The question is no longer whether a significant security incident will occur, but whether the organisation is genuinely prepared to absorb, respond to, and grow stronger from it when it does.
Why This Tenet Matters #
The assumption that a well-defended organisation will avoid significant security incidents is no longer tenable. Every organisation of meaningful scale will face serious breaches during its operational lifetime, and every ISO will encounter high-impact incidents during their career. The security function that orients itself entirely around prevention, treating incidents as evidence of failure rather than as inevitable features of the operating environment, will always be on the back foot. Resilience reframes this reality, shifting the measure of security effectiveness from whether incidents occur to how well the organisation responds, recovers, and improves when they do. Anti-fragility goes further still, describing organisations that do not merely withstand disruption but emerge from it with stronger capabilities, sharper processes, and a more mature security culture than they had before.
Core Concepts #
Defining Resilience #
Resilience in the context of information security refers to the organisation’s capacity to maintain critical operations during a security incident, contain its impact, recover effectively, and restore normal service with minimal lasting disruption. It is an organisational capability that spans people, processes, and technology, and it cannot be achieved through technical controls alone. Business continuity planning, incident response procedures, crisis communication protocols, and tested recovery mechanisms are all essential components of a resilient security posture.
Anti-Fragility goes beyond Resilience #
Anti-fragility extends beyond resilience by describing a system or organisation that actively benefits from stress and disruption. Where a resilient organisation bounces back to its previous state, an anti-fragile one bounces forward, using the experience of adversity to improve its capabilities, sharpen its processes, and deepen its institutional knowledge. For the ISO, cultivating anti-fragility means treating every incident, regardless of severity, as a source of intelligence and an opportunity for genuine improvement rather than simply a problem to be resolved and closed.
Culture as the Foundation of Resilience #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
