Cyber Resilince¶

Cyber resilience is the ability of any organisation to continuously deliver the intended outcomes despite adverse cyber events. Assuming that attacks will eventually penetrate defenses, focusing heavily on survival and recovery. Protection and security assume defenses can hold, while resilience assumes defenses will fail. A. An effective action that I would do to build cyber resilience is to implement regular, automated, and immutable data backups. (Immutable backups are critical because they cannot be altered, deleted, or encrypted by ransomware after they are written.) B. The biggest obstacle to building cyber resilience is a culture that treats cyber risk exclusively as an IT problem rather than a business crisis. When executives view cyber strategy as a technical checklist, they fail to fund or practice operational survival. C. Cyber resilience is an effective response to human-centric vulnerabilities because it assumes employees will eventually make mistakes and builds systems to survive those errors.

To help the organization stay cyber secure, we should focus on driving habitual, daily actions rather than just general awareness that includes:¶

Secure and Isolate Credentials Use a password manager by generating, storing, and auto-filling strong, unique passwords for every single corporate account instead of reusing passwords or writing them down.
Maintain Digital Hygiene Lock and log off: Lock the screen every single time we step away from the workstation, even for a moment. Apply updates promptly: Restart the computer and software applications as soon as IT pushes security updates, rather than repeatedly clicking “Remind me later.”
Pause and Verify Identity Verify unusual requests by checking the identity of any colleague, executive, or vendor who requests urgent fund transfers, password resets, or sensitive data access. Use out-of-band communication; confirm the request via a separate, known channel (like a quick phone call or in-person check) instead of replying directly to the suspicious email, text, or chat.

To drive these security behaviors sustainably, employees must move past compliance fear and adopt internal motivators.¶

Core Values includes; integrity, accountability and collective care. Critical Attitudes includes; constructive skepticism, midnful vigilance, and psychological safety.

To embed these values, attitudes, and beliefs into an organization’s culture¶

We must move away from dry, annual compliance training. Culture is shaped by structural incentives, leadership communication, and psychological safety.

The top two human-centric security concerns stemming from the use of Generative AI¶

Confidentiality Bleed through Over-Reliance General view about GenAI tools is that it is a private, trusted assistants rather than public, data-absorbing processors. Driven by a desire for efficiency; it develops cognitive laziness—blindly pasting sensitive corporate data, intellectual property, or customer information into prompts to draft emails, clean code, or summarize meetings. Once entered into public commercial models, this data can be retained, reviewed by human moderators, or inadvertently leaked to competitors if used to train future iterations of the model.
Hyper-Personalized Social Engineering GenAI eliminates the traditional human red flags that users use to detect fraud, such as poor grammar, awkward phrasing, and generic greetings. Attackers feed public LinkedIn profiles, stolen corporate emails, or writing samples into GenAI to instantly generate flawless, context-aware, and highly persuasive phishing lures at massive scale. Because we are conditioned to trust highly professional, contextually accurate correspondence, the psychological defenses are easily bypassed.

One must sanitize before pasting: Scrub all specific identifiers; such as client names, exact financial figures, or proprietary code snippets, and replace them with generic placeholders. Check the browser URL or application interface to ensure that one is logged into their company’s officially sanctioned, enterprise-grade AI instance (which protects data privacy) rather than a free, public consumer account. Treat output as a draft; review every AI-generated response critically for hallucinations, biases, or incorrect data before using it in official company work, maintaining human ownership of the final product.

The most effective mechanism to drive the values, attitudes, and beliefs for safe GenAI use¶

Instead of lecturing others on rules; Interactive, Blameless GenAI “Red Teaming” Workshops flips the script by letting them safely play the role of the hacker or data leaker. This directly builds the constructive skepticism and personal accountability needed to change their habits.