Stop Buying Resilience. Start Building It.
Resilience cannot be outsourced. It is not a product, a SaaS subscription, or an awareness module. It develops inside organizations through practice, structure, and leadership — or it does not develop at all.
The Misunderstanding
There is a persistent market for resilience as a product. Platforms, training modules, awareness programs, dashboards. They promise preparedness and deliver documentation.
The problem is not that these products are useless. The problem is what they claim to be.
What Research Shows
A large-scale study in the U.S. healthcare sector made this concrete: nearly twenty thousand employees were exposed to phishing simulations over eight months. The results were sobering. Annual awareness training had no measurable effect on vulnerability. Generic, non-contextualized learning content correlated with worse outcomes in some cases.
Those who assume that ticking a box with another vendor’s product generates resilience are, at best, wasting resources. At worst, they are increasing their exposure.
What Resilience Actually Is
Resilience consists of three intertwined capabilities.
First: resistance. The ability to withstand disruption before it becomes a crisis.
Second: coping capability. The ability to decide and adapt under pressure when disruption exceeds resistance.
Third: cooperation capability. The ability to act together with other actors under conditions that could not be anticipated.
None of these three capabilities can be generated through information delivery. They develop through practice, through decisions under real pressure, through structures built during ordinary times.
The Structural Problem with Most Solutions
Most offerings operate at the surface. They deliver content instead of capability. They confuse information transfer with behavior change. And they sell the illusion of preparedness while distracting from the actual work.
The actual work is slower. It requires treating crises not as anomalies to be outsourced to vendors, but as realities to be rehearsed, understood, and built into the organizational structure.
Resilience is not found in dashboards. It develops where leaders practice difficult decisions before a crisis forces them to.
Quotable
“Resilience cannot be outsourced. It is a practice, not a product.”
“Those who assume that another awareness module generates resilience are, at best, wasting resources.”
“The actual work is slower. But it is the only kind that endures.”
→ How Rico Kerstan develops resilience capabilities: Services → The conceptual model: Approach