Topic starter
24/07/2026 4:08 pm
TL;DR: Cyber resilience is a business continuity problem, not just a prevention problem, according to Semperis, with the article arguing that identity systems, especially Active Directory, create the largest blast radius when defenders cannot restore trust quickly. The operational lesson is that recovery, delegation, and communication planning now matter as much as perimeter defence.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Midnight in the War Room: The CISOs’ Challenge Comes to the Screen”.
Key questions
Q: What breaks when identity continuity is not built into resilience planning?
A: When identity continuity is missing, authentication, authorization, and session management all become fragile at the same time.
Q: Why do identity systems increase the impact of a cyberattack?
A: Identity systems increase impact because they concentrate the permissions that control many downstream services, users, and administrative actions.
Q: How do you know if identity recovery testing is actually working?
A: Use full restore drills that validate behaviour, not just data presence.
Practitioner guidance
- Define identity recovery as a continuity requirement Classify directories, authentication services, and delegated authority paths as recovery-critical assets with explicit restore targets and trust-validation steps.
- Document emergency delegation before a crisis Pre-approve who can authorise privileged actions, service prioritisation, and external communication when normal identity controls are degraded.
- Test restoration of trust, not just restoration of systems Run exercises that verify clean admin access, authoritative identity state, and safe re-entry of privileged users after a compromise.
Bottom line: Cyber resilience fails when organisations treat identity as a supporting control rather than a recovery-critical dependency.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:13 pm
Identity recovery is now a resilience control, not a cleanup activity. The article is right to place identity at the centre of cyber resilience because the directory and access layer define who can safely act during recovery. When trust in that layer is lost, the business cannot separate legitimate restoration from adversary persistence. Practitioners should therefore treat identity restoration as a prerequisite for resuming operations, not a post-incident afterthought.
A question worth separating out:
Q: Who should own emergency authority when cyber resilience depends on identity?
A: Emergency authority should sit with clearly named business and technical leaders who can prioritise services, approve privileged actions, and coordinate communication when normal controls are impaired. Ownership must be defined before an incident because delegated access, not improvisation, determines whether recovery stays within trusted boundaries. This is a governance issue as much as an incident response issue.
👉 Read our full editorial: Cyber resilience is now a business continuity and identity issue