Notifications
Clear all
Topic starter
24/07/2026 4:08 pm
TL;DR: Cyber resilience is a business continuity problem, not just a prevention problem, according to Semperis, with the article arguing that identity systems, especially Active Directory, create the largest blast radius when defenders cannot restore trust quickly. The operational lesson is that recovery, delegation, and communication planning now matter as much as perimeter defence.
NHIMG editorial — based on content published by Semperis: Midnight in the War Room and the meaning of cyber resilience
By the numbers:
- Average CISO tenure is less than 11 months.
Questions worth separating out
Q: What breaks when identity systems are the recovery dependency in an incident?
A: Recovery becomes unsafe if the organisation cannot quickly prove that directory state, privileged access, and trust relationships are clean.
Q: Why do identity systems create such a large blast radius during cyber incidents?
A: Identity controls who can access almost everything else, so a compromise in directory services, privileged access, or federation can spread across applications, infrastructure, and recovery processes.
Q: What do security teams get wrong about resilience and trust?
A: They often separate infrastructure resilience from identity governance, even though access assurance depends on the same continuity guarantees.
Practitioner guidance
- Map identity recovery dependencies Identify which directory, IAM, PAM, and federation services must be restored first for critical business services to come back safely.
- Test delegated decision rights Run exercises that verify who can approve emergency access, isolate systems, notify regulators, and communicate with customers when primary teams or systems are unavailable.
- Validate identity integrity before service restoration Add checks for stale privileged access, compromised accounts, and trust relationship drift before bringing production systems back online after an incident.
What's in the full article
Semperis' full article covers the operational detail this post intentionally leaves for the source:
- The documentary context and speaker lineup behind Midnight in the War Room, including the mix of CISOs, national security figures, and researchers.
- The specific crisis-management themes raised in the film, including psychological pressure, business continuity, and leadership decision-making.
- The Black Hat USA premiere details and the tabletop simulation format for healthcare, critical infrastructure, and retail.
- The source article's framing of how cyber incidents affect operations, legal response, communications, and resilience planning.
👉 Read Semperis’ analysis of cyber resilience, identity recovery, and CISO decision-making →
Cyber resilience and identity recovery: what leaders are missing?
Explore further
24/07/2026 4:13 pm
Cyber resilience is an identity governance problem as much as a continuity problem. The article is right to place identity at the centre of resilience because identity systems determine who can act, recover, and restore trust after a disruption. In practice, IAM and PAM teams should be part of resilience design, not only post-incident remediation, because the trust layer is often the first thing the business needs back.
A question worth separating out:
Q: Who is accountable when identity risk causes measurable business impact?
A: Accountability sits with the teams that own identity governance, privileged access, and security risk decisions, not with the alerting tool alone. Organisations should define who can translate identity findings into financial exposure, who approves remediation, and who is responsible for containment when a privileged identity is compromised.
👉 Read our full editorial: Cyber resilience is now a business continuity and identity issue
