“Tools and technologies can support us, scale our capabilities and help us react faster. But resilience, I mean real resilience, is still built by people.”

After many years of building security programs and managing security incidents, one conviction has only grown stronger: we are entering an era where cyber risk is not just growing in volume, it is growing in intelligence, speed, and systemic consequence. And in that environment, the temptation to overdelegate to machines will be our biggest vulnerability.

Three forces will redefine the threat landscape.

AI-powered attacks will industrialize deception. Phishing will become precision-targeted. Impersonation will become increasingly difficult to distinguish from reality. The challenge is no longer purely technical; it is also epistemic: how do we know what to trust? Even the recent debate around models such as Anthropic’s Fable 5 and Mythos 5 shows how rapidly these capabilities are evolving, and how  seriously their potential misuse is already being treated by governments. The U.S. government recently moved to restrict access to these models for foreign nationals on national-security grounds, underlining how strategic such capabilities have already become.

“How do we maintain trust and critical judgment when deception is cheap, convincing, and automated? That question ultimately has a human answer, not a purely technological one.”

Third-party risk is no longer a side topic; it is now one of the main stories in cybersecurity. Many of today’s most damaging breaches start somewhere else, in a vendor, a platform, a processor, or a trusted partner that already sits inside the chain of trust. Nearly half of breaches now involve a third party, and more than one in three are estimated to originate there.

That changes the nature of the problem. The question is no longer only whether your own systems are secure, but whether the ecosystem around you is resilient. In a hyperconnected world, one partner’s weakness can quickly become everyone’s problem. Recent research shows that a single vendor breach now affects more than five downstream organizations on average, illustrating how rapidly cyber risk can cascade across a trusted network.

“In cybersecurity, trust remains essential — but blind trust has become a vulnerability.”

Identity is the new perimeter, and still one of the most underestimated. Compromised identity has become the master key that most attackers no longer need to steal by force, logging in is often faster, cheaper, and harder to detect  than defeating technical defenses, because malicious activity blends in with legitimate access. The Verizon DBIR 2025 confirms it: stolen credentials and identity misuse remain at the center of modern breaches.

“Knowing who has access to what, why, and whether that access is still justified is not simply a compliance issue. It is a matt er of resilience.”

The CISO of 2035 will be more strategist than technologist. AI will be a genuine force multiplier, faster detection, smarter triage, automated response. I embrace that. But AI will not decide to shut down a critical system when the business cost is ten million euros per hour. It will not explain your incident choices to a regulator. It will not rebuild client trust after a breach. Those remain human responsibilities, and they will demand more of us, not less.

Stop chasing 100% secure.

Build 100% ready. No organization is, or ever will be, fully secure. The question is not whether disruption will occur, it is whether you are ready when it does. Ready to detect. Ready to respond. Ready to
recover. Resilience is not a posture you achieve once; it is a discipline you practice constantly. Know your crown jewels. Rehearse your response before the crisis hits. Make security the DNA of the organization, not just its immune system.

“Cyber resilience, in the end, is not a technology challenge. It is a leadership challenge. The organizations that survive will be those where human judgment, accountability, and vigilance are not displayed on a poster but lived.”