The day after the cyberattack
by Miguel Lucas
I keep hearing more complaints about how hard it’s getting to do simple things on a computer at work. Having to authenticate every other minute. Far more restrictions on sharing a document. More and more tools are off-limits. Has IT lost its mind?
To a point, there are reasons to raise our guard. AI lets attackers do more with less expertise and fewer resources. According to CrowdStrike, attacks by adversaries using AI rose 89% in 2025 over the previous year 1. The threat is growing, and companies are strengthening their defenses.
But that protection comes at a cost that goes beyond licenses and security teams. We also pay in time, interruptions, and lost autonomy to get everyday tasks done. We accept that friction to reduce risk. Are we paying comparable attention to how we’ll recover if the attack succeeds?
An Accenture survey of 1,000 executives reveals a telling gap: 54% believe strong protective controls are enough to ensure continuity after an attack. Only 35% say they regularly test their resilience through actual recovery and continuity exercises 2.
Reducing the likelihood of a crisis isn’t the same as being ready to manage one. We can add controls every day and still have no proof of what we’d be able to do if our usual systems became unavailable.
That’s a responsibility for leadership. Which parts of the business must keep running. Who gets to decide what stops and what gets restored first. How we’ll inform employees and customers if email and corporate channels are compromised.
The UK’s NCSC recommends preparing those decisions, rehearsing them under pressure, and having alternative communication channels available 3 4. The ability to respond has to exist before we need it. An approved plan doesn’t prove we can execute it when the tools are missing, information is incomplete, and every hour of disruption adds to the damage.
Iván Pino has long argued for a further ambition: moving from resilience to antifragility, from withstanding crises to getting better through challenges 5. Here, we can start by using every exercise to uncover dependencies, address weaknesses, and prepare a better response.
AI is pushing the risk of cyberattacks to unprecedented levels. But we’ll be making a mistake if we put all our energy into trying to prevent them. It’s also vital to prepare and rehearse how we’ll recover when an attack succeeds. Because, at the rate things are moving, the question isn’t whether it will happen. The question is when.