From Prevention to Resilience: Cybersecurity’s New Paradigm

Key points

• Most organisations still budget and govern as though prevention alone will hold, even while telling boards the opposite.
• EU frameworks DORA, NIS2, and the Cyber Resilience Act now treat digital operational resilience as a legal obligation in specific sectors.
• The US approach leans on disclosure and enforcement through SEC cyber risk rules and CIRCIA reporting requirements.
• "Critical infrastructure" is a political and legal category, not a technical one, and vendors are avoiding the label to dodge the obligations it carries.
• AI compresses attack timelines and lowers the skill barrier for attackers, making defensive AI a practical necessity rather than a talking point.

Should you abandon prevention?

No. WAFs, MFA, and patching still form a necessary baseline. But prevention is no longer a credible operating model on its own. The question boards should be asking has shifted from "Can we stop the attack?" to "Can we keep operating when the attack gets through?" Survival means breach readiness, continuity, and identity restoration when the identity provider itself is the thing that's been hit.

Where regulation is heading

Europe has committed to putting resilience into law. DORA makes operational resilience a hard obligation for financial-sector firms. NIS2 widens the net of entities that must comply. The Cyber Resilience Act pushes security requirements into the full product lifecycle, from design through maintenance. The US is taking a lighter-touch path, pressing accountability through disclosure rules and sector enforcement rather than mandating resilience outright. We covered the tools-versus-operational-control tension this approach produces in our 2 June story.

Who actually counts as critical?

The "critical infrastructure" label is political, and companies are working hard not to earn it. The real exposure, though, isn't regulatory classification. A SaaS identity layer, a CI/CD pipeline, or an open-source package can sit well outside any regulator's list yet still be the single point that takes down hundreds of customers. That's a business continuity gap, not a compliance gap, and voluntary pledges don't close it.

What AI changes about the tempo

AI lowers the skill floor for attackers across phishing, reconnaissance, and exploit development. It also expands the internal attack surface through shadow AI deployments and agentic integrations whose permission scopes nobody has fully audited. Defenders need AI in return. Runtime analysis is growing in importance. The human role shifts from triage and correlation toward decision-making and boundary design. Our earlier piece "Exploitation Industrialized" ran the same argument from the attacker's side on 28 May.

AppSec as the practical model

Modern application security already treats resilience as a design goal, not an afterthought: tight API authorisation, audited supply-chain controls, continuous testing, reduced blast radii. That logic belongs at the organisational level too. The companies that will absorb a breach without collapsing are the ones building recoverability into operations now, not after the incident report lands.