A cyberattack does not have to bring an organisation to a standstill for days. Its actual impact depends largely on how quickly the business detects the incident, contains it and restores critical processes.
This is the principle behind cyber resilience. The aim is not to create an environment that can never be breached, but to prepare the organisation for a situation in which some of its defences fail.
In our previous article, we explored why cybersecurity should be treated as part of business risk management, how to develop a cybersecurity strategy, and the respective roles of the board, IT teams and process owners. Here, we focus on the next step: what needs to be in place and tested before the organisation has to respond to a real incident?
Policies on paper are of little use if they cannot be translated into practical action during a crisis. Readiness therefore needs to be built on solutions, procedures and behaviours whose effectiveness can be verified before they are put to the test in a real incident.
What are the signs that an organisation is unprepared for a cyberattack?
A lack of readiness does not necessarily mean a complete absence of security measures. An organisation may have tools, procedures and backups in place, yet still be unsure whether they will work during an actual incident.
Training is provided, but its effectiveness is unknown
58% of employees who work at a computer have not received any cybersecurity training in the past five years. Meanwhile, 24% of businesses do not assess what employees have learnt after training.
Simply scheduling a training session does not mean the team is prepared. The organisation needs to know whether employees can recognise a threat and respond appropriately.
Employees are afraid to report mistakes
16% of employees admitted to concealing an incident from their IT department for fear of disciplinary action or dismissal. In practice, this costs the security team valuable time that could otherwise be used to limit the impact.
Backups exist, but no one has checked whether they can be restored
Only 31% of businesses maintain backups isolated from their main network, and just 23% regularly test whether they can restore systems from those backups. This illustrates a broader issue: having a safeguard in place is not the same as knowing it can be relied upon in a crisis.
What needs to be in place before an incident?
Identify what the business needs to keep running
The first step is to identify the systems, data and processes whose unavailability could bring core business operations to a halt.
It is also worth estimating the cost of downtime, taking into account factors such as additional staff workload, contractual penalties and lost customers. This helps establish which assets require particular protection and which should be restored first.
Secure the foundations of your infrastructure
Essential measures include:
- multi-factor authentication for work accounts,
- infrastructure segmentation to make it harder for an attacker to move between systems,
- properly protected backups,
- regular testing to confirm that backups can be restored.
The priority, however, is not simply to introduce more security controls. It is to ensure that those controls address actual risks and will work when needed.
Prepare your employees
Employees should understand:
- what to avoid in their day-to-day work,
- which behaviours or messages should raise suspicion,
- what to do when they identify a potential threat,
- where to report an incident and how quickly to do so.
It is equally important to create an environment in which reporting a mistake, such as clicking on a phishing link, prompts an appropriate response rather than encouraging the employee to conceal the problem.
The efficiency of these efforts can be assessed through measures such as controlled phishing simulations carried out before and after training.
Establish how threats will be detected and incidents handled
The organisation should have mechanisms for detecting suspicious activity as quickly as possible, alongside an Incident Response Plan (IRP) with predefined procedures for scenarios such as phishing, ransomware and data breaches.
The plan should extend beyond the IT team’s technical response. During a serious incident, it must also be clear who makes decisions, when escalation is required and who needs to be involved.
Prepare the organisation to restore operations
Stopping an attack does not mean the business can immediately return to normal. Incident preparedness must therefore also cover the recovery of business operations.
The organisation should establish in advance:
- which processes and systems need to be restored first,
- how long they can remain unavailable without critical consequences for the business,
- which data and backups can be used for recovery,
- who is responsible for deciding the order of restoration,
- how the business will operate until its systems are fully restored.
Disaster recovery procedures and backups only deliver value when the organisation knows how to use them in practice. Preparation should therefore include regular recovery testing, rather than simply checking that backups have been completed.
Having a plan is not enough – you need to know it will work
An organisation’s readiness for a cyberattack cannot be verified through documentation reviews alone. Its response needs to be tested in practice.
Data recovery testing
Backups should be restored regularly in a test environment. This verifies not only that the data exists, but also that it is complete and can be recovered within a timeframe that meets the needs of the business.
Simulated social engineering attacks
Controlled phishing campaigns help assess whether employees can recognise threats and whether training is making them less susceptible to manipulation.
Incident response exercises
The response plan should also be rehearsed with the people who would be responsible for making decisions during a real incident.
An exercise can be based on a predefined scenario, such as a critical system being encrypted, a data breach or an account takeover. Its purpose is to establish whether participants understand who makes each decision, how escalation works and which processes take priority.
Testing exposes gaps while addressing them is still part of a preparedness exercise, rather than an actual crisis.
How can organisational readiness be measured?
Preparedness should be assessed using specific indicators. The author’s material highlights measures such as faster threat detection, more efficient business recovery, phishing simulation results and the speed of incident reporting.
In practice, it is worth monitoring:
- the time taken to detect an incident,
- the time taken to respond and contain its impact,
- the time needed to restore critical processes,
- the results of data recovery tests,
- the results of simulated phishing campaigns,
- how quickly employees report potential incidents.
The aim is not to produce a single „cybersecurity score”. What matters most is whether successive tests, exercises and real incidents show that the organisation detects problems sooner, responds more effectively and experiences shorter periods of disruption.
Assess your business: are you ready for a cyberattack?
Rather than waiting for a real incident, assess your organisation’s readiness now.
- Do we know which processes, data and systems must remain available for the business to carry out its core activities?
- Do we know how long we can operate without them and which should be restored first?
- When did employees last receive practical cybersecurity training, and have we assessed its efficiency?
- Does someone who makes a mistake or notices suspicious activity know where to report it – and will they do so without fear of repercussions?
- Do we have a tested Incident Response Plan, and is it clear who makes the key decisions during a crisis?
- When did we last carry out a test restoration of our systems from backups?
- Do we have mechanisms in place to detect suspicious activity quickly enough?
- Have we ever tested the organisation’s readiness by simulating a serious incident?
Conclusion
Being prepared for a cyberattack does not mean assuming that the organisation can prevent every incident. It means knowing which processes must be protected, detecting problems promptly, having a response in place and being able to restore critical business operations.
The true measure of cyber resilience is therefore not simply the number of security controls or procedures in place. Far more revealing is whether they have been tested in practice.
The first step may be to answer a simple question before investing in another tool: if a serious incident occurred tomorrow, would everyone involved in the response know what to do – and are we confident that the mechanisms needed to restore operations would actually work?
Sources
https://www.parp.gov.pl/component/content/article/91061:dane-jako-nowa-waluta-przedsiebiorstwa
Cyberportret polskiego biznesu 2026 – Raport – Cyberbezpieczeństwo firm w obliczu nowych wyzwań – Eset, Dagma Bezpieczenstwo IT – 2026
