Cyber resilience is no longer considered a mere technical concern, but a board-level business imperative and a direct investment category. In terms of recovery speed, the organizations that treat it as such will bounce back faster when disruption hits.

That evolution is well underway, according to Christy Wyatt (pictured), president and chief executive officer at Absolute Security. New research published by the company at Black Hat 2026 found that the average cost of one hour of endpoint downtime across 1,000 CISOs surveyed is $19 million. However, despite growing awareness of the problem, only 4% of those same practitioners said they felt genuinely ready to recover from a major disruption.

“I think the first is the cost of one hour of downtime. If we took across the — we had 1,000 CISOs participate in the survey — $19 million an hour. That’s a crazy number,” Wyatt said. “$19 million an hour is what the average was across that community. If we want to talk about how do we minimize downtime, we can put a dollar amount on it.”

Wyatt spoke with Krista Case at Black Hat USA during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how cyber resilience is emerging as a distinct market category, why the CISO’s role is expanding to encompass recovery in addition to prevention and what separates organizations that recover quickly from those that don’t. (* Disclosure below.)

Cyber resilience demands rehearsal, board involvement and endpoint recovery infrastructure

Most organizations run tabletop exercises that stop at the point of containment. They know how to identify and remediate a threat, but they have never played the scenario all the way through to the question of how to get 5,000 downed devices back online while the business is still trying to operate. Minimum viable operations, communication protocols and device recovery workflows are the steps that get skipped, and of course, they’re the ones that fail when a legitimate event takes place.

“Ask yourself what would happen if 60% of your endpoint devices got wiped out tomorrow morning,” Wyatt said. “Do those people know what they’re supposed to do and where they’re supposed to go and how they’re supposed to communicate with one another?”

Absolute Security’s strategy for endpoint security resilience is based on a firmware-embedded technology called Persistence, which is baked into hardware from 28 PC manufacturers and covers the majority of enterprise laptops deployed throughout the past two decades. It’s an anchor that allows the platform to reach a device regardless of its software state. It pulls forensics, restores network connectivity, or executes a remote, bare-metal reinstall without requiring the device to be physically returned to IT. The goal is to compress recovery from weeks to minutes, Wyatt noted.

“If the answer from IT was: ‘we think you clicked on ransomware, please box that laptop up and ship it back in a FedEx box,'” Wyatt said. “If we can say, actually, we’ll just pull the forensics from that device, and we’ll do a remote bare metal reinstall, and you’ll be back up and running in 25 minutes — that’s probably better.”

Boards that have reached cyber fluency now need to take the next step, Wyatt said, asking not just about risk posture but about what happens operationally when the lights go out. The CISO increasingly owns recovery as well as prevention, but the CFO, CIO, general counsel and board all have roles to play. After all, the research found that more than 72% of CISOs have already expanded their remit to include overseeing cyber resilience.

“The right conversation at the boardroom and with the senior management team is not, have you rehearsed for a cyber event?” Wyatt said. “But have you rehearsed your overall resilience? Have you written that down, practiced it, rehearsed it?”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA:

(* Disclosure: Absolute Software sponsored this segment of theCUBE. Neither Absolute Software nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE