SPECIAL EDITION: Why cyber resilience is business critical

In 2026, cyber attacks are far from the sole provision of cybersecurity professionals. These incidents pose real, hugely destructive impacts for businesses, and can seriously impact employee and customer experience in the short and long term. It's not a matter of if, but when, your business is targeted by threat actors. But in the gap between realising this and implementing the right cyber resilience strategy, there's potential for enormous financial losses. How can businesses prepare for the worst? And what role can a trusted partner play in reaching true cyber resilience? You're listening to a special edition of the ITPro podcast. I'm Rory Barthgate. In this episode, in association with 11.11 Systems, we're joined by Sean Tilley, Senior Director of Sales EMEA at 11.11 Systems, and Sam Woodcock, Senior Director of Solutions Architecture EMEA at 11.11 Systems. Sean, Sam, welcome to the show. Thanks, Rory. So, to start with, how well understood is the business need for cyber resilience at the moment? At the moment, I think the situation is, from a positive perspective, I feel like the situation's improving. I think we've been working in this space for over a decade at this point. Previously, it was very inconsistent, very minimal in terms of awareness of the need for cyber resiliency. But actually, in recent years, because of the nature of attacks, because we've seen attacks within the news hitting high-profile organizations, more so now organizations in similar industries, similar verticals, they're now starting to see the real impact from a financial perspective and a business risk perspective. And I would say that's led to that improvement from our side as well, from what we've seen. And what we're also seeing, businesses are seeing, that cyber risk isn't just a security issue now, it's actually how, if something happens, the business actually recovers and can remain operational and service their customers. So, we have seen that shift of mindset, and it really is becoming a commonplace that organizations are actually measuring how ready are they, what is their business capable of, and how can they remain resilient during one of these incidents. I'd add, Rory, from my perspective, I definitely see it improving. Adding to some of the comments that Sam said, cyber risk can still be seen very much as a security issue rather than an operational resilience issue. And how we look at resilience, what it means to us, is staying operational during an actual incident and being able to recover quickly afterwards. That means having well-tested plans, a clear ownership, along with a route to evidence in the capability of such testing and recoveries, can be demonstrated to board and regulators. I would also go on to add, looking at the report and the research that we went through, that definitely showed that cyber incidents are a lot more common nowadays. They're very costly, and what we saw was that it's the recovery element is where most organizations struggle. Adding to that, there is more scrutiny now from regulators, which is also meaning organizations need to evidence the level of resilience that they've actually got. What I would say, the positive from the research, and certainly from what I see from direct customer engagement, is that cyber resilience is a more consistent key issue at board level, and that truly does demonstrate that there's a greater awareness and need for resilience within the market now. You mentioned the report there. 11.11 Systems Global Cyber Trends Report 2025 found that 82% of companies have experienced a significant cyber attack. And 57% experienced two or more significant cyber attacks. What are some of the most pressing cyber security threats the businesses are actually facing right now? I think exactly. I mean, from the report side, it was really eye-opening, I think, for a lot of organizations that have consumed that information, that research. I think the other thing to mention, just first of all, is that there's a lot of other research out there in the market that point towards similar statistics organizations are facing. And I think what was kind of interesting and surprising to a lot of people that read the report was that it wasn't just a single attack that organizations are now having to contemplate and plan for. The most common scenario, in fact, is that organizations are experiencing multiple attacks in the same calendar year. And if you think to your own business, the listeners that are listening to the podcast today, what would that like be for yourselves if you see multiple attacks within that same space of time? Now are you ready to recover from that? So that's where I'm really seeing that, I guess, the evolution is that previously maybe it was a not-if-but-when type of scenario. Now it's actually planning for these incidents happening much more frequently to organizations. And what we really spend a lot of time working on from an advisory perspective is, are you ready to recover? And do you have the confidence in that capability? And that only comes from the ability to test and validate what you have in place. That needs to become almost the culture of the organization, be planning ahead, testing, and verifying. Because at that point, you'll have a true understanding of how long is it going to take to actually get my business up and running? And was it successful? And did it meet the business objectives that I have as an organization in general as well? And to add to some of those points from the research, from the report, is there