Why organisations need to measure cyber resilience – not just preparedness
As leaders gather this week at GISEC Global in Dubai to discuss the region’s cybersecurity agenda, Sidharth Wahi from Gallagher emphasizes the importance of accurately measuring cyber resilience – and not just cyber preparedness.
Preparedness is the presence of controls, recovery plans and security capabilities. Resilience is something different: the ability to absorb disruption without breaching operational, safety or financial limits.
The distinction matters because a mature security programme does not guarantee resilient operations. When a major cyber incident occurs, boards are not asking whether controls existed. They are asking a more fundamental question: can the business continue to operate within acceptable limits?
That question is becoming increasingly urgent. The UK National Cyber Security Centre (NCSC) assesses that artificial intelligence is likely to increase both the frequency and impact of cyber threats.
More importantly, AI is changing the cyber resilience gap itself. Attackers can increasingly automate reconnaissance, vulnerability discovery, social engineering and campaign execution at scale. As a result, cyber attacks may evolve faster than many organisations can strengthen their resilience capabilities. AI has the potential to increase disruption demand faster than organisations can build resilience capacity.
The Middle East
This challenge is particularly relevant in the Middle East.
Across the region, governments and organisations are investing heavily in AI, digital transformation, smart infrastructure and industrial modernisation to support long-term economic growth. These investments create substantial opportunities for productivity and innovation, but they also increase dependence on interconnected digital and operational systems.
At the same time, the threat environment continues to intensify. UAE cybersecurity leaders report that the country faces approximately 600,000 cyberattack attempts every day and warn that AI is increasing the scale and sophistication of attacks targeting the digital infrastructure that underpins aviation, energy, water and other critical services.
For organisations operating critical infrastructure, industrial facilities and essential services, cyber incidents can disrupt production, interrupt supply chains and affect the safe operation of physical processes. The challenge for leadership is therefore not simply preventing cyber incidents but understanding whether the organisation can absorb and recover from them.
Cyber resilience gap
Every cyber incident creates a demand on the organisation. Every organisation has a finite capacity to absorb that disruption. The difference between the two is the cyber resilience gap.
Understanding the gap begins with credible scenarios. Which critical operations could be disrupted? How long could disruption last? What operational, safety, environmental and financial consequences might follow? Which suppliers or service providers could also become unavailable?
The assessment must focus on material scenarios rather than generic threat lists. Ransomware affecting corporate systems creates very different demands from a loss of view or control in an operational technology environment. Organisations must then understand their resilience capacity: their ability to absorb disruption while remaining within defined operational, safety and financial boundaries.
Operational capacity determines how much disruption can be tolerated while maintaining minimum viable operations through measures such as safe degradation, local control and manual fallback procedures. Recovery capacity determines how quickly critical functions can be restored through tested recovery processes, specialist support and alternative operating arrangements. Financial capacity determines how much residual loss can be absorbed through retained-risk capacity and insurance protection.
Cyber insurance is often the fastest and most scalable way to increase financial resilience. It provides access to specialist response, forensic, legal and recovery resources while transferring defined financial losses that could otherwise place significant pressure on earnings, cash flow or capital.
However, insurance is not a substitute for resilience. It cannot maintain production, restore a critical supplier or compensate for inadequate recovery capabilities. Its role is to strengthen financial capacity while operational and recovery capabilities strengthen the ability to continue and restore operations.
When disruption demand exceeds resilience capacity, cyber risk becomes business harm. Operational losses accumulate, recovery challenges intensify and financial consequences compound. This is the resilience gap leaders should be measuring.
Three interventions
Closing the gap requires action on three fronts: reducing disruption demand, increasing resilience capacity and increasing financial absorption capacity.
Security controls, segmentation, supplier risk management and AI-enabled defence can reduce disruption demand. Investments in operational resilience, recovery capabilities and crisis management can increase resilience capacity. Liquidity, capital allocation and cyber insurance can increase financial absorption capacity.
This is where cyber risk quantification becomes valuable. Its purpose is not simply to attach a monetary value to cyber risk. It is to estimate the demands created by specific scenarios, model how losses develop as disruption continues and identify the most effective ways to close resilience gaps.
AI also affects the capacity side of the equation. Organisations are increasingly using AI to improve monitoring, detection, response, recovery and scenario analysis. The strategic question for boards is whether those gains are keeping pace with the growth in AI-enabled disruption demand.
Boards should stop asking whether the organisation is cyber secure. The more important question is whether the organisation understands its cyber resilience gap and whether that gap is widening or narrowing over time.
Conclusion
In an AI-enabled threat environment, cyber resilience is no longer simply a technology issue. It is a capital allocation challenge. Leaders must decide how much to invest in reducing disruption demand, how much to invest in operational and recovery resilience, and how much risk to retain or transfer through insurance.
The organisations best positioned for growth will not be those with the highest maturity scores or the largest number of controls. They will be those that can answer three questions with evidence: What disruption could we face? What capacity do we have to absorb it? And where is the resilience gap?
For a region investing heavily in AI, smart infrastructure, industrial modernisation and digital economies, these are increasingly strategic business questions rather than cybersecurity questions. The organisations that can measure and systematically close their resilience gap will be best positioned to sustain growth in an increasingly volatile threat environment. That is the cyber metric that matters.
