Cyber resilience is no longer considered a mere technical concern; it’s becoming a board-level business imperative and a distinct investment category. Organizations that treat it that way are better positioned to recover faster when disruption hits.

That evolution is well underway, according to Christy Wyatt (pictured), president and chief executive officer at Absolute Security. New research published by the company at Black Hat USA 2026 found that only 4% of the 1,000 chief information security officers surveyed said they felt genuinely ready to recover from a major disruption.

“Nineteen million an hour is what the average was across that community,” Wyatt said. “That’s a crazy number. If we want to talk about how we minimize downtime, we can put a dollar amount on it.”

Wyatt spoke with theCUBE Research’s Krista Case at Black Hat USA during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how cyber resilience is emerging as a distinct market category, why the CISO’s role is expanding to encompass recovery in addition to prevention and what separates organizations that recover quickly from those that don’t. (* Disclosure below.)

Cyber resilience moves from containment to recovery

Most organizations run tabletop exercises that stop at the point of containment. Teams practice identifying and remediating threats but not restoring 5,000 disabled devices while the business continues operating. Minimum viable operations, communication protocols and device recovery workflows often go untested — and may fail during an actual incident.

“Ask yourself what would happen if 60% of your endpoint devices got wiped out tomorrow morning,” she said. “Do those people know what they’re supposed to do and where they’re supposed to go and how they’re supposed to communicate with one another?”

Absolute Security’s approach to endpoint security relies on Persistence, firmware-embedded technology integrated into hardware from 28 PC manufacturers, according to Wyatt. The technology provides an anchor that allows the platform to reach a device regardless of its software state. It can collect forensic data, restore network connectivity or execute a remote bare-metal reinstall without requiring the device to be physically returned to IT. The goal is to compress recovery time from weeks to minutes, Wyatt noted.

“If the answer from IT was, ‘We think you clicked on ransomware, please box that laptop up and ship it back in a FedEx box,'” Wyatt said. “… if we can say, ‘Actually, we’ll just pull the forensics from that device, and we’ll do a remote bare metal reinstall, and you’ll be back up and running in 25 minutes,’ that’s probably better.”

Boards that have reached cyber fluency now need to take the next step, asking not just about risk posture but about what happens operationally when the lights go out, according to Wyatt. The CISO increasingly owns recovery as well as prevention, but the chief financial officer, chief information officer, general counsel and board all have roles to play. Absolute Security’s research found that more than 72% of CISOs have already expanded their remit to include overseeing cyber resilience.

“The right conversation at the boardroom and with the senior management team is not, ‘Have you rehearsed for a cyber event?'” Wyatt said. [“It’s,] ‘Have you rehearsed your overall resilience? Have you written that down, practiced it, rehearsed it?'”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA:

(* Disclosure: Absolute Security sponsored this segment of theCUBE. Neither Absolute Security nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE