* [Blog](https://origin-researchcenter.paloaltonetworks.com/blog) * [Palo Alto Networks](https://origin-researchcenter.paloaltonetworks.com/blog/corporate/) * [Must-Read Articles](https://origin-researchcenter.paloaltonetworks.com/blog/security-operations/category/must-read-articles/) * Reactive to Resilient: Th... # Reactive to Resilient: The Roadmap to Cyber Readiness and Beyond [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2021%2F09%2Fcyber-resilience%2F) [](https://twitter.com/share?text=Reactive+to+Resilient%3A+The+Roadmap+to+Cyber+Readiness+and+Beyond&url=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2021%2F09%2Fcyber-resilience%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2021%2F09%2Fcyber-resilience%2F&title=Reactive+to+Resilient%3A+The+Roadmap+to+Cyber+Readiness+and+Beyond&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://origin-researchcenter.paloaltonetworks.com/blog/2021/09/cyber-resilience/&ts=markdown) \[\](mailto:?subject=Reactive to Resilient: The Roadmap to Cyber Readiness and Beyond) Link copied By [LeeAnne M. Pelzer](https://www.paloaltonetworks.com/blog/author/leeanne-m-pelzer/?ts=markdown "Posts by LeeAnne M. Pelzer") Sep 29, 2021 7 minutes [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown) [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown) [Incident Response](https://www.paloaltonetworks.com/blog/tag/incident-response/?ts=markdown) [ransomware](https://www.paloaltonetworks.com/blog/tag/ransomware/?ts=markdown) This post is also available in: [日本語 (Japanese)](https://origin-researchcenter.paloaltonetworks.com/blog/2021/10/cyber-resilience/?lang=ja "Switch to Japanese(日本語)") Too often, I find that organizations believe they are "cyber ready" without considering "cyber resilience." Over the course of assisting hundreds of clients of all sizes across all industry verticals, it's become clear to me that many organizations would benefit from understanding what it means to be cyber resilient, how to achieve resilience and why resilience should be top-of-mind for executives. This understanding makes it possible to prepare for a cybersecurity incident proactively, and to get the most out of the time and effort required. ## Cyber Resilience: More Than Being Ready Organizations typically determine their state of "cyber readiness" based on implemented offensive and defensive security measures -- in other words, how prepared and capable the organization is to "block and tackle" cybersecurity threats. While blocking and tackling undoubtedly play a role in thwarting threat actors, this conventional approach to security does not specifically highlight business considerations and complexities. How can organizations ensure that, even while handling the consequences of a cybersecurity incident, customers are satisfied, business objectives are met, critical systems are available and sensitive data is protected? This is where **cyber resilience**comes into play. **Cyber resilience is a tactical state of preparedness that enables organizations to pivot business delivery mechanisms and core system functionality to minimize business disruptions and maintain reputation in the event of a cybersecurity incident.** To summarize: Resilient organizations can continue delivering critical services, even when navigating a cybersecurity incident, because there is a tactical plan for how to operate in a degraded state. Organizations that have a thorough understanding and dedicated approach to resilience will thrive above competitors when faced with a cybersecurity incident -- minimizing business disruptions, maintaining customer trust, lessening the remediation timeline and lowering the overall [**cost of a breach**](https://www.paloaltonetworks.com/blog/2021/06/the-cost-of-cybersecurity-incidents-the-problem/). ## Roadmap to Resilience Achieving a state of cyber resilience does not happen overnight. Organizations should consider the following steps when building a foundation of resilience. ### Define Current-State Resilience First, organizations must thoroughly [understand their current resilience posture](https://www.paloaltonetworks.com/unit42/proactive-assessments) -- inclusive of capabilities, practices, risk tolerance and business objectives. In order to identify current-state cyber resilience, organizations should conduct an assessment against a dedicated cybersecurity resilience framework. This is different from a conventional cybersecurity risk assessment due to an additional emphasis on operational requirements and organizational mission, objectives and goals. It is important to choose a framework that is inclusive of resilience-specific techniques, safeguards and processes such as service continuity management, situational awareness and external dependency management. For example, the Cybersecurity and Infrastructure Security Agency (CISA) offers extensive [resources](https://us-cert.cisa.gov/resources/assessments#two-options) to assist organizations in defining current-state resilience posture. ### Understand Organizational Attack Surface It is impossible to protect infrastructure that you don't know exists. Organizations should ensure that the attack surface, inclusive of assets and data, is [meticulously managed](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management). Additionally, it is essential to consider implications arising from the use of "Shadow IT" or cloud-based applications. Organizations should deploy appropriate tools or configurations to restrict the use of non-authorized software, hardware or applications wherever possible. Most importantly: "Crown Jewels" (i.e. critical business/service infrastructure) must be identified, managed, monitored, protected, prioritized and maintained. Resilient organizations recognize the value and necessity of putting security above convenience when it comes to ensuring their most critical assets are protected. For example, small steps such as leveraging application allow listing, disabling extraneous system functionality and implementing the principle of least privilege can significantly reduce attack surface risks. ### Stress Test Crown Jewels Resilience is not achieved by maintaining homeostasis. It is essential to regularly "stress test" critical infrastructure, services, capabilities and organizational dependencies. Stress testing can be accomplished by introducing aspects such as complex breach scenarios, technical testing and controlled threat deployment to the most critical areas of an organization. It is essential to continuously push the envelope -- conducting the same "paper-based" annual tabletop exercise to simply check the box is not enough. Organizations should explore tactical exercises that aim to specifically target the most critical assets -- chipping away at defensive capabilities and controls. This can be accomplished through "[Purple Teaming](https://www.paloaltonetworks.com/resources/datasheets/ransomware-readiness-assessment)," in