is an element of a gap in confidence. I think you'll see the organizations feel ready to recover. But many haven't actually proven it end-to-end, especially not under any kind of realistic conditions. So even though the kind of cyber threat is increasing, it hasn't impacted enough to do those full-on realistic conditions where people have been able to demonstrate their capabilities. And I think what I would recommend is that that shift needs to be kind of moved from intent to evidence. So having those tested recovery plans, have an architecture that's designed specifically for recovery, clear recovery objectives, and making sure that business leaders actually understand what it means and they actually own the recovery piece because the responsibility ultimately sits with them. I think when you look at our research as well, some of those numbers, they align directly with the regulatory expectations that firms can actually withstand and recover from severe but plausible cyber scenarios without any real intolerable harm to customers or actually to the UK markets, to be fair. So a lot of the UK regulars are now increasingly asking, show us, show us your impact tolerances, show us your test results, and actually demonstrate how quickly you can restore those important services and not just the systems themselves but the services after an attack. It's clearly a crucial issue, that point of recovery. And there's a key stat from the report that really stands out to me, that stat of almost half, 48% of respondents saying that downtime, just one hour of downtime, cost them between $100,000 and $250,000. A third put this figure between $250,000 and $500,000. Is the cost of downtime also kind of beginning to sink in for businesses? I believe so, yes. And I think from the first question, right, around how more aware people are in terms of cyber resilience in general, I think, again, you kind of log in, you see the news each day or each week, you'll see some form of cyber incident impacting an organization. And there can be tangible real world impact that you see not only from a reputation side, but also, as the study kind of pointed out, from a financial perspective, it can be very significant. If we think about, as an example, Jaguar Land Rover, for example, there was a lot of articles around the financial impact, not only on that organization, but the downstream providers to that organization as well. And them seeing financial impact themselves. So I think, again, because we see these real world incidents actually impacting organizations that they're spoken about in their research, and we think about those a lot, organizations, I think, really now see that this is the reality and that needs to plan ahead around, how am I actually going to get my minimal viable company back up and running? How am I going to get my business operational again? And what is the terrible amount of downtime that I can actually suffer from an organizational perspective? What we saw from the research was that organizations are seeing not just hours of downtime, but days and weeks. If you think about your own organization, what is the financial impact if that happens to yourselves as well? So definitely have seen that awareness kind of sinking in, and it has led to people making investments or starting to make investments, not only from a security side, but also the recovery side, which is often kind of missed out on as well from our side. I'd also say downtime, it's no longer an IT inconvenience or a short-term disruption. It's very much a direct quantifiable financial hit. I'd say that's before you even consider regulatory exposure, the reputational damage, or even the long tail of customer churn that can happen. In real incidents, downtime often lasts hours or days. Therefore, customer trust is impacted and recovery efforts definitely escalate quickly. I'd say our engagement really demonstrates that downtime is now firmly a board-level risk, which is good to see in the market. And cyber readiness and cyber recovery readiness is definitely a business imperative, not a nice to have, which is what I would say we used to see in the past. And to help with that, organizations need the right mix of people, process, and technology in order to restore operations quickly. If I just touch on financial services, for example, from a regulatory perspective, they're expected to set and stay within defined impact tolerances for important business services. That really does force a hard conversation between operational risk, technology, and finance. That question very much being how many minutes or hours of disruption can we really afford from both a commercial and regulatory perspective? And can our current recovery approach credibly deliver that under attack conditions? And what we generally do is we run lots of exercise with clients, which helps demonstrate what that true cost of downtime is to that organization specifically. And that really does help support future resilience investment because there is that large cost in downtime, as you mentioned at the start, Rory. You mentioned there people, processes, and technology. And I think it's worth considering at this point whether if you're restoring systems or even things like preventing escalation or even keeping an eye on the landscape, is it possible to achieve all this alone? It's a great question. I think what we found in practice, and this is encompassing both the security aspect, the preventative aspects, the recovery elements, and all of those things combined, what we've seen in the market just generally is there's