Notifications
Clear all
Topic starter
10/07/2026 9:13 pm
TL;DR: Roger Hale argues that cyber resilience is a governance posture measured in recovery time, board-ready evidence, and the ability to keep services running under failure, not a product stack, according to Elisity. That shifts identity, logging, segmentation, and insurance evidence into one operating model where resilience reporting must prove the program moved the needle.
NHIMG editorial — based on content published by Elisity: Cyber Resilience: Interview with 7-Time CSO Roger Hale
By the numbers:
- The average cost of a data breach reached $4.88 million in 2024, and the average time to identify and contain a breach was 258 days.
- Since December 2023, SEC rules have required public companies to disclose material cybersecurity incidents within four business days on Form 8-K.
Questions worth separating out
Q: How should security teams report cyber resilience to the board?
A: They should report resilience in terms the board can act on: recovery time, containment time, service availability, and residual risk.
Q: Why do IAM and NHI controls matter in cyber resilience programmes?
A: IAM and NHI controls matter because they determine who or what can move during an incident, what evidence exists afterward, and whether recovery can be proved to insurers and regulators.
Q: How do organisations prove that resilience controls are actually working?
A: They prove it by testing recovery, validating containment boundaries, and producing identity evidence without manual reconstruction.
Practitioner guidance
- Tie resilience metrics to identity controls Map recovery time objectives, containment time, and access evidence readiness to specific identity controls so the board can see how access governance affects continuity.
- Unify logs for access reconstruction Correlate IAM, PAM, cloud, and segmentation logs so investigators can rebuild who had access, what changed, and what remained excluded after an incident.
- Test recovery before an insurer asks for proof Run tabletop exercises that verify you can produce the telemetry, access history, and containment evidence required for a claim or disclosure.
What's in the full article
Elisity's full article covers the interview detail this post intentionally leaves for the source:
- Roger Hale's direct boardroom framing on how CISOs should translate security into business-risk language.
- The discussion of how cyber insurance requirements are changing evidence expectations for incident response and recovery.
- The article's broader context from RSAC 2026 and the resilience themes that surrounded the interview.
- Additional career and leadership commentary from a seven-time CSO perspective that is more personal than operational.
👉 Read Elisity's interview with Roger Hale on cyber resilience and board reporting →
Cyber resilience and identity governance: what boards need now?
Explore further
10/07/2026 9:35 pm
Cyber resilience is now an identity governance discipline, not a separate security program. The article's strongest point is that recovery, evidence, and board reporting all depend on identity boundaries that can be explained under pressure. That aligns with NIST CSF 2.0, where Govern is now part of the resilience conversation, and with the reality that IAM, PAM, and NHI controls determine whether a company can keep operating during an incident. Practitioners should stop treating resilience as downstream of identity and start treating identity as one of its primary control planes.
A few things that frame the scale:
- 85% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials.
A question worth separating out:
Q: Who is accountable when cyber resilience fails?
A: Accountability sits with the executive owners of continuity, security, and identity governance, because resilience is cross-functional. The board expects a coordinated operating model, not isolated technical ownership, and insurers will evaluate whether the organisation can demonstrate evidence, containment, and recovery under policy conditions.
👉 Read our full editorial: Cyber resilience is now an identity governance problem
