Cyber resilience vs cybersecurity: The difference and why you need both
What separates cybersecurity from cyber resilience, the five components of each, and what Garmin and Colonial Pipeline show about running them together.
By 5 mins readPublished Updated On this page
Phishing, ransomware and DDoS attacks hit companies of every size, and the bill arrives as downtime, lost customers and regulatory penalties.
Garmin's 2020 ransomware attack is the standard example. Operations stopped for days, and the ransom alone is estimated at around $10 million, before lost customer trust and the security spending that followed.
A company of Garmin's size absorbs that. A small business often does not; one incident can end it.
Spending on security tools and staff training is the obvious response, and it is half of the answer. The other half is resilience, and the two get confused.
What cybersecurity is
Cybersecurity is the work of defending computers, servers, phones, networks and data against attack. It is the locks and cameras on the house.
The tools are familiar: antivirus, penetration testing, fraud detection, API scanners, and patching on time. The part most often skipped is training. Staff who recognize a phishing email stop more incidents than any single product.
The five components of cybersecurity
Five areas make up most security programs.
1. Network security
Firewalls, intrusion detection and hardened network configuration keep the network usable and intact.
2. Endpoint protection
Antivirus and anti-malware on every laptop, phone and server, so one infected device does not become a foothold.
3. Data encryption
Sensitive data is scrambled so that only authorized users can read it. A stolen database of ciphertext is a much smaller breach than one of plaintext.
4. Security awareness and training
Staff learn what the threats look like and what to do when they see one. The payoff is a workforce that reports the odd email instead of clicking it.
5. Incident response and management
A rehearsed plan for when something gets through: who does what, how the damage is contained, and how the business keeps running meanwhile.
What cyber resilience is
Cyber resilience is what happens after protection fails. It is the organization's ability to keep operating through an attack, recover from it and adapt afterwards.
The UK's National Cyber Security Centre (NCSC) frames it as planning to withstand an attack and keep critical operations running during the incident, not just to respond to it.
Recovery should be fast and controlled, without the panic decisions that cause their own damage, and systems and practices should change as new threats appear.
The five components of cyber resilience
A resilience framework covers the full arc of an incident, from before it starts to what changes afterwards.
1. Preparedness
Anticipate the incidents you are likely to face and write the response plans before you need them.
2. Detection
Systems that spot threats in real time, so the response starts in minutes rather than months.
3. Response
A clear plan for containing the damage while the business keeps running.
4. Recovery
Restoring systems and data to normal quickly after an attack.
5. Adaptation
Feeding lessons from each incident, and each new threat, back into the plan.
How the two depend on each other
Security and resilience pull in the same direction. Security lowers the odds of an incident; resilience lowers the cost of the ones that happen anyway. You need a balance of both to protect data and keep operating.
The 2021 Colonial Pipeline ransomware attack shows both halves. Attackers got past the company's defenses, the pipeline was shut down, and fuel supply across the Eastern U.S. was disrupted.
Colonial did have resilience measures, including incident response plans, and those are credited with getting operations back quickly and limiting the wider damage.
The lesson is uncomfortable: even careful defenses fail, and when they do, resilience is what you are left with.
So the job is both: controls that stop most attacks, and the practices that get you back on your feet when one gets through.
Why run them as one program
Cybersecurity keeps the defenses up. Cyber resilience keeps the business running and gets it back to normal when the defenses are breached.
Run together, they give you a safety net under the data and under the operations that depend on it.
Colonial Pipeline makes the case: security controls were in place, attackers found a gap anyway, and the resilience plan is what limited the damage.
Who does what
Resilience is a job for several layers of the organization. The chief information security officer (CISO) owns the strategy, keeps the security plan aligned with business goals and answers for compliance.
Security managers and analysts turn policy into controls, hunt for weaknesses and handle the daily work of keeping systems safe.
Incident responders and security engineers run the plan when an incident happens and build the protections that stop the next one.
During an incident the CISO sets the strategy and the operational teams carry it out. If those layers have not rehearsed together, the plan on paper does not survive contact.
Where to start
Resilience is maintained, not installed. It is not cybersecurity versus cyber resilience; it is both, run as one program.
Start by writing down what happens in the first hour after a breach, then test it. On the fraud side of resilience, Sensfrx scores every signup, login and payment in real time from device, network and behavior signals, so your rules block attacks on customer accounts before they become incidents.
If you want help building the security and resilience framework itself, SecureLayer7 does that work.