a lot of demand for skills internally or for hiring for your own organization. And there's a lot of kind of, I guess there's a short amount of supply for that skillset, right? If we think just about security, that's top of mind for a lot of organizations. They're looking to improve upon their security posture, but it can be hard to find great people that can solve for that challenge. And the same is said for the recovery aspect, right? Traditionally, a lot of organizations have to try to go alone. They've tried to fight that battle and the recovery element themselves. But again, I think in that similar vein to security, we also see that gap in the market in terms of the supply of experts who can actually navigate this new world of cyber recovery compared to the traditional disaster recovery. And everyone's trying to get those people. And tying into all of that, we're seeing organizations with limited time, limited budget, and also they have that general lack of expertise in their business. And also, while all of those things are said, a lot of organizations are looking to innovate. They're looking to utilize AI. They're looking to push their business forward from a objective perspective. And they don't really wanna potentially be looking after, for example, the recovery element because of that lack of skillset or because they want the focus on that innovation. So what we've seen more so from organizations, specifically in recent years, based on what we're seeing from a research side, is they are contemplating working with experts in their field. And that allows them, again, to retain their business knowledge, their business objectives, and focus on those elements, but let somebody else take care of the security elements in the recovery side. And that focus is really essential for that business. But also, tangibly, what that gives you as an organization is if you find the right expertise, then you have more confidence, you have more capability and more ability to actually recover if something happens. And as we saw in the statistics, these things are happening, again, frequently, but also multiple times. Having an expert who can have experienced those things across the board, that's really important to a lot of the organizations that we speak to. Yeah, it's definitely not a battle they should, or I would say realistically can fight alone across most organizations. Maintaining that effective prevention, response and recovery really does require specialist skills and ongoing investment. I'd say this is where a resilience partner adds real value. And adding to some of the key points that Sam just raised, this is where that true resilience partner, they understand building out proven runbooks, they offer to support and ensure repeatable testing. There's also areas that can be delivered for clean room recoveries. And that is a challenge for a lot of organizations to ensure there is true clean room recovery available and actually having that experience support when it matters most. So instead of trying to build everything internally, organizations can buy time and assurance by leaning on a partner that truly does live and breathe these types of scenarios and these types of testing and recoveries. I would say a true partner doesn't just provide tools, they really do get involved with you as an organization to help you evidence resilience, support scenario testing and provide the artifacts that is required from a risk audit and regulatory teams need perspective. So having that kind of partnership in place, it does enable organizations to really focus on what's key to them, which is bringing the business back online, the external communications, but also the ongoing day-to-day just innovation that's required for businesses to keep moving forward. So I think my underlying piece is it's a battle that you probably wouldn't want to go into alone. We've talked about resilience quite a lot already, but for many cyber leaders, the focus of their career so far has been on prevention. There's been a lot of demand and discussion around prevention. What is the difference between resilience and prevention in your own words? Again, a great question. I think we have seen that similar thread from our side, where a lot of organizations from their perspective are building upon their preventative aspects, trying to stop the cyber threats from impacting their organization, stopping these incidents from happening in the first place. But actually, if you look at, I guess, the space over the last number of years, even though there has been a lot of, I guess, focus, time, money and attention spent, as well as great technology evolutions from a cyber security side, we're still seeing the number of cyber security incidents rising. And those two things show that, again, obviously it makes sense to combine the technology, the people in the process, and to continue to invest in prevention. But obviously the evidence shows that you still need to have the ability to recover and the ability to keep your business running, to recover quickly, to do it safely and predictably. And that's what we mean by resilience is it's not one or the other. It's a combination of both of these aspects being required to ultimately can kind of round out what you have from a resiliency perspective. From our approach, we focus on how we can help protect, how we can provide the capability to detect any ongoing incidents to potentially reduce the scope of those attacks. Also, again, when we talk about the combination, it's about how do we respond? How do we recover? And also ultimately, can