenable. The question for modern security leadership is not whether a serious incident will occur, but whether the organization has built the capability to absorb it, contain it, and recover from it without catastrophic operational or financial consequences.
“Prevention alone is a strategy that assumes you will always win,” says Guerassim Nikolov, entrepreneur and enterprise security advisor with more than twenty years in cybersecurity strategy. “Resilience is what you build for the assumption that eventually, you won’t. The organizations that recover well aren’t the ones with the most sophisticated defenses – they’re the ones that have practiced what happens when those defenses fail.”
The Colonial Pipeline ransomware attack of May 2021 illustrated what inadequate resilience looks like in practice. DarkSide ransomware – introduced through a compromised VPN account that lacked multi-factor authentication – encrypted critical billing and operational systems. Colonial Pipeline halted all pipeline operations as a precautionary measure, cutting off approximately 45% of the East Coast’s fuel supply for several days. The company paid a ransom of $4.4 million in Bitcoin within hours. Even after receiving the decryption key, restoring full operations took additional days, and the disruption triggered emergency declarations across seventeen states.
Support authors and subscribe to content
This is premium stuff. Subscribe to read the entire article.
