In today’s rapidly evolving digital landscape, cyber resilience is a priority for organisations of all sizes. With increasingly sophisticated threats and infrastructure becoming ever more complex, achieving true resilience requires a strategic, proactive approach.
But what exactly is cyber resilience? Zscaler’s new research defines cyber resilience as an organisation’s ability to maintain operational continuity in the face of needing to respond to or contain a cyber incident within its systems or networks.
Currently, only 49% of global IT leaders believe their IT infrastructure is highly resilient. With 60% of IT leaders expecting their organisation to experience a significant failure scenario within the next 12 months – and 45% saying their organisation experienced one within the last six months – there is a clear need for action. So, how can IT leaders improve their organisation’s cyber resilience?
One of the first challenges organisations face is identifying their own blind spots. “There seems to be a dual mindset, where many organisations feel they are very resilient, but also recognise the need to be more resilient,” explains Zscaler CISO, James Tucker, who warns this confusion often stems from a limited overview of resilience.
“A lot of people measure resiliency in terms of whether any systems have broken or if the organisation has experienced a breach. But the absence of that does not mean they’re as resilient as they should be,” he says. As 40% of IT leaders admit to not having reviewed their cyber resilience strategy in the last six months, organisations are well advised to take action.
Regions vary in their approach to cyber resilience
One of the key insights from Zscaler’s research on cyber resilience is the notable differences in approach across various regions.
“Traditionally, the US tends to be quicker to adopt new approaches that have proven to be effective,” says Tucker. In contrast, in Europe there is often a more cautious, evaluative approach and more rigidity once a decision has been made.
“If someone who assessed a solution very carefully 10 years ago decided to go for a VPN-based solution, it’s highly likely they would still be convinced that they made the right decision at that point in time,” he explains.
The tendency to stick with established solutions, even as the landscape evolves, can make it challenging to drive change
The tendency to stick with established solutions, even as the landscape evolves, can make it challenging to drive change. This regional variation is further compounded by the role of regulation. “Regulated resilience happens in Europe much more than in other countries around the world,” says Tucker.
The resulting influx of guidelines and standards from governing bodies can slow down the adoption of new technologies. Organisations must prioritise compliance over innovation, especially when resources are limited, making it challenging to pursue both strategies simultaneously.
“In Europe, we tend to be the leaders in rule adherence and risk-averse decision-making, and the rest of the world does emulate it,” says Tucker. “But we also tend to be a little less willing to take a chance when it comes to ripping out the default setting and running with something new.”
However, Tucker also highlights that there are numerous examples within Europe of companies that have successfully navigated this transformation, achieving significant benefits in terms of security outcomes and cost savings. The key, he suggests, is to challenge the status quo and embrace a more proactive, offensive stance when it comes to cybersecurity resilience.
Framework-based approach
But this required change in approach is about much more than just proactivity. The reality is that resilience is a multi-faceted concept, encompassing architectural, cyber and organisational elements. Failing to consider all these dimensions can leave critical blind spots unaddressed.
To overcome this challenge, Tucker recommends that organisations adopt an objective, framework-based model to assess their resilience posture. By aligning to an established standard like the NIST Cybersecurity Framework, organisations can gain a more comprehensive and impartial view of their strengths, weaknesses and areas for improvement.
But to become truly resilient, cyber resilience strategies and the approaches organisations take cannot remain siloed - or an afterthought. IT leaders must approach cyber resilience holistically, making it a vital part of an organisation’s wider resilience strategy and involving more people in the decision-making process.
Organisations need to combine the traditionally separate disciplines of networking and security, as this cohesion is imperative in a cloud-based world. This is currently not the reality with less than half of organisations (44%) even involving their CISO, for example, in resilience planning.
Here, we outline three key steps organisations should follow to fortify their cyber defences and become resilient by design:
Reduce current infrastructure complexity
According to Zscaler’s survey results, the number one barrier to organisations becoming more cyber resilient is the complexity of their IT and security infrastructure.
“The more complex an organisation’s IT infrastructure is, the harder it is to maintain resilience,” says Tucker. Legacy systems, overlapping security tools and convoluted data flows create unnecessary failure points and make it difficult to pinpoint vulnerabilities.
By simplifying the architecture – streamlining connectivity, consolidating security solutions and minimising attack surfaces – organisations can dramatically improve their ability to prevent, detect and respond to cyber incidents.
(Re)architect for resilience
In a modern, distributed environment where users and assets are everywhere, a cyber resilience strategy must combine robust prevention, detection, containment and recovery capabilities. This requires rethinking the network and security design from the ground up.
As Tucker notes, “There is no way to simply wave a magic wand and say ‘we’re zero trust.’” However, key elements include implementing zero trust access, micro-segmenting an environment to limit the blast radius of any attack and ensuring seamless failover between systems. The goal is to create an infrastructure that can withstand disruption and maintain operational continuity, even in the face of a breach.
Shift from defence to offence
Cyber resilience is not just about building stronger walls – it also requires a proactive, offensive mindset. “Rather than passively waiting for threats to materialise, organisations must take a more dynamic, threat-hunting approach,” says Tucker.
This means constantly evaluating the evolving risk landscape, identifying potential attack vectors, and implementing controls to stay one step ahead of adversaries. Achieving true cyber resilience is an ongoing journey, not a one-time project.
This means empowering security teams to challenge the status quo and drive continuous improvement. As Tucker says, “You are never done with security, you have to keep evolving.”
By following these three steps – reducing complexity, re-architecting for resilience and adopting a more offensive security posture – organisations can build the agility and adaptability needed to withstand even the most sophisticated attacks and to bounce back without costly downtime.
To learn more about the state of cyber resilience and the key findings from Zscaler’s latest research, download the full report here.
In today’s rapidly evolving digital landscape, cyber resilience is a priority for organisations of all sizes. With increasingly sophisticated threats and infrastructure becoming ever more complex, achieving true resilience requires a strategic, proactive approach.
But what exactly is cyber resilience? Zscaler’s new research defines cyber resilience as an organisation’s ability to maintain operational continuity in the face of needing to respond to or contain a cyber incident within its systems or networks.
Currently, only 49% of global IT leaders believe their IT infrastructure is highly resilient. With 60% of IT leaders expecting their organisation to experience a significant failure scenario within the next 12 months – and 45% saying their organisation experienced one within the last six months – there is a clear need for action. So, how can IT leaders improve their organisation’s cyber resilience?