we measure that? Is it actually targeted where it's going to make the most difference and reduce the risk where the business wants that resource kind of focused on as well? And again, by focusing on all of the elements of the spectrum and aligning to a framework, that's going to give you the best possible route to again, protect and defend and recover should one of these things happen to your organisation as well. And having spent 25 years in the industry, from my view and how I take it, prevention is about stopping incidents from happening or spreading, whereas resilience is really accepting that incidents will happen and focuses on keeping the business running, recovering quickly and doing so safely and predictably. I think where we've seen the industry shift is from that prevention only thinking to more of a broader focus on readiness, proven recovery, especially as I would say, what we've seen is AI driven attacks are really eroding the margins of purely preventative controls anymore. So you've got to think of it more as that overall resilience piece. I'd say that really does align closely with a lot of the operational resilience agenda that we see. Certainly across regulators, they don't expect zero incidents, but they expect you to show that when disruption happens, you can keep those important business services within those stated impact tolerance levels, including under cyber scenarios, to be fair. And that's resilience, not perfection. So the ability really to absorb shocks, recover quickly and learn from each event. I'd say our approach at 11.11 has always been to bring together protection, detection, response and recovery so that organisations can restore operations with confidence and not just restore data, which is what we're certainly seen as in the past. It's very much about designing environments, processes and having the governance so that recovery is repeatable, testable and auditable, not improvised at that point in time. At the end of your answer there, you raised an interesting point, which is the importance of end-to-end cyber resilience. When a business is looking to really deploy that and enable proper end-to-end cyber resilience, how can they go about it? Yeah, so again, great question. We spoke just before around the need for preventative aspects and recovery aspects and having those things combined. What we often find when we speak to organisations, however, is we think about end-to-end, it's about encompassing what's important to the business, what will provide the ability to make sure my business can just stay operational from a minimal business perspective, but also what is important for customers and users and services. Oftentimes we find it can be hard for a lot of organisations just because of the nature of innovation, the speed and routes to market. A lot of organisations maybe don't have a true handle on where all of their applications and data live. Right now, organisations are shifting from a traditional on-premises infrastructure to consuming cloud-based services, software as a service, or AI capabilities. And because of the speed and the nature of complexity, a lot of organisations that we work with potentially don't have a handle on where those things are, first of all. But also there's that exercise of understanding what matters most to the business, which of those applications are essential, which are top tier, tier one priority, and which are lower level priority. From starting around an approach towards an end-to-end, you have to identify what matters most, and then align the right technology, the right people and process to protect it properly and enable the recovery as well. And once you have that as your starting point, your guiding process to the solution set, then you can layer on, how am I detecting that incidents are happening? How am I responding to that and limiting the actual impact of those incidents? And also, what should I be testing? What should be validated? And how frequently should those things be achieved based on the criticality to the business? And through that process, this isn't just a one-time exercise. What we often find is organisations may have gone through those various stages and put something great in place, but IT changes every day. Data is growing every single day and week. And that plan for protection recovery can become out of date very quickly. So what we recommend also is an end-to-end approach also needs to encompass change management. And change alignment as well to make sure that it doesn't just remain static, it evolves with the business. And again, when you come to recover or protect, you're not missing a blind spot along the way and you can ultimately have a successful outcome as well. Yeah, our recommended lifecycle is identify, protect, detect, respond, recover, which very much mirrors the NIST framework. And that is underpinned how we go about our cyber recovery platform. From our perspective, end-to-end, it also means aligning technology capabilities with the regulatory expectations. And I know I've touched on this a couple of times, but mapping those important business services and then understanding those underlying assets and even suppliers that form part of those business services, defining those realistic impact tolerances, and again, proving through the testing scenarios that we've mentioned, including cyber attacks. And that will really help in terms of that demonstration and taking it from start to finish. So as I say, just adding onto the piece that Sam said, from making sure we get in early days to do that whole understanding