From Security to Resilience:
Rethinking the Impossible
11th & 12th March 2026 • Park Plaza Victoria, London, UK
“Cybercriminals pose a seismic and increasingly sophisticated threat to businesses and national security. Yet Britain seems remarkably ill-prepared,” The Guardian October 2025
Secure everything? Or survive anything?
Cybersecurity professionals may take issue with the last words, but they surely understand that that’s what it looks like to politicians, shareholders, customers and the public in general. ‘What are ministers going to do about this?’ is an increasingly common question in the press. All of which means that at last the true significance of cybersecurity is being realised. Finally, then, will organisations spend the right money on the right things?
Preventing a Digital Breakdown
Airports grounded. Automakers stalled. Retailers offline. Breweries silenced. The economy runs on tech no one can fully secure. Technology implementation has been so fast and fragmented that organisations no longer understand what they have or who/what they depend on. Security has never been more important.
The Accountability Reckoning
Boards no longer accept ‘too hard to quantify.’ CISOs must speak the language of risk — or be replaced. If we can model credit default and hurricane exposure, and allocate capital against it, why pretend cyber risk is immeasurable? Security is operational risk. It should be measured and managed as such.
From Defence to Design for Failure
If security can’t guarantee safety, resilience must become the organising principle. A truly resilient enterprise could survive (expensively) without security. Security becomes an efficiency function — not a guarantee.
The ROI Reset
CISOs started off talking about data crown jewels and GDPR – but data losses are not existential, it’s data encryption and attacks on IoT systems that are. So, is uptime the only relevant metric?
Next generation tools and models: the rise of AI
Resilience and security need many of the same things: visibility across technology and processes; accurate inventory mapping; data integrity and availability; risk-based prioritization. So how will AI help with these?
The future of the cybersecurity stack
The stack of the future is a resilience architecture: dynamic, AI-assisted, and impact-aware. Its goal is not to prevent every breach, but to ensure that when compromise happens, the organisation stays in business. So how can firms re-think their security stacks and turn security into resilience?
CISO or Chief Resilience Officer? What's the new power base?
Resilience is the new seat at the table. If resilience not security is the endgame, what does that mean for hierarchies, budgets and responsibilities? Will the next generation of CISOs defend walls or rebuild faster?
100% security is impossible. So, security alone doesn’t keep organisations running, security + resilience does. Recognising this requires a fundamental shift at every organisation – in people, process, and technology.
