Before the Incident

01Resilience cannot currently be failed

Ask an organisation to demonstrate that it is resilient and you will receive a document. Ask it to demonstrate that it is not, and it cannot, because nothing in the prevailing definition is capable of returning that answer.

Resilience is conventionally described as a capacity: the ability to anticipate, absorb, adapt and recover. As a description of what we want, this is unimpeachable. As something to assess, it is close to useless. A capacity is a disposition, and dispositions are only observable when they are exercised, which is to say, after the event we were trying to avoid.

The practical consequence is visible in almost every resilience assessment produced in this country. They conclude that the organisation is broadly resilient, with opportunities for improvement. They are never wrong, because they are not the kind of statement that can be wrong. A board receives them, notes them, and is no better placed to make a decision than before.

An assertion that cannot be falsified cannot be assured. If no evidence would have changed the finding, no evidence supports it.

This is not a failure of effort or of practitioners. It is a failure of definition. And it has a second consequence that matters more: because resilience is assessed as a property rather than a state, it is assessed periodically, and between assessments, nothing is watching.

02The discipline measures backwards

Consider what the established frameworks actually instrument.

Four of these five are post-event by construction. The fifth, risk management, is pre-event, but it measures the wrong variable. A risk register records likelihood and consequence, assessed at a point in time, and is reviewed on a cycle measured in quarters or years. It tells you what could happen. It does not tell you how close you currently are to it happening, nor which direction you are travelling.

Between the risk assessment and the incident lies a period in which the organisation's actual condition changes continuously, and which frameworks ask to be monitored but none measures. Controls lapse. Staff leave. Certificates expire. Suppliers are acquired. Maintenance is deferred. Test regimes slip. None of this is dramatic, none of it triggers anything, and all of it moves the organisation closer to a condition in which an ordinary event becomes a serious one.

Safety practice learned this lesson decades ago and gave it a name. Counting injuries is a lagging indicator: it tells you about a past you can no longer influence. Mature safety programs built leading indicators: observable precursors that move before the harm does. Cyber, infrastructure and organisational resilience have, with very few exceptions, not made that transition.

03A method borrowed from engineering

The transition has already been made elsewhere, and thoroughly.

Rotating machinery used to be maintained on a schedule or on failure. Neither is satisfactory: the schedule replaces healthy components and misses sick ones, and failure is expensive. Condition-based maintenance replaced both. Instrument a parameter that correlates with degradation (vibration, temperature, lubricant chemistry, acoustic emission), establish the baseline for a healthy unit, define the condition at which the unit is no longer fit for service, and measure the distance between the two. The discipline that grew from this, prognostics and health management, goes further and estimates remaining useful life: not whether the component is healthy, but how long it has.

This is mature. It governs maintenance in aviation, rail, energy generation and heavy industry. It is unremarkable to the engineers who practise it. And it rests on three requirements, all of which organisational systems can meet:

• A defined condition that correlates with the system's ability to perform.
• A threshold at which performance is no longer assured.
• A measurement of the current value and its direction of travel.

Why has it not transferred? Three honest reasons. A bearing has vibration; a payments platform has no single obvious analogue. A bearing's failure threshold is physical; an organisation's is contested and political. And the resilience discipline grew out of emergency management, whose entire culture is organised around response.

None of those is a reason it cannot be done. They are reasons it has not been.

04The definition

Three properties of this definition are worth drawing out, because each is a departure from current practice.

It is falsifiable. A margin is a quantity. It is either where you say it is or it is not, and the claim can be checked against the same evidence by two different people.

It is continuous. A margin exists on every day, not only on assessment days. The question "how resilient are we" acquires an answer that changes, which is the only honest representation of an organisation whose condition changes.

It is actionable, and it says when. This is the part that matters. A risk rating tells you something is bad. A window tells you how long you have, and therefore whether this is a decision for the next executive meeting or the next budget cycle. Nothing in current resilience practice produces that number.

05What can and cannot be measured this way

This is the discipline on which the whole method depends, and the point at which it would be easy to overclaim.

Degradation of a known condition is measurable. The occurrence of an adversarial or natural event is not. These are different kinds of thing and must never be conflated.

It would be easy to read that right-hand column as a defeat. It is the opposite, and the reason is the central claim of this paper:

You cannot forecast the event. You can measure whether the conditions that would let you survive it still hold, and those conditions decay on timetables you already know.

An organisation cannot know when it will be attacked. It can know, precisely and in advance, that the failover it relies on has not been proven in fourteen months, that two of the three people who can execute the recovery have left, and that the supplier contracted to restore the environment is operating on an expired agreement. None of those facts predicts an incident. All of them determine what an incident costs.

A practitioner who claims to forecast exploitation will be asked for the model, and will deserve to be. A practitioner who states that four of the eleven conditions required for recovery have degraded this quarter is making a claim that can be checked and acted on.

06Conditions: the unit of measurement

The method requires a unit, and the unit is the condition: a specific, testable statement that must hold for a critical function to be delivered and recovered.

Every organisation already relies on a set of these. Few have written them down as statements that can be tested. They live tacitly, distributed across the people who would be called at two in the morning, and they are discovered during the incident, which is the worst possible moment and the reason recovery takes longer than the plan says.

Writing them down is the work. For a given critical function, the question is not "what are our risks" but something much more concrete:

What has to be true for this to keep working, and what has to be true for us to get it back if it stops?

The answers are finite, and each of them has a present value, a threshold and, critically, an observable expiry or trend.