piece and then managing that on a cyclical basis with it because things do change quite regularly from both the business system and IT perspective. In the aforementioned global cyber trends report, 23% of respondents stated that better staff training and awareness would improve their cyber resilience. So how can leaders deliver effective cyber resilience training? So cyber resiliency training or just cyber security awareness, to me, is again, we've spoken a lot throughout this podcast around people, process, and technology, and you need all those three things to provide a successful outcome. Similarly as well with cyber resiliency and training and awareness, it needs to be embedded in the culture of your organization. That means it's not just a yearly exercise and everyone gets an email and they go through a training exercise. It needs to be a consistent training that occurs throughout the organization at different levels. And it's also practical and role-based, not just that tick box exercise. That's really important. They need to go through training that aligns the real world that we see and to be able to experience it at some level to actually get an outcome or to get more awareness within the organization and start to build that culture. Of awareness to build the response as well. What we also find is to do this more frequently as well. Again, as I mentioned before, traditionally, maybe in the past, this was a yearly exercise from a compliance side and that was it. Again, by making this more frequent, you can start to measure that level of awareness, that level of culture towards cyber security and resiliency. And by measuring, you can improve. And obviously, it's a consistently moving target as well. You're never going to have a point where everyone is 100% aware and 100% ready. There are going to be new challenges, new solutions or new threats every single month that an organization faces. By measuring these things, we can then align to what improvements we need to make and target the awareness and training towards those gaps that we're identifying as part of that exercise as well. What we feel people should know is what do I do in the first hour of an incident? What's my communication look like? What pieces am I responsible for? What decisions do I need to make? And how does escalation work within that remit as well? And that's similar to the IT teams as well. They need to follow what their runbooks look like, follow those through, and also validate the systems and the data. So people need to have that awareness across their roles, across that practical use case. And again, we need to make sure that this is a culture because it needs to be something that you know, if something happens, it feels more comfortable to enact and to utilize under pressure as well. And culture is a big thing that you mentioned there, Sam. So regulators are increasingly looking at specifically culture and governance as part of resilience. So that starts tying into more senior management accountability, clarity of roles, as Sam mentioned, evidence that playbooks have been walked through in anger. We find a lot of scenario-based exercising is a good way to kind of improve training and actually capability within teams. That kind of scenario-based training and exercises would include communications with regulators and with customers. And it's a way of actually being able to, shall we say, turn training into more demonstrable capability by going through those scenario-based exercises. From an 11.11 perspective, we've delivered a number of cyber readiness assessments, cyber incident tabletop exercises. And one of the more recent things that we're looking at delivering is ransomware scenario-based exercises. And all of that is truly looking to improve understanding of, you know, what things can happen, what things can go wrong, and therefore, you know, how to react. And that does really help build confidence and therefore builds more capability throughout organizations. So that's how, from my perspective, we can see leaders really helping to implement more of that kind of culture and governance from a training perspective around cyber resilience. Both of you just mentioned exercises. Sean, you mentioned ransomware exercises specifically. I'm wondering what role can disaster recovery tests play when forming your overall cyber strategy? Testing is super essential. And actually, we've seen varying degrees of testing throughout the years that we've both been operating and working within this space. We found some organizations who are really not testing at all. With that lack of testing, you never know how long is it going to take me to recover, what other steps I need to take place to get a successful recovery in place. This just can't happen if you're not testing. I think what we've seen in recent years is testing has become more frequent, but potentially is still only an annual exercise and maybe, again, aligned more to a ticking a box type of scenario. What we've also seen throughout the research is at the same time is that we have seen an uptick in the number of organizations are making testing a priority for their organization. They're doing biannual testing. They're doing monthly testing or quarterly testing. Again, by testing more frequently, you can identify gaps sooner because, again, we spoke before around the nature of IT. Things are changing. Applications are changing. Data is growing. You may miss something. And by testing, you highlight that gap and you can resolve that. Testing, again, also helps you understand if this application is