Downtime pushes resilience planning into security operations
CISOs describe a shift in how they define success. New research from Absolute Security shows broad agreement that resilience outweighs security goals centered on prevention alone. Security leaders increasingly define their role around keeping the business operating through disruption.
The cost of recovery (Source: Asolute Security)
CISOs see themselves as responsible for recovery when incidents interrupt operations. Business continuity, endpoint restoration, and coordination with IT teams fall within their scope. Formal resilience strategies have become common, indicating that this shift is built into planning instead of treated as an add on.
Disruption is part of operations
The survey shows that operational disruption has become routine for large enterprises. CISOs reported recent incidents that rendered employee devices unusable across remote, mobile, and hybrid workforces. These incidents include ransomware, data compromise, and other failures that affect endpoint availability.
This pattern explains why downtime commands as much attention as attack volume. When endpoints fail, access to core systems stops across departments. Recovery efforts often run alongside normal business demands, stretching both security and IT teams.
“At some point every organization will face the reality of a cyber incident or attack that takes down the business. Organizations that aren’t prepared to bounce back quickly face an almost existential crisis, as prolonged downtime can crush a business,” said Christy Wyatt, President and CEO, Absolute Security.
Recovery takes longer than expected
CISOs consistently reported recovery timelines measured in days rather than hours. Endpoint remediation requires coordination across tools, identity systems, and user support, which extends outages.
Respondents also described recovery costs that reach into the millions for many incidents. These figures reflect direct remediation tied to device and system recovery. Indirect costs, including lost productivity and delayed services, add pressure during extended outages.
These recovery realities feature prominently in board discussions. Planning centers on reducing downtime and restoring access across the enterprise when failures occur.
Expectation of future disruption
CISOs expect disruption to continue. Many believe their organizations will experience incidents that cause significant downtime within the next year. Ransomware remains a key concern, alongside supply chain disruptions, insider activity, and compliance failures.
Each risk has the potential to interrupt operations even when perimeter defenses hold. CISOs increasingly assess threats based on their ability to stop work, not only their technical characteristics.
Personal stakes rise for security leaders
The study shows growing concern about personal consequences tied to major incidents. CISOs worry that severe downtime could lead to job loss, legal scrutiny, or financial liability. This concern reflects expanding expectations placed on security leadership.
Accountability for recovery outcomes has become more visible at the executive level. CISOs describe pressure to demonstrate preparedness and recovery capability beyond traditional security metrics.
Software failure enters resilience planning
One finding highlights concern about failures within trusted security software. CISOs increasingly view internal technology breakdowns as a meaningful source of risk. Respondents expressed concern that a failure in a security control could trigger widespread downtime.
This view broadens how resilience is defined. Planning includes scenarios where protective tools themselves disrupt operations. CISOs factor these risks into testing and recovery exercises alongside cyberattack scenarios.
Executive expectations remain demanding
The research also points to continued tension between leadership expectations and operational reality. CISOs report that executives expect security investments to eliminate breaches and ransomware entirely. These expectations form how resilience is discussed at the executive level.
Security leaders describe ongoing efforts to explain resilience as preparation and recovery. Conversations focus on limiting disruption and restoring services when incidents occur.