Cyber resilience: why protection is no longer enough

Cyber resilience is an organisation's ability to keep operating during a cyberattack, recover quickly and come out stronger. The term is now everywhere, from European law to boardroom speeches. It captures something true: nobody can promise any more that no attack will get through. But it has its critics too, who sometimes see it as a convenient way to give up on proper protection. Here is what the idea covers, why it has taken hold and where its limits lie.

NIST, the US National Institute of Standards and Technology, defines cyber resilience as the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that rely on digital resources. Its SP 800-160 publication adds an important point: this ability is built on the assumption that the environment is contested, in other words that an adversary may already be inside.

The UK's National Cyber Security Centre says much the same thing. Its Cyber Assessment Framework devotes a whole objective, objective D, to minimising the impact of incidents: having capabilities that limit an incident's effect on essential functions, with well-defined and tested incident management processes to ensure continuity.

Two distinctions help:

• Cyber security and cyber resilience. Classic cyber security mainly aims to prevent incidents. Cyber resilience includes it and asks the next question: what happens when protection fails?
• Business continuity and cyber resilience. A business continuity plan covers every cause of disruption, from fire to pandemic. Cyber resilience focuses on digital threats but goes beyond recovery: it includes anticipation beforehand and adaptation afterwards.

The word is now in the law

In Europe, resilience is no longer a slogan but an obligation. The DORA regulation, applicable since 17 January 2025, is explicitly about the "digital operational resilience" of the financial sector: banks, insurers and asset managers must be able to withstand, respond to and recover from ICT disruptions. The NIS 2 directive lists among mandatory measures business continuity, including backup management and disaster recovery, as well as crisis management; in France it is being transposed through the resilience bill. As for the Cyber Resilience Act, it carries the word in its very name and sets security requirements for digital products.

The threat leaves no choice

The 2025 threat overview published by ANSSI, the French national cyber security agency, on 11 March 2026 counts 3,586 security events handled, including 1,366 incidents. Education and research account for 34% of victims, ahead of ministries and local authorities (24%) and healthcare (10%). The agency notes that state-linked actors are pre-positioning themselves in networks, targeting edge devices in particular, and urges organisations to apply the baseline measures of NIS 2 and the CRA without delay. At European level, ENISA analysed nearly 4,900 incidents between July 2024 and June 2025, according to Security Affairs: hacktivism, mostly denial-of-service attacks, makes up around 80%, but ransomware remains the most damaging threat.

French news bears this out. On Saturday 17 October 2026, around twenty French organisations were claimed by attackers in a single day, Solutions Numériques reports, while denial-of-service attacks hit the websites of the family benefits agency (CAF), ANSSI and several large cities. For an organisation, the question is no longer just "how do we avoid the attack?" but also "how do we keep serving customers and users while it is happening?".

Companies absorb attacks better, but are still hit

The 2025 barometer of CESIN, the French association of information security experts, shows progress: 40% of companies surveyed report at least one significant successful attack, down from 47% the year before and 49% in 2023. But among them, 81% report an impact on their business, with data theft in 52% of cases and production disruption in 28%. Better protection reduces the number of incidents; it does not remove their consequences.

Cyber resilience is almost universally endorsed, which is precisely a reason to look at it closely. Four criticisms come up often.

1. An excuse to give up on prevention

"We will be attacked anyway" can become an excuse for not fixing flaws or hardening access. That would be a misreading. ANSSI's overview urges organisations to apply baseline measures first, and ENISA counts vulnerability exploitation among the main ways in, at 21% of intrusions, behind phishing (60%). Resilience comes on top of protection, it does not replace it. Rigorous vulnerability management and an architecture that limits an attacker's movement, in the spirit of the zero trust model, directly reduce how deep the fall goes.

2. A buzzword that covers everything

Backups, disaster recovery, crisis management, insurance, detection: everything is sold under the "resilience" label today. The risk is that the word is used to repackage old projects without changing anything. The remedy is simple: ask for evidence. A backup that has never been restored, or a crisis plan never rehearsed, makes nobody resilient.

3. Too technical a view

Three security studies researchers, Myriam Dunn Cavelty, Christine Eriksen and Benjamin Scharte, published a useful critique in the Journal of Risk Research in 2023: cyber resilience is often framed as a technical problem with humans added on. They suggest the reverse, seeing it as a social problem that technology helps address. In practice, the ability to get through a crisis depends first on the people who decide, communicate and improvise, hence the importance of security awareness and exercises.

4. An uneven burden depending on size

The World Economic Forum's Global Cybersecurity Outlook 2026, based on 804 leaders in 92 countries, finds that small organisations are about twice as likely as large ones to report insufficient resilience. And 65% of large companies cite third parties and the supply chain as their biggest barrier to resilience, up from 54% a year earlier. In other words, you can be highly resilient in-house and still fall because of a supplier, as supply chain attacks show.

A caveat: respond without panicking

Being resilient also means keeping a cool head. Vincent Strubel, director general of ANSSI, pointed out in March 2026, according to Solutions Numériques, that there is "a lot of bluff" behind some data theft claims. For the 17 October wave, most claims had not been verified when the first reports came out. A resilient organisation checks before it communicates, but prepares as if the threat were real.

NIST's four abilities translate into concrete actions.

• Anticipate. Know what really matters: which activities are essential, how long they can stop, which systems and suppliers they depend on. That is the job of the business impact analysis (BIA) and the risk analysis.
• Withstand. Limit how far an attack spreads: segment networks, separate administrator accounts, fix exploited flaws first, monitor internet-facing devices.
• Recover. Have offline, tested backups, as ANSSI's guide on information system backups recommends, an IT disaster recovery plan and a crisis team that has already trained together. Against ransomware, this is often the difference between a few days and several weeks of downtime.
• Adapt. After every incident or exercise, run a lessons-learned review and turn its conclusions into tracked actions, as good incident management requires. That is how you end up stronger than before.

Recent incidents show that a single forgotten device can tip everything over, as in the supermarket refrigeration cyberattack of October 2026. On the supplier side, third-party risk management lets you assess their own ability to recover and plan a fallback for the most critical ones.