which offensive tactics and techniques are strategically applied in order to test -- and hopefully validate -- the success of defensive cybersecurity measures. Purple Teaming provides extremely valuable insight regarding how weak or underperforming defensive controls can be improved. Additionally, organizations should ensure that purposeful "lessons learned" meetings are conducted after all stress testing exercises. Specific projects, initiatives or takeaway actions to drive continuous improvement should be the key outcomes of every lessons learned meeting. ### Practice Alternative Service Delivery Most organizations believe they have a backup plan for service delivery -- whether that be an alternate business site, maintained network backups, or processes for outsourcing service responsibilities to a partner or third-party. However, the majority of organizations have no idea how they would *actually* go about executing an alternative service delivery plan. In fact, most organizations are not even confident about how they would (or if they could...) complete a full network restore by leveraging backups. Most alternative service delivery plans sound great in theory, but they are not realistically as effective and efficient in practice. It is essential for organizations to identify, test, re-test and continuously improve alternate paths and processes to deliver critical services. By ensuring that alternative service delivery plans work like well-oiled machines, organizations can quickly pivot when core assets become unavailable during an incident, minimizing business disruptions and associated costs. While these exercises tend to be very planning-intensive, and sometimes costly, organizations that are hit with ransomware or another service-disrupting cyberthreat will save precious time and money by ensuring alternative delivery plans are fine-tuned. ### Have the Tough Conversations | \* Under what circumstances would you pay a ransom? \* How would you maintain customer trust if the media was swirling with rumors and your stock price was sinking? \* What would happen if your CISO was incapacitated when an incident was discovered? \* Who would you call to stop an active incident from spreading like wildfire? | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| It is essential that organizational leadership is aligned on the answers to these and similar questions. Leaders should ensure that decision trees are formally defined and socialized with key stakeholders to facilitate discussion and buy-in. When a change in stakeholder personnel occurs, these decision trees should be revisited and updated as required. Having the tough conversations before an incident occurs will save valuable time and enable organizations to focus on what matters most -- maintaining critical operations and recovering to a state of normalcy. ## [Cyber Resilience in the Boardroom](https://www.paloaltonetworks.com/unit42/executive-board-advisory) It is typical for cybersecurity to be left off of the roster during board or executive meetings. Organizations shy away from overloading business-minded leaders with security operation metrics, information about new risks or threats, and reports on the status of tools and technologies due to a fear of being "too technical." However, resilient organizations are invested in permeating security throughout their workforce -- including the most senior leaders. Cyber insights and data points should be correlated with key performance indicators (KPIs) and security metrics that should be shared in the boardroom. "Meaningful" metrics are not necessarily synonymous with "highly technical" metrics. Consider your organization's primary mission, customer commitments and regulatory requirements; this is a great starting point for developing insightful metrics that demonstrate how cybersecurity plays a role in organizational success. These metrics can inform data-driven decisions regarding business investments, resourcing, strategic roadmaps and budget allocation. Cybersecurity resilience is achieved by shifting organizational culture, and should be a topic that is frequently discussed with the board of directors or senior executives. Given our increasingly digital world, it is imperative that business leaders are equipped with the facts and knowledge that is required to successfully navigate cybersecurity risks, dependencies and business considerations. If you're ready to get started on strengthening your cyber resilience, Unit 42 offers a number of [proactive assessments](https://www.paloaltonetworks.com/unit42/proactive-assessments), including the [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/ransomware-readiness-assessment) and the [Business Email Compromise (BEC) Readiness Assessment](https://www.paloaltonetworks.com/bec-readiness-assessment). *Unit 42 Principal Consultant and cybersecurity risk management expert LeeAnne Pelzer has written several proactive security articles, including her series on the* [*true cost of cybersecurity incidents*](https://www.paloaltonetworks.com/blog/tag/cost-of-cybersecurity/)*. Follow her on [LinkedIn](https://www.linkedin.com/in/leeanne-pelzer-cissp-09224679/) to be notified of future publications and insights.* *** ** * ** *** ## Related Blogs ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown) [#### Extortion Payments Hit New Records as Ransomware Crisis Intensifies](https://origin-researchcenter.paloaltonetworks.com/blog/2021/08/ransomware-crisis/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Next-Generation Firewalls](https://www.paloaltonetworks.com/blog/network-security/category/next-generation-firewalls/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown) [#### The Ransomware Threat: Bigger, Greedier, Attacking the Most Vulnerable](https://origin-researchcenter.paloaltonetworks.com/blog/2021/03/ransomware-threat/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown) [#### Learning From the Past --- Ten 2022 Cybersecurity Events to Know](https://origin-researchcenter.paloaltonetworks.com/blog/2022/12/unit42-cybersecurity-events-2022/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Unit 42](https://unit42-dev2.paloaltonetworks.com) [#### 7 Tips to Improve Your Existing Incident Response Plan](https://origin-researchcenter.paloaltonetworks.com/blog/2022/09/improve-your-existing-incident-response-plan/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Today's Cyberthreats: Ransomware, BEC Continue to Disrupt](https://origin-researchcenter.paloaltonetworks.com/blog/2022/07/cyberthreats-incident-response-report/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) [#### Average Ransom Payment Up 71% This Year, Approaches $1 Million](https://origin-researchcenter.paloaltonetworks.com/blog/2022/06/average-ransomware-payment-update/) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://origin-researchcenter.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language