Topic starter
11/07/2026 1:54 pm
TL;DR: Cyber resilience is shifting from a recovery slogan to an operational requirement as organisations judge security by containment, continuity, and adaptation rather than control presence alone, according to Zero Networks. That reorients identity and network design toward blast-radius reduction, granular enforcement, and automated containment when breach prevention fails.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “What Is Cyber Resilience? How to Protect Business Continuity”.
By the numbers:
- Just 19% of organisations say their cyber resilience capabilities exceed minimum requirements.
- Attackers begin moving laterally in as little as 51 seconds.
- Compromising over 60% of the environment in less than an hour is possible once lateral movement starts.
Key questions
Q: What breaks when cyber resilience is treated as a control checklist?
A: A checklist approach misses the real test, which is whether controls can contain damage once compromise occurs.
Q: Why do internal trust relationships increase business risk during a breach?
A: Because attackers use those trusted paths to move laterally from one foothold into many systems.
Q: How do security teams know whether containment is actually working?
A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded.
Practitioner guidance
- Define containment zones by business criticality Group assets, identities, and services by the business functions they support so a single compromise cannot cross into unrelated operations.
- Reduce internal trust paths Remove implicit reachability between internal systems and treat east-west traffic as untrusted unless explicitly required.
- Automate selective isolation Build enforcement that can isolate a compromised identity, workload, or segment without shutting down the whole environment.
Bottom line: Cyber resilience fails when the environment assumes breaches can be cleanly prevented instead of locally contained.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:05 pm
Cyber resilience is now an identity governance problem, not just a recovery problem. The article’s central point is that business continuity depends on how identities, trust paths, and containment rules behave after an incident begins. Traditional controls can reduce likelihood, but resilience is decided by how much of the environment remains reachable once compromise occurs. Practitioners should therefore judge governance by constraining access paths, not by counting controls.
A question worth separating out:
Q: When should organisations prioritise automated containment over broad shutdowns?
A: Whenever the business needs critical services to keep running during an incident. Broad shutdowns may be acceptable for small environments, but they create avoidable paralysis in complex ones. Selective containment is the better choice when the goal is to limit impact while preserving continuity.
👉 Read our full editorial: Cyber resilience is becoming an identity and containment problem