As cybercriminals and nation-state adversaries turn to increasingly sophisticated tools and techniques, including deeply buried
supply-chain intrusions and AI-powered
phishing campaigns, attaining total immunity against online attacks becomes ever more distant.
If 100% protection is out of reach, then what matters more is flexibility, adaptability and survival. What matters is
cyber resilience, the ability to quickly bounce back from a potentially crippling information-technology outage.
“Cyber resilience mean[s] how the whole organization comes together when there is some type of interruption to that whole IT estate, whether it’s a cybersecurity breach, a man-made incident or a natural disaster,” says Theresa Lanowitz, Chief Cybersecurity Evangelist and Head of Thought Leadership at LevelBlue.
Sadly, few organizations are truly cyber resilient. In a recent survey of 1,500 corporate executives worldwide conducted for
LevelBlue’s 2025 Futures Report, only about 100 companies, or 7%, were identified as being cyber resilient.
However, these organizations shared certain common characteristics that separated them from the rest. And these traits can be learned or acquired.
The five characteristics of cyber resilience
The first and most important common trait among cyber resilient organizations: they have aligned their cybersecurity and business goals.
The executive leaderships of these companies grasp the importance of cybersecurity and cyber resilience and fund those efforts accordingly. Their IT and cybersecurity teams understand that their organizations’ business goals take precedence over other issues.
“
Aligning cybersecurity and the line of business is critical, so that the cybersecurity team understands the critical few objectives of the business and you can align what you’re doing on cybersecurity in a more strategic way versus a tactical way,” says Lanowitz.
All organizations deemed cyber resilient in the LevelBlue survey said they had aligned their cybersecurity teams with their lines of business, compared to 66% of survey respondents overall. More granularly, 57% of cyber-resilient companies said they had “effectively aligned business risk appetites with cybersecurity risk management” versus 43% of the general pool.
“An organization with a cyber-resilient culture is a place where everyone, at every level, understands their role in cybersecurity and takes accountability for it — including protecting
sensitive data and systems,” says the 2025 Futures Report.
AI used both for offensive and defensive purposes is high in the priorities of cyber resilient organizations. For this reason, the second shared characteristic of such companies is the ability to effectively defend themselves against AI-powered attacks.
The third common trait is that cyber resilient organizations were more likely than others to use AI in their own cyber defenses.
“They’re not afraid of embracing AI on the cybersecurity front, so they’re able to defend against those
AI-powered attacks,” explains Lanowitz. “But they’re also using AI in their own cybersecurity.”
Concerns about AI-powered adversaries loom large among respondents in the LevelBlue survey. While 42% said they expected AI-fueled attacks to impact their organizations, only 29% felt prepared to counter them. Likewise, 44% believed that
deepfake attacks on their organizations would happen, while 32% considered themselves ready to handle them.
“They expect that there’s going to be an AI attack, but they’re not really prepared for it,” says Lanowitz.
Along similar lines, 59% of respondents said that it was getting tougher for their employees to distinguish deepfakes from genuine video, images and voice recordings. And 48% admitted that their organizations had to get better at defending against attacks from AI-powered adversaries.
Nevertheless, many of the executives surveyed felt confident — perhaps over-confident — that their companies were prepared to face AI-powered attacks, and to use AI-powered defenses in response.
“More than half (52%) say they are highly or very highly competent at defending themselves against AI techniques,” the report says, “and in implementing and using AI to enhance cybersecurity (54%).”
Not all the tools and techniques used by today’s adversaries involve AI. Phishing scams have been augmented by variants involving text messages (
smishing), voice calls (
vishing) and QR codes (
quishing). We’ve heard about the devastating
NotPetya and
SolarWinds supply-chain-software attacks, but less obvious is the
ongoing poisoning of open-source repositories with malware and backdoors.
“We’re seeing these emerging attack types: quishing, software-supply-chain attacks, smishing, deepfake and
synthetic-identity attacks, AI-powered attacks, and then brute-force attacks,” says Lanowitz. “One of the top phishing groups came out and said, ‘We don’t need to install malware on your computer. We can just weaponize things that are already there with poor security.'”
The fourth characteristic that sets cyber-resilient organizations apart from the rest is their ability to resist new types of cyberattacks, a stance partly fueled by strategic investments in incident response and threat intelligence.
In the LevelBlue survey, the differences were stark:
94% of cyber-resilient companies said they were investing in supply-chain security, while only 62% of the entire survey group had
91% of the cyber-resilient group were implementing advanced threat detection, versus 63% overall
48% of the elite group planned to subscribe to threat-intelligence providers, as opposed to 39% of the whole survey pool
45% of cyber-resilient organizations were implementing zero-trust network architectures, compared to 35% overall
“They’re ready for these new types of threats, these new types of attacks that they’re going to be experiencing,” Lanowitz said. “There’s a lot of investment in
application security. A lot of investment in machine learning, for pattern matching. A lot of investment in cyber resilience processes across the business.”
Finally, the fifth characteristic was simple: Unlike the bulk of the 1,500 organizations surveyed, none of the cyber-resilient organizations had experienced a major cybersecurity breach in the previous 12 months.
The reasons for that are not simple, however, as they have to do with creating an adaptive and flexible cybersecurity culture. Some statistics from the LevelBlue survey hint at what’s going on: 79% of the cyber-resilient companies felt comfortable taking risks with innovation due to their cybersecurity confidence, as opposed to 61% of the overall group.
Likewise, 61% of the cyber-resilient group said they allocated cybersecurity funding to every new project from the get-go; only 46% of the larger group did.
“They want to implement new technologies, processes and procedures,” says Lanowitz. “Being able to take that bolder approach is one of the things that comes from being cyber resilient.”
How to achieve cyber resilience
The 2025 Futures Report lays out four steps that organizations can take to become cyber resilient.
1. Elevate cyber resilience by convincing company leadership to make it a core business goal. This goes further than getting the C-suite and the cybersecurity team on the same page. LevelBlue recommends that cybersecurity-related known progress indicators also be tied to leadership roles.
“It’s about building a proactive culture, to align and collaborate to break down those silos,” says Lanowitz. “The C-Suite really has to take on cybersecurity.”
2. Create a cyber resilient culture by stressing cybersecurity best practices at every level of the company. All employees should feel comfortable reporting potential breaches, threats or errors.
Training programs should include how to spot the latest threats and attacker techniques.
3. Be proactive about cyber resilience. Like the cyber-resilient organizations in the LevelBlue survey, make investments in incident response, advanced threat detection and threat intelligence, as well as in
vulnerability management.
LevelBlue also recommends moving to a zero-trust architecture if possible, and to not be afraid to engage outside advisors and
managed service providers to fill holes in your security posture.
“They want to bring in consulting organizations, they want to engage with managed security service providers,” says Lanowitz. “They know they can’t do everything on their own.”
4. Focus on software-supply chain resilience. Unless an organization uses only its own code, it’s reliant on
third-party software suppliers and/or open-source repositories. Verify the security stances and credentials of vendors, implement
code review and analysis to catch vulnerabilities, and carry out assessments of suppliers.
But again, the primary incentive for cyber resilience must come from the top of the organization and involve the cybersecurity team from the very beginning.
“Aligning cybersecurity and the line of business is critical,” says Lanowitz, “so that the cybersecurity team understands the critical few objectives of the business and you can align what you’re doing on cybersecurity in a more strategic way versus a tactical way.”
“The cyber resilient organizations are far better prepared for what’s coming next,” she adds. “They are more prepared. They’re more aligned. They understand.”