07Who controls what you depend on

A dependency can be lost without anything failing. A supplier changes hands. A partner takes new funding. A contractor's own subcontractor changes. Nothing has worn out and nothing has been triggered, but a condition the organisation was relying on, that whoever has access to its critical systems answers to it, may no longer hold.

Most of what an organisation knows about its suppliers, the suppliers told it. Declarations of ownership, certification and security practice are made once, usually at onboarding, and age from that day. They are conditions like any other: they have a date, and they expire.

Foreign ownership, control or influence rarely arrives as an intrusion. It usually comes through an ordinary commercial door: an acquisition, an investment, a partnership.

So the conditions behind a critical function include control as well as capability. The method assesses organisations and the engagements between them, never individuals. Its value is the same as everywhere else in this paper: a change of control is a dated fact, and a dated fact can be known before it matters.

Regulation is moving in the same direction. The enhanced risk management program requirements under the Security of Critical Infrastructure regime, registered in June 2026, ask operators of high-risk assets such as water and energy to map their major suppliers to critical components, to assess foreign ownership and control, and to set the maximum outage they can accept from each. That is margin thinking applied to suppliers.

08Thresholds, and why not a traffic light

Having defined conditions, there is a strong temptation to aggregate them into a colour. It should be resisted, for the same reason the original definition failed: a single rating is unfalsifiable and conceals the information that would make it useful.

A threshold in this method is not a colour. It is a stated margin at which a specific response is triggered, agreed in advance with the people accountable for the function, including whoever must fund the response. Three are usually enough:

• Nominal: the condition holds with margin to spare; nothing is required.
• Intervention: the margin has narrowed to the point where restoring it is still routine work, scheduled and inexpensive. This is the threshold that matters, and the one nobody currently has.
• Escalation: the margin will reach zero inside the time it would take to restore it. The decision has become urgent, and the options have narrowed to the expensive ones.

The reporting line that follows is not a score. It is a sentence of the form: nine of the eleven conditions supporting this function hold; two are inside the intervention threshold; the earliest reaches zero in thirty-one days. That sentence can be acted on by somebody who has never read the methodology.

09Where this sits

The discipline has doctrine for three of the four states an organisation can occupy. The fourth is where this method lives, and it is unattended.

1. Normal operationGoverned by operations, assurance and risk management. Well served.
2. DriftCondition degrading, no event has occurred, nothing has been triggered. Frameworks ask for monitoring; none measures how long is left. The margin is being consumed and the window is still open.
3. Incident and crisis responseGoverned by ISO 22320 and ISO 22361. Well served, and expensive.
4. Continuity and recoveryGoverned by ISO 22301 and disaster recovery practice. Well served, and more expensive again.

This matters because the transition from state two to state three is where cost, disruption and exposure are created, and because that transition is frequently the first moment anybody notices state two was occurring at all.

What this does, and does not, do to business continuity

It does not replace it, and any claim that it does should be treated with suspicion. Earthquakes happen. Suppliers fail without notice. Zero-days exist. A proportion of invocations are genuinely unavoidable and the capability to respond must be maintained in full.

What it changes is two things, and both are substantial. It reduces the number of avoidable invocations: those in which the precipitating event was ordinary and the consequence was severe only because the organisation had drifted. And for the unavoidable ones, it means the plan is invoked from a known state rather than from a state discovered during the first hour of the response.

Framed properly, this is not a competitor to business continuity. It is the instrumentation continuity planning has always assumed existed.

10A worked example

11What this does not claim

12Implications for governance

There is a particular consequence for anyone who signs an attestation, and under statutory regimes, including the Security of Critical Infrastructure regime, an increasing number of directors do.

An annual attestation is a statement about a period. But it is made on a single day, on evidence assembled in the weeks before, and from that day forward nothing tells the signatory when it stops being true. Four months later, several of the conditions the signature rested on have expired. The attestation has not been withdrawn. It has simply ceased to describe the organisation, and nobody has been informed, including the person whose name is on it.

Margin and rate makes this visible, and it does so without forecasting anything. Every condition underpinning an attestation has a known expiry. The implication is immediate and, in my experience, novel to every board that hears it:

On the day it is signed, it is already possible to state the date on which the attestation will first cease to be true.

That is a disclosure no director is currently given, and there is no technical reason for that. It requires no monitoring of operational systems and no new data, only that the conditions a signature rests on be written down with their expiry dates, which is a discipline rather than a technology.

13Adoption

The method is not demanding, but the order matters, and the sequence most organisations attempt (buy the instrument, then work out what to measure) fails reliably.

1. Name the critical functions. Not systems, not assets. The things that must keep happening. Most organisations have fewer than a dozen and disagree about them, and the disagreement is itself informative.
2. Define the conditions. For each function, what must be true for it to work and to be recovered. This is the engagement, it is practitioner work, and it cannot be bought as software.
3. Set thresholds with the people accountable for them. An intervention threshold nobody has agreed to fund is a future argument, not a control.
4. Instrument only what already has a date. Begin with conditions that decay observably. Resist the temptation to model anything.
5. Report margin and window, never a score. The moment it becomes a number that moves on its own, it has become the thing this paper was written against.

Closing

The argument of this paper is narrow and, I think, hard to dispute. Resilience as currently defined cannot be measured, and therefore cannot be managed, only asserted. Defined as margin and rate it can be measured, by a method that has been mature in other disciplines for decades, using information most organisations already hold but do not assemble.

The prize is not a better report. It is the recovery of a period that the discipline currently ignores: the interval in which something is going wrong, nothing has yet happened, and the options are still cheap.

Discuss an engagement →