affected, not just the whole business, but this specific critical application is impacted. How long is it going to take me to recover through that testing? And when I report that testing back to the business, is that acceptable? And does it align to the SLAs and the goals of the organization? If not, again, by testing, you validated that you have a gap and you need something to solve for. And you can go about remediating that and exposing that and running through the clear prioritization of resolving that challenge. Again, what we've also found is traditional organizations are focused on how to recover from a traditional disaster recovery event, like a hardware failure or a network going down or a data center level issue. But now with cyber recovery, restoring systems alone isn't enough. You need to validate, to Sean's point earlier, is the copy of the data clean? Is it free from the security threat that impacted it in the first place? And can I then get back up and running in that type of scenario? So again, when we're working with organizations, we're doing more cyber recovery related testing to understand in that type of scenario, again, what is the recovery time? Can I get back up and running? Is everything covered? And is it clean and uncorrupted? And again, it's essential. And I think the good part of the research and what we've seen is because these impacts are happening to organizations now and they're being publicized, we have seen more action in that space as well. Yeah, and from what Sam is saying, I think that's where 11.11 come in from our recommendation perspective is that you do perform two distinct tests each year. One of those is that traditional disaster recovery for let's call it the physical type disasters. Then the opposite side is the cyber recovery test. So I know, Sam, you touched on both those points, but that's why, again, from our perspective, we recommend you do both of those tests each year. So cyber recovery test would be something that likely mimics ransomware or a data breach scenario versus, as I mentioned, that traditional disaster recovery test side of things. So that would be how we would look at making the kind of testing piece for more part of a cyber strategy from that side of things. And again, you know, I come back to the regulatory piece, but the expectation is that you have got regular and well-documented testing support, not just from operational readiness, but also, you know, to be able to provide that tangible evidence that you are within your impact tolerance levels that we've mentioned. So again, you know, that for me is key to that business cyber strategy perspective. In a broader sense, how does 11.11 Systems help with overall business continuity? We ultimately are looking to make, I guess, the recovery predictable and repeatable. That's the end goal, right? We spoke a lot about the nature of testing and validation and preventative and recovery elements. Ultimately, we're wanting to make sure that the organization has a good posture from a cybersecurity side, but ultimately we can get the business back up and running. Spend a lot of time working with organizations from a lifecycle perspective to really understand, first of all, what are the critical business applications and data within that organization? What solutions are aligned to those sets of applications today? And where are the gaps that we can help organizations in terms of making sure that we have more confidence and predictability in that recovery as well? So we're really focused on, regardless of where the customer is from a technology landscape side, we have great technology, but we also have expertise and the right process aligned to ultimately the scenarios that we've been speaking about today in terms of cyber incidents, ransomware, and the traditional disaster recovery events that we still need to think about and take care of. So we spend a lot of time modernizing technology, but at the same time, again, identifying where we can make improvements and take ownership over the actual recovery itself for an organization and prove out to them and their stakeholders that we can predictably get that organization back up and running in a clean state that, again, will not be impacted further by the types of incidents that we're seeing nowadays as well. I'd go back to the commentary from earlier. We made this a full end-to-end lifecycle from discovery to design and then to running and that ongoing lifecycle management. Other areas that we are in supporting with within that overall business continuity element is getting, you know, an understanding within organizations, running business impact analysis, helping them build out their business continuity plans, incident response plans, that's another piece, running crisis communication sessions because I think we've seen it in the past where an incident does happen, the actual communication part, both out to, let's say, the wider market, out to internal, out to customers, out to regulators, that has been a challenge and that impacts the actual operational future of the business if you do not communicate in a manner that, you know, supports the future of the organization. So those types of things help us or help organizations really build out the business continuity and, as I say, resilient side of things in greater detail and that's where 11.11 come in to support from that side. We've spoken about recovery quite a lot and for some businesses that may mean just using data backups. What other dimensions should be front of mind for business leaders when it comes to a comprehensive