From Security to Resilience: The 2026 Mandate for Critical Infrastructure

In a rapidly evolving cybersecurity landscape, Alain Sanchez, EMEA Chief Information Security Officer at Fortinet, emphasizes the necessity for organizations to transition from an unattainable goal of complete prevention to a more pragmatic focus on resilience. This shift acknowledges the inevitability of breaches and prioritizes operational continuity, swift recovery, and the implementation of AI-driven defense mechanisms.

The Shift in Cybersecurity Strategy

The traditional approach to cybersecurity, which aimed for 100% prevention, is increasingly viewed as outdated. The complexity of modern systems, coupled with the rise of sophisticated AI-driven threats and nation-state-level attacks, renders total avoidance of incidents not only unrealistic but potentially hazardous. This evolving reality compels Chief Information Security Officers (CISOs) and their executive teams to adopt a more comprehensive strategy centered on resilience.

Resilience represents a departure from the fortress mentality of security, which often creates a false sense of safety. Instead, it focuses on maintaining operational continuity even when defenses are breached. The true measure of success in this new paradigm lies in the speed and effectiveness of recovery efforts.

Core Capabilities of Resilience

The modern resilience framework is characterized by three essential capabilities that shift the focus from perimeter security to core operational integrity:

1. Anticipatory Response: This capability emphasizes real-time learning from live attacks. By analyzing an attack as it unfolds, organizations can anticipate potential system failures and prepare recovery tools proactively.

2. Managed Degradation: Organizations must be able to maintain a defined set of critical services while acknowledging that other network components may be compromised. This strategic approach allows essential functions—such as financial transactions and healthcare services—to remain operational, albeit at a reduced capacity.

3. Rapid Restoration: The emphasis is no longer on whether an organization will be attacked, but rather on how quickly it can recover. This capability is quantified through the Recovery Time Objective (RTO) and is supported by immutable data backups and well-tested recovery protocols.

The Legal Imperative for Critical Infrastructure

As organizations increasingly adopt resilience strategies, this shift is becoming a legal and regulatory obligation, particularly for those managing Critical Infrastructure (CI). CI includes vital assets and systems whose incapacitation could significantly impact national security, economic stability, public health, or safety.

Historically, governments have established security standards for CI. However, the new resilience mandate signifies a shift in the relationship between government entities and private operators. Governments now assert that the ability to withstand and recover from disruptions is a matter of national security, thereby placing the onus of resilience on private sector operators.

Cloud Sovereignty and Local Control

The concept of resilience is closely tied to technological independence and local control. To comply with stringent requirements, new infrastructure models are emerging:

• Sovereign Cloud Partitions: Cloud providers are creating environments that are both physically and logically isolated, with governance structures shielded from foreign jurisdictions. For instance, the AWS European Sovereign Cloud ensures that management and data remain entirely within the EU, thus adhering to legal and physical boundaries.

• Sovereign Edge Computing: Telecommunications companies are integrating security and processing capabilities directly at the network edge. This approach ensures that sensitive data is processed locally before it reaches the public internet, reinforcing both Managed Degradation and data sovereignty.

Global Drivers and Market Response

The regulatory push for resilience is echoed by a growing economic consensus. At the World Economic Forum (WEF) annual meeting in Davos, Fortinet executives highlighted that 92% of CEOs now prioritize cyber recovery capabilities over traditional perimeter defense spending. This shift in executive focus is expected to drive significant market changes:

• Insurance Transformation: Major cyber-insurers are implementing “Resilience Audits.” Premiums are increasingly based on a company’s RTO and the immutability of their data, rather than solely on breach occurrences. This financial incentive encourages organizations to invest in measurable recovery frameworks.

• OECD Governance Framework: The Organisation for Economic Co-operation and Development (OECD) has stressed that ensuring CI resilience requires new governance models to limit service disruptions and foster cross-sector collaboration. This approach aims to establish national frameworks that promote redundancy, incident reporting, and infrastructure sharing.

The Technological Frontier: Autonomous Resilience

The technological response to the resilience mandate is evident in the emergence of Autonomous Resilience Agents and “Self-Healing Networks.” These advanced tools go beyond traditional blocking mechanisms, allowing suspected attacks to proceed in a controlled environment. This enables the system to generate and disseminate immunity signatures throughout the infrastructure.

This AI-driven strategy embodies the resilience philosophy by leveraging attacks as learning opportunities. Instead of merely attempting to prevent breaches, systems are designed to adapt and restore themselves based on real-time data from ongoing attacks.

The Architect of Continuity and Control

The transition from a focus on security to resilience, now compounded by the need for sovereignty, represents a significant operational shift for critical infrastructure operators. This evolution is not merely a regulatory requirement but a fundamental change in how organizations approach cybersecurity.

To succeed, this shift must be supported by robust public-private partnerships. Aligning government security intelligence with private sector operational expertise will ensure that sovereignty mandates are both technically feasible and economically sustainable.

The CISO’s role is evolving from that of a gatekeeper to an architect of continuity. The emphasis is no longer on preventing every attack but on building systems that are inherently adaptive and capable of rapid recovery within legally defined sovereign boundaries. In this new environment, resilient organizations will be those that can absorb shocks, learn from experiences, and maintain essential operations with minimal disruption.

For further insights into the evolving landscape of cybersecurity, visit securitymea.com.