Resilience Is Not a Cybersecurity Issue. It Has Just Been Framed as One.
In many organizations, the CISO is today the most visible authority on resilience. Business continuity, crisis management, and operational recovery are increasingly shaped by cybersecurity logic — not because it is the most comprehensive perspective, but because it is the most established.
How It Happened
Cybersecurity developed in a global, English-speaking ecosystem, free of historical constraints. It produced frameworks, metrics, certifications, and regulatory momentum. It addressed measurable risks with standardized solutions and positioned itself close to the board.
Other security domains — physical, organizational, procedural — remained fragmented, less formalized, and harder to quantify. They often operate outside the strategic core. As a result, their influence on the overall understanding of resilience is limited.
This creates an asymmetry: because digital risks are more visible and auditable, they tend to dominate the resilience narrative. Other dimensions — leadership culture, systemic interdependence, the capacity to navigate uncertainty — are underrepresented.
What This Means for Executives
Leadership in times of uncertainty and overlapping crises requires more than recovery plans and security dashboards for IT services.
It requires a broader perspective on vulnerability, adaptability, and strategic readiness. Understanding how resilience is framed within the organization and whose logic defines it is not a technical consideration. It is a question of governance and leadership responsibility.
The Structural Conclusion
Resilience deserves a place at the executive table — not as an IT subcategory, but as a guiding leadership principle for navigating complexity.
There is one more point: IT security logic and solving IT problems with IT solutions also increases complexity and the causes of crises. That is not an argument against cybersecurity. It is an argument against viewing resilience exclusively through its lens.
Resilience is not an IT subissue. It is a leadership responsibility.
Quotable
“Cybersecurity dominates the resilience narrative not because it is the most comprehensive perspective — but because it is the most established.”
“Understanding whose logic defines resilience within an organization is not a technical question. It is a leadership question.”
“Resilience deserves a place at the executive table — not as an IT subcategory, but as a guiding leadership principle.”
→ How Rico Kerstan addresses resilience as a leadership topic: Services → The conceptual model: Approach