"Security? We've Implemented It": Four Routines for Real Cyber Resilience
"Security? We've implemented it." That statement came up in an initial conversation with a CEO. Three questions later, the room was silent. Not because the questions were uncomfortable — but because none of the answers were there. Cybersecurity that was set up once and left untended since is not security. It is an illusion with an expiration date.
The Silent Illusion of Implemented Security
Many mid-sized companies hold a widespread but dangerous belief: security is something you set up. A firewall is configured, antivirus is installed, an ISMS is built — and then security is "implemented." This view fundamentally misunderstands the dynamic nature of cybersecurity.
Attackers continuously evolve. New vulnerabilities emerge every day. Your own infrastructure changes through new systems, new employees, and new processes. Security without continuous maintenance and regular review is like a car without servicing: it runs — until it doesn't. And it usually stops running at the worst possible moment.
Control Is Repetition, Not Intention
The decisive difference between a secure and an insecure organization lies not in the one-time decision to implement security measures, but in the regularity with which those measures are actively practiced. Control emerges through repetition — not through good intentions.
Four routines are especially critical for real cyber sovereignty in day-to-day operations:
Access reviews: Staff changes, project handovers, and shifting roles cause access rights to drift from their intended scope over time. Someone who has left the company should no longer have access. Someone who changed departments needs different permissions than before. Regular reviews — at minimum quarterly — ensure that only people who actually need system access have it. Access reviews scheduled for "when we have time" do not happen in practice.
Patch and vulnerability management: Known vulnerabilities are the most common attack vector in practice. A structured patching process that does not depend on individual heroes but functions as a routine dramatically reduces the attack window. Heroism is not a process.
Recovery tests with documented results: Backup systems are worthless if recovery does not work or takes unacceptably long. Recovery tests must be conducted regularly and real results documented: test date, actual recovery time, problems found, measures initiated. A plan without test results is an assumption.
Incident exercises before incidents occur: Waiting until an incident happens to learn how to respond means learning too late and too expensively. Regular exercises strengthen operational capability and expose gaps while they can still be closed.
The Hidden Risk: When Routines Get Postponed
The greatest danger to security routines is not the active decision to abandon them. It is the quiet postponement under stress. "We don't have time for the access review this week" sounds like a reasonable compromise. When that becomes "this month" and eventually "this quarter," a control gap develops that gradually grows into a significant risk.
The question of which security routine gets postponed first when things get stressful is one of the most important questions for organizational resilience. The answer reveals where the real weaknesses lie — not the documented ones, but the practiced ones.
Four Questions Every CEO Should Be Able to Answer
When was the last access review, and who owned it? When was recovery last tested, and what was the result? When was the last crisis drill, and what was learned? Which security routine was most recently postponed — and why?
For companies subject to NIS-2 obligations, these questions are not rhetorical. The directive explicitly requires continuous and regular review of security measures. One-time implementation without ongoing maintenance does not satisfy this requirement. Real cyber sovereignty emerges through structured cadence — fixed rhythms for reviews, tests, and exercises that do not depend on the organization's current workload.