Some companies are exceptionally well equipped, yet still find themselves caught off guard by a crisis. Others operate with more modest resources but navigate incidents surprisingly well. The difference rarely lies in the technology itself. Technology is only one component of an organisation’s cyber resilience.

This conclusion comes directly from projects delivered for demanding clients. Without well-designed security processes and an informed workforce, all we have is technology. And while technology is essential, it is not enough.

The first pillar is security processes. They determine whether the response to an incident is coordinated action or improvisation. A process defines who responds, in what order, where they obtain information and who receives it. A well-designed process continues to work even when an individual or a specific tool fails, because it does not depend on one person or one screen. This is particularly important during a crisis, when pressure increases and time becomes scarce.

The second pillar is workforce awareness – the understanding among employees outside the IT department of the role they play in protecting the company. Employees are often the first to notice suspicious messages, unusual system behaviour or situations that deviate from the norm. An informed workforce reports concerns and asks questions. An uninformed workforce clicks and stays silent. No tool can fully eliminate that difference.

Workforce awareness is not a one-off training session accompanied by a presentation. It is a state in which responding to irregularities is considered both normal and safe within the organisation. An employee who is afraid to report their own mistake will try to conceal it. An employee who knows that reporting is encouraged gives the company time to respond. A strong reporting culture can therefore be just as important as knowledge itself.

Both pillars combine with technology to form a single system, as we discussed when examining the most common misconception in building cyber resilience. Experience from our projects suggests a 60% contribution from tools and 40% from processes, capabilities and organisational readiness. Security processes and workforce awareness account for a significant part of that 40%.

The maturity of both pillars can be initially assessed by asking two questions. First: when were our security processes last tested in practice rather than simply updated in a document? Second: does an employee outside IT know what to do when they notice something concerning, and have they ever actually done it? The answers reveal whether the company is building resilience among its people or only within its infrastructure.

There is another practical consequence. Processes and awareness do not require substantial budgets, but they do require consistency. Training delivered once every three years provides awareness that is three years out of date. A process tested during implementation and never revisited describes a company that no longer exists. In this area, consistency matters more than scale. A quarterly cycle of exercises and reminders achieves more than a one-off push.

Technology remains the foundation, and its importance is beyond question. But a foundation alone does not make a house. A resilient company is one in which tools, processes and people work together, with each of the three aligned with and supporting the others. Two of them do not require significant investment. They require attention.