recovery strategy? I think it's a great starting point to have a backup solution in place but oftentimes we find gaps even with just a very basic setup of having data backups and backup solutions in place. Where we spend time with those types of organizations is do you have a copy of that critical data off-site in another location? Is that data within that other location in a state that cannot be deleted or compromised by a threat actor? Because what we've seen from our perspective with just the backup space is prior to launching an attack within an organization the threat actor will actually look at what backup technology you have in place today. Do you have an off-site copy? Is it in a state that I can compromise as a threat actor? And one of the first things that they'll go after from their side is actually to delete the data where possible in both the primary and the off-site copy. And so we spend a lot of time in understanding what do you have in place for that solution today? Does it have strong role-based access? Does it have segmentation away from my production infrastructure? Those things are essential because it reduces the ability for a threat actor to compromise that primary copy. Also, we spend a lot of time understanding what is their off-site strategy? Do they have immutability or the ability to prevent deletion? So when they have that gap, we can solve for that from our side very easily. And again, that means when the threat actor starts to go after that technology, we have the ways and means to make sure that that secondary copy or that third copy in the cloud cannot be tampered with. It's a route through to enable the organization to restore back to that primary location. If we take that further, what we also see is oftentimes, even with that, there's a gap in terms of a clean, isolated recovery environment that organizations simply don't have. And so, yes, you may have a copy primary, a copy in the cloud, and it's in a state that can't be tampered with. But do you have a safe landing zone that's completely isolated that enables you as an organization to bring back that backup and establish, is that a clean, healthy state to go back to? Or will it be reinfected? Or is it already infected by that ransomware scenario? So clean room is an area that we see a lot of gaps with that we can solve for at 11.11 to make sure that an organization can recover safely in an isolated place to make sure that that is a successful outcome. To tie into all of that, what we see is a lack of a second site or a second isolated infrastructure that organizations can use to bring online their applications and data. Oftentimes, the primary location is completely compromised. And so that can't be an environment that can be restored back to because you're going to end up with the same challenge. What we recommend to organizations is to have a secondary platform with somebody like 11.11, an alternative provider that gives you that isolated recovery environment, but also the compute, the networking, all those other elements to make sure that you can bring the application online in that type of scenario where the primary site is completely compromised. With all of this, we've been speaking a lot about technology, but also throughout the podcast, we've spoken about a lack of expertise or the organization wanting to focus. We also recommend, obviously, technology is great, but on its own, it's not enough. You need to have that expertise. You need to have the tried and tested plans and process. That's also an area where we recommend identifying, are you ready for that type of scenario? Or would it make sense to evaluate what expertise lies in the market to solve for that challenge? I'll touch on some of the stuff that Sam has mentioned previously as well, because the areas that we try and work on early with clients is that understanding, piece of the understanding of the applications, how that then aligns with infrastructure and the dependencies that sit within those, because that then helps build up what that proven order in which services should be brought back online. Because from our side of things, recovery is a coordinated operational discipline, and it's not just a storage function of data. So we talk about how we kind of take it more from a recovery perspective as opposed to just data backups. I would also say that recovery strategies, they must consider manual workarounds as well. We've talked about the importance of customer communications, third party dependencies, and other governance alongside the actual technical restores. To conclude that piece, I'd say a backup only mindset will struggle to satisfy the kind of broader operational resiliency expectations that we see across the market and across regulators today. We've covered a lot of the different angles of cyber resilience today. What are some immediate steps that IT leaders can take to start their journey to true cyber resilience? I think, first of all, one of the things that I think we've spoken about throughout the session or the podcast is really about starting with identifying what are the critical services in the business. Do I have a full understanding across both the technology organization as well as the executive level and the business itself in terms of what is critical to the business, what will keep it running, but also what is essential to provide those critical services. Starting there will help you identify where the biggest gaps may lie and also where you can make the biggest impact by investing time, budget, and expertise to align to that from a security and a