When a company decides to take cyber resilience seriously, its first instinct is usually the same: review the market and start buying. New tools, new systems, new licences. This instinct is understandable and partly justified. The problem begins when purchasing becomes the entire plan.

Based on our experience of delivering client projects, the biggest misconception in building cyber resilience is the belief that it can be achieved through technology alone. In reality, resilience comes from preparing the organisation to operate during an outage or attack. The distinction may sound minor, but it changes everything, because it shifts the focus from what a company owns to what it is capable of doing.

A ratio commonly observed in cyber resilience projects illustrates the scale of the issue: around 60% of success comes from tools, while the remaining 40% depends on processes, skills and the organisation’s readiness to make decisions. In other words, even a superbly equipped company leaves almost half of its potential resilience unrealised if it stops at purchasing security solutions.

This ratio does not diminish the importance of technology. It simply shows that tools are necessary, but not sufficient. A company without tools cannot defend itself at all. A company with tools alone can defend itself only partially. In a crisis, partial protection can still result in a complete shutdown.

This misconception persists for a simple reason. A purchase is easy to plan: it has a budget, a schedule, a supplier and a formal sign-off. Preparing an organisation offers none of the same certainty. It requires people’s time, exercises that must be repeated and decisions that no external provider can make on the company’s behalf. When projects for the next quarter are being prioritised, purchasing always looks better on paper.

Yet it is precisely that 40% that determines how a company responds in a crisis. Tools do not activate themselves or make decisions. What matters in a critical moment is whether processes have been practised, whether people understand their roles and whether the organisation can make decisions under pressure. As we have already noted in the context of business continuity plans, a document that has never been tested remains little more than a declaration. The same applies to tools: without a prepared organisation, they are simply technology assets.

The procurement trap is easiest to recognise in the way security discussions are structured. If every discussion ends with a list of products to buy, but none produces a list of processes to practise, the balance is wrong. Another warning sign is a budget in which technology spending increases year after year, while exercises, training and decision-making preparation receive no funding at all.

For decision-makers, this leads to one practical recommendation. With every security investment, it is worth asking a second question immediately after asking about the price: what do we need to prepare within the organisation for this tool to work in a real crisis? If the answer is “nothing”, it means no one has examined the question seriously enough.

In this respect, cyber resilience is more like fitness than equipment. You can buy the best bicycle in the world, but you cannot buy the miles of training. Companies that understand this spend more wisely on technology and achieve better results, because every tool is placed in the hands of an organisation that is prepared to use it.