The economics of cyber-resilience
We live in an “assume breach” era: the question is no longer if an attacker gets in, but how quickly an organisation can recover when they do.
Kavitha Mariappan
chief transformation officer, Rubrik
Despite projections by research and advisory firm Gartner that global cybersecurity spending will exceed US$240bn in 2026, major incidents remain startlingly common. Yet detection and response are still widely prioritised over resilience—the ability to recover quickly from an incident, while minimising disruption. Economist Enterprise research, supported by Rubrik, finds that prevention spending still outpaces expenditure on recovery by 54% to 46%, a split projected to continue until at least 2030.
AI, and especially agentic AI, will force a reordering of these priorities. As agents compress the time available to respond, prevention-fi rst strategies collapse. Cybersecurity firm Palo Alto Networks has simulated a fully agentic ransomware attack in only 25 minutes, nearly 100 times faster than a conventional intrusion. When breaches unfold at machine speed, the only viable defence is rapid recovery.
But senior managers remain blind to, or overconfident in, their companies’ resilience posture. A mere quarter of organisations regularly track average recovery times at board level, the Economist Enterprise research reveals, leaving directors unable to answer how fast and how completely they could bounce back.
Recovery time objectives (RTOs)—the amount of time estimated to restore specific applications and workflows—are widely used metrics for gauging resilience. Yet they are rarely tested. Fewer than 10% of organisations had actually simulated their ability to meet established RTOs, according to Economist Enterprise’s findings.
When they are verified at all, tests tend to be plagued by two particular design flaws. They are either treated as components of tabletop exercises—semi-formal discussion-based simulations of disruption—or applied too broadly to the IT estate as a whole.
Rather than focusing on all applications, recovery teams should prioritise those critical for keeping the business running: Tier 0 and Tier 1 applications. These typically include functions such as identity platforms, core databases and enterprise resource planning (ERP) systems. When organisations cannot verify their users or authorise them to access company data, operations grind to a halt.
Leadership teams should establish cross-functional “centres of excellence”, advised by the board, that reflect the distributed responsibilities necessary for running resilient organisations. No single function should oversee business continuity on its own. This is a task that requires input and oversight from IT, security, recovery ops and beyond. Progress must be regularly measured and reported, using standardised metrics that can be benchmarked against past performance and industry peers.
Resilience is a process, not a point-in-time activity. Organisations that prioritise continuous improvement will be those best placed to insulate themselves against disruption in an era of robust and sophisticated cyber-threats.