Compare the Cloud
Author name and job title: Terry Hancock, Head of Service Operations & Cyber Resilience at Axiologik Terry Hancock, Head of Cyber Resilience at Axiologik, explains why businesses need to prepare for cyber attacks…
Author name and job title: Terry Hancock, Head of Service Operations & Cyber Resilience at Axiologik
Author Linkedin — https — //www.linkedin.com/in/terry-hancock-3574466/
October 2026
Your incident response plan isn’t proof you can recover
Terry Hancock, Head of Cyber Resilience at Axiologik, explains why businesses need to prepare for cyber attacks getting through, not just focus on keeping them out.
For years, much of the cyber security conversation has focused on keeping attackers out. Invest in the right technology, patch vulnerabilities, train people to spot phishing emails and lock down access. Put enough barriers in the way and, theoretically at least, you stop the breach from happening.
We still need to do all of that. But prevention can only reduce risk, so it can’t be the only measure of whether an organisation is secure. The more useful question now is what happens when something does get through. How quickly is it detected? How far can it spread? And how confident are you that the services the organisation relies on can actually be recovered?
For most large organisations, that question is already live. The UK Government’s Cyber Security Breaches Survey 2025/26 found that 69% of large businesses identified a breach or attack in the previous 12 months.¹ A year with a breach in it is now the norm.
Recent incidents involving AI models show how even well-designed controls can fail. In May, during a security test run by Irregular, Google’s Gemini accessed systems belonging to three real companies. In two cases it used credentials it found in a public code repository, and in the third it guessed a password.² In July, OpenAI models running in internal security evaluations got around controls meant to isolate them from the internet and went on to compromise systems at Hugging Face.³ The Australian Prime Minister has also said an OpenAI agent gained unauthorised access to non-public files on a Medicare statistics portal, a claim researchers have since questioned.⁴
None of this makes preventative security redundant. It does show that resilience can’t rest on assuming every control will work every time.
Having a plan doesn’t prove you can recover
Organisations can look very well prepared on paper, with policies in place, named owners, incident response plans, maturity assessments and documented recovery procedures. All of those things are great in theory, but none of them prove that a critical service will come back when it’s needed.
The same survey found that 76% of large businesses now have a formal incident response plan.¹ So most large organisations expect incidents and have written down what they’d do. What the survey can’t tell you is whether those plans have been tested against anything realistic.
The FCA highlighted exactly this gap in its operational resilience findings earlier this year.⁵ It found examples of firms stating in their self-assessments that there was no scenario from which they’d be unable to recover, without providing evidence that they’d tested sufficiently severe scenarios to support that claim.⁶
A recovery procedure that exists on paper still has to work when ransomware reaches the systems you were relying on, a critical supplier is down, or the people who normally run the recovery aren’t available.
Test the service end to end
The FCA requires firms within scope of its operational resilience rules to test whether they can remain within agreed impact tolerances during severe but plausible disruptions. It also makes clear that mapping can’t focus solely on technology. Organisations need to understand the people, processes, information, facilities and third parties involved in delivering an important business service. That’s a useful standard for any organisation, regulated or not.
Take one service your organisation depends on and test what happens if it’s disrupted. Who notices first? Who needs to make the decisions? Which systems does the service depend on? Which people need to be available? What happens if a supplier is involved? And how long does it take before that service is genuinely usable again? The answer is unlikely to sit entirely within the security team.
If the people, information or third parties needed to run the restore are unavailable, the organisation has a problem that needs addressing, and finding it is the whole point of testing. Whatever comes to light is information the organisation needed to uncover. An undocumented dependency, an assumption about a supplier or a recovery process that takes considerably longer than expected are all much better discovered during an exercise than during a real incident.
Put the effort where it matters most
No organisation has unlimited cyber security resources. Recognising this, our approach to cyber resilience at Axiologik is to look across people, process, technology, suppliers and third parties, and to check whether key controls work as well as whether they exist. The aim is then to prioritise the action that will reduce the most risk in the shortest timeframe.
Another cyber security tool isn’t necessarily the answer. Depending on what testing uncovers, the biggest weakness could be a technical vulnerability, a recovery process that’s never been exercised, an over-reliance on one supplier or a gap in who is able to make a decision when an incident occurs. You can’t know which of those deserves attention first if the starting point is simply a list of controls.
Cyber Security Awareness Month will quite rightly bring another round of advice this October about passwords, phishing, updates and good cyber hygiene. We still need all of it, but the conversation now needs to go further. The question organisations should be asking is this: when someone does get in, do we know what happens next?