How organisations can use vulnerability to create cyber resilience

Too often, there is an inappropriate level of trust between organizations in the digital ecosystems we depend on. The dynamic is born from institutional aversion to loss, fear of condemnation, fragile confidence, and lack of cyber resilience.

The World Economic Forum’s Global Cybersecurity Outlook 2022 report, developed in collaboration with Accenture, found that:

It doesn’t have to be this way. If organizations can overcome such self-limiting stigma, each will gain from the collective wisdom and combined capability of its partners. Doing so is a necessary foil for the cascading consequences that occur when fragile, interconnected ecosystems break down, as so many recent events have demonstrated.

For organizations to move past this protracted mistrust, they must exploit a different kind of critical vulnerability from what cyber professionals are used to—the vulnerability of an organization to be truly seen. They must embrace the willingness to be transparent within their organization and ecosystem about shortcomings in cyber resilience posture. They should set realistic expectations about exposure and provide clear information about the systemic consequences of disruptions. They should be forthcoming about experiences with disruptive events and share lessons learned as a result.

Cyber resilience is what takes over when security prevention measures falter. In the digital economy, the ability to transcend cyber disruption distinguishes market champions. Organizations that turn vulnerability into strength will have the confidence to take healthy risks.

Turning institutional vulnerability into organizational strength is not easy to do. Fortunately, the World Economic Forum’s newly-released Cyber Resilience Index Framework – developed in collaboration with Accenture - presents the six principles to cultivate a culture of resilience:

Two principles in particular—cultivating a culture of cyber resilience and encouraging systemic resilience and collaboration—have long been under-valued. Both these principles provide organizations with a starting point to turn vulnerability into cyber resilience. The principles are put into practice as follows:

Employees are empowered to understand and embody cyber resilient behaviours. This principle has the following practices:

The organization understands the interdependencies within its ecosystem, engages with other organizations, and fulfils its role in maintaining the resilience of the entire ecosystem. This principle has the following practices:

These principles and practices promote the kind of cyber vulnerability that organizations and ecosystems need. It’s not just about creating a more capable ecosystem, either. It’s about the opportunity to gain a sustainable competitive advantage. Organizations that quickly adopt cyber resilience through confident vulnerability quickly emerge as leaders in their industry and set the standard for their ecosystem.

ISO 31000:2018 emphasises the fact that risk is the “effect of uncertainty on objectives” and that, despite conventional thinking, that effect can be positive as well as negative. Amid the Fourth Industrial Revolution, systemic interdependence creates both downside costs of cyber risk and holds a much greater upside value. On both sides, the effect of resilient organizational behaviour on the future is more than the sum of its parts. The organizations that will lead us into the digital future are those that are not only vulnerable enough to admit they can’t do it alone but are also confident and savvy enough to realize that it’s better for businesses to not even attempt it.