Despite geopolitical uncertainty, new AI-created cyber threats, and nation-state security risks, global businesses indicate that their budget outlook is woefully thin on cyber resilience spending to defend against these threats. The 2026 PwC Global Digital Trust Insights report calls resilience ‘a work in progress’ as only 6% of respondents to a survey for the report feel that their organization can withstand a wide range of attacks. The report also warns that spending is too skewed toward reactive measures like paying fines than proactive measures to support effective cyber resilience. Ideally, spending will reach a better balance. However, powerful cyber resilience does need to cover both before and after elements of security and data protection. Think of it as a complete system, one that assumes attacks will occur and focuses on fast, reliable recovery.
Taking a systematic approach to cyber resilience
Taking a systematic approach is the most effective means of fighting the new generation of automated and AI threats, ransomware being the prime example. Using modern tools, ransomware has evolved into a new, more dangerous version. IT and security professionals know there is no solitary product or control that can stop every one of these threats. Protection must therefore be designed as a complete system, providing a business with the a thorough defence and recovery infrastructure.
To achieve resilience, it is strategic to think of a cyber security infrastructure as having five layers working together to keep data protected, recoverable, and trustworthy even when other parts of the environment are compromised. Any organization, regardless of size or technology stack, can apply these same principles.
The five layers are:
Defence at the API origin
Gaining entry through management consoles or API is an alternative to accessing hardware and a favourite of attackers. Therefore, interfaces must be treated as critical security boundaries that deserve the same attention as firewalls or authentication systems. Recommended defence tactics include strong access control, fine-grained permissions, and strict retention and immutability policies. These will protect data from both external attackers and accidental, potentially damaging internal actions.
Data access control
Preserving the integrity and confidentiality of data, even when attackers succeed in breaching the network, must be a critical priority. To accomplish this, the data layer should always assume zero trust. Every user, device, or process requesting access must be verified. Additionally, the system must encrypt data in transit and at rest to prevent stolen data from being exploited. Real-time monitoring is also required to flag anomalies and suspicious activity. Along with audit trails, these practices strengthen a proactive defence.
Stored data protection
Hardening the storage layer is essential to business recovery in the event of a cyber attack. Using techniques like erasure coding and distributed integrity checks, data can be reconstructed even if disks, servers, or entire nodes fail. Another recommended practice is separating metadata from the stored data to thwart attackers trying to reassemble stolen information. This strategy helps ensure stored data will be recoverable even after a hardware failure or attack.
Multi-site data redundancy
Data redundancy is the best approach to ensuring business continuity and recovery in the event of a widespread outage, cyber attack, or natural disaster. As some locations come back online, locally stored data will help businesses recover faster. It is an essential safety net in an era in which businesses are more globally dispersed than ever.
Architecting for immutability
For true resilience, a business must look beyond tools and policies to how the overall system architecture protects data and supports recovery. The best secure architecture isolates failure domains so that an issue in one area doesn’t cascade across the environment. Add to this multi-site replication, hybrid-cloud deployment, and policy-based data placement to enable operations to continue if one region fails. Architecting for immutability also requires being able to adapt to new threats like AI ransomware and make system changes to maintain the highest level of protection.
A workable system for future threats
When only 6% of organizations feel very confident they can adequately respond to a wide range of threats, it is compelling proof that a system approach to resilience needs more adoption. Without architecting for the certain eventuality of an attack or outage, businesses remain highly vulnerable.
Defending against cyber threats can be efficiently managed by integrating the resilience layers into a simplified architecture. Unifying storage, backup, and security functions reduces risk while improving efficiency. The easier it is for administrators to apply consistent policies and verify results, the stronger the overall defence becomes.
The author
Tom Leyden is Vice President, Product Marketing, Scality