recovery side. Also, when, again, we think about those critical services, do you have that map of what is dependent on which piece and component part? That, again, is often a piece where maybe an organization has an idea of the critical services, but they may be missing a number of workloads to actually keep that system running. So starting by identifying the application dependencies can make a big difference. Also, we've spoken, again, around technology. I spoke just previously around things that are really industry best practice now around preventing impact to backup data through immutability, through isolation of backup and recovery infrastructure. Identifying the level of maturity you have is a critical next step so that you can align solutions where you have gaps, where it's going to, again, make a big impact. And then throughout this session and throughout our conversations with organizations, a big core area, and it can't be said enough, is really focusing on what level of testing do I have in place today? And is that effective at measuring how effective I can get back up and running and the time it takes to do so? And again, through investing in time and expertise to focus more on testing, you can increase the maturity of what you have in place from a cyber resiliency side to make sure that you do have a successful way to get back up and running as a business as well. Some great points there, Sam. And I guess I will provide what my thoughts are, which is probably going to be some overlap with what you've covered because there's some great points. But for me, immediate wins can include aligning cyber scenarios with important business services, setting those realistic impact tolerances that we've mentioned, close those obvious gaps that exist in backup and recovery coverage, and also schedule at least one end-to-end cyber recovery exercise in the next 12 months. For me, those steps really do move resilience from slideware to something you can actually measure, test, and be able to confidently discuss with boards and regulators. So at minimum, again, probably covering what Sam had said, though, start by identifying what must be recoverable, what dependencies they have, and what are acceptable impact tolerance levels for downtime. Then gain that understanding of any gaps that exist in recovery between achieving those impact tolerance levels and really just build from there. What does it mean to be a resiliency partner and not just a vendor? I think for us, it really is all about the outcome. I think if you look at the landscape today across security, recovery, as well as other technology solutions, there are a lot of products and services that make a big difference to organizations. But technology, without the expertise, without the process, can it deliver on the outcome that you're looking to solve for? If you don't have the other two elements to that kind of combination, you can have a great product or solution but not deliver on what the business wants to achieve. And for us at 11.11, we really focus on the outcome from the starting point and then let that guide from a design implementation and ongoing management side, the right mix of technologies, as well as the right mix of process and people to make sure that we are delivering on what the original intent of the organization was. What we also feel from our side is a partner really is about being accountable and actually delivering on what the original outcome was, but also what the objective of the organization is as well. So again, if the outcome and the resiliency element is all about delivering maybe a two-hour recovery time and focusing on certain subsets of the application, that means really focusing entirely on that outcome and making sure that we're aligning the right pieces to make sure that that's the reality. And I think what we would recommend organizations really to focus on as they're doing research. Again, there's so much choice is to work with that organization and really start to question and delve deeper into some of these pieces so that they can make the right choice in which partner they choose to solve for the outcome as well. I totally agree with you there, Sam. Being a resilience partner is definitely about outcomes, not products. That shared accountability you mentioned for continuity, not just supplying technology components. For us in practice, that means helping organizations assess what matters most, go back to design the recoverability into their environments, improving it through orchestrated recovery testing, clean room exercises. So a partnership model is key. And really where 11.11 comes into it as a resilience partner, we collaborate to help demonstrate to boards, to auditors and to regulators that you have a tested, repeatable recovery capability that is actually supported by the expected appropriate controls and has the documentation and evidence behind it. So it's very much, as Sam has said, it's about delivering those collaborative outcomes together. Well, unfortunately, that's all we have time for today. But Sean, Sam, thank you so much for joining us. Thank you, Rory. As always, you can find links to all of the topics we've spoken about today in the show notes and even more on our website at ITPro.com. You can also follow us on LinkedIn as well as subscribe to our daily newsletter. Don't forget to subscribe to the ITPro podcast wherever you find podcasts. And if you're enjoying the show, let us know. We're leaving a rating or review. We'll be back later this week with our regular look at the world of IT. But until then, goodbye.