Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Are Building Cyber Resilience Teams
Transcript
- Lucas: So there's this term that's been creeping into enterprise security decks for the last year or two: cyber resilience. And it's not just a rebrand of disaster recovery or business continuity. Luna: Okay, I've seen the slide. But what's actually different about it? Lucas: The shift is from assuming you can prevent every breach to assuming a breach will happen and focusing on how fast you recover. And I think the clearest sign that this is more than a buzzword is that companies are now creating dedicated cyber resilience teams. Not just a committee, but people whose job it is to plan for the worst. Luna: And you said this is listener-funded. For anyone who wants to keep this kind of conversation going, you can support the show at buy me a coffee dot com slash fexingo. It's literally how we keep making these episodes without ads. Lucas: Yeah, appreciate that. And a quick honest thing — a handful of listeners chip in monthly and it genuinely covers the production costs. No pressure, but if you're one of those people, thank you. Luna: It's a small group, but it's what keeps the lights on. Alright, back to resilience. What does a team like that actually do day to day? Lucas: So the classic example people cite is Maersk back in 2017. They got hit by NotPetya and had to reinstall forty-five thousand servers and twenty-five hundred applications. It took them ten days to get back to something like normal. That's the kind of scenario these teams are built around. Luna: Right, so it's about the operational recovery, not just containing the malware. Lucas: Exactly. And the new teams are being built to answer questions like: how do we rebuild our Active Directory from scratch? How do we restore our ERP system if the backups are compromised? How do we communicate with customers and regulators during an outage? These are not questions your average SOC analyst is thinking about. Luna: And these teams are separate from the SOC and the incident response function? Lucas: Usually yes. Some organizations put them under the CISO, but often they sit in a risk or business continuity function. The interesting trend is that CISOs are increasingly being asked to own resilience end to end, even if the operational pieces live elsewhere. Luna: So what does that mean for the CISO's role? They were already overloaded. Lucas: It's expanding, for sure. Some companies have created a deputy CISO for resilience or a director of resilience reporting into the CISO. And the boards are starting to ask tougher questions, not just 'are we secure?' but 'how fast can we get back to business?' Luna: And do they have the budget for that? Or is it being carved out of existing security spend? Lucas: That's the million-dollar question. Some are creating separate resilience budgets because the ROI is different. You can't justify a resilience team by showing fewer breaches; you justify it by reducing mean time to recover. And that's a metric boards are starting to track. Luna: Mean time to recover. I've seen that in a few annual reports now. Lucas: Right, and the target is getting shorter. A few years ago, a two-week recovery was acceptable. Now, for critical systems, some companies are targeting under twenty-four hours. That requires not just planning but constant testing, which is where these teams spend a lot of their time. Luna: Testing like tabletop exercises, or actual restore drills? Lucas: Both. Tabletop exercises are common — you walk through a scenario with executives and see who makes decisions. But the more interesting ones are what people call 'game days' — they simulate a ransomware attack in a live environment and actually try to restore from backups while the network is still infected. It's like a fire drill, but with real smoke machines. Luna: And that's where you find out your backups were encrypted too, because the attackers got into the backup admin console. Lucas: That is exactly the lesson. We've seen that play out in real breaches. So the resilience team is also responsible for ensuring that the backup infrastructure is segmented, immutable, and tested. It's not just IT ops anymore; it's a security function. Luna: So who's in these teams? Are they former IT disaster recovery folks, or more security people? Lucas: A mix, but I'm seeing a new profile: people who have lived through a major breach and know what it actually takes to recover. There's a premium on that experience. One CISO told me he'd rather hire someone who's been through a ransomware attack than someone with a bunch of certifications. Luna: And that experience is rare, so they're paying for it. Lucas: Oh, absolutely. These roles can command salaries comparable to senior incident responders, and in some cases more, because the stakes are higher. Also, there's a growing consulting ecosystem around this — you have firms that specialize in crisis management and recovery planning, and they're being brought in to run these exercises. Luna: So for a mid-sized company that can't build a full resilience team, what's the minimum viable approach? Lucas: I think the minimum is having at least one person whose job is explicitly resilience, not just security or IT. And then doing at least one real recovery exercise a year for your top two or three critical systems. And that exercise has to involve the board or at least the executive team, because one of the biggest risks is that decisions get made in a vacuum during a crisis. Luna: And that's where the board's role comes in. Are they actually engaged in these exercises? Lucas: More and more. I talked to a CISO at a large bank who said the board now asks to see the recovery runbooks. They want to know: if we lose our core transaction system, how fast can we be back up? And if the answer is 'we don't know,' that's a problem. Luna: It's almost like business continuity planning, but with a security threat model attached. Lucas: Exactly. And that's why the resilience team often sits at the intersection of security, IT operations, and the business. They have to translate technical recovery metrics into business impact, like revenue loss per hour of downtime. Luna: And that's a number boards understand. Lucas: Right. So when you make the case for a resilience budget, you can say, 'If we reduce recovery time from five days to one, we save an estimated X million dollars per incident.' That's a different conversation than 'we need more firewalls.' Luna: So what's the next big shift? Are we going to see resilience as a separate board committee? Lucas: Possibly. There's already talk of a chief resilience officer at some large enterprises, though that's still rare. But I think the bigger trend is that resilience is becoming part of the security metrics that are reported externally. You're seeing companies mention mean time to recover in their annual reports, and I expect that to become more standard. Luna: Interesting. So if I'm a security professional listening, what should I take away from this? Lucas: I'd say: if you're not already involved in recovery planning, raise your hand. Even if you're in a SOC, understanding how the business recovers from a breach makes you more valuable. And for CISOs, start building those relationships with your IT ops and business continuity colleagues now, before you need them. Luna: And maybe run a game day that actually breaks something. Lucas: Only in a test environment, please. But yes. Because the worst time to discover your backup strategy is broken is when you're already under attack.