Reflections from the Cyber Resilience Centre Summit in London

Dawn attended the summit as a member of GTIA, acting in the role of National Ambassador. The speaker lineup included the UK Security Minister and representatives from the City of London Police, alongside professionals working on cyber resilience across sectors.

Whether in the UK or the US, one issue came up repeatedly: it's difficult to get business leadership to understand cyber risk in business terms, not because they don't care, but because the risk is usually described in technical language that doesn't map to how leaders think about their organizations. Firewalls, phishing, and MFA fatigue are real, but they're inputs. Leaders think in outcomes: downtime, reputational damage, regulatory exposure, client trust, and financial impact.

A cyber incident is rarely just a cyber incident. It shows up as a missed payroll run, a delayed financial close, or a line-of-business system nobody can reach.

Most organizations now accept that cyber threats exist. Fewer have real ownership, defined decision-making authority, and a practiced response plan behind that acceptance. One speaker's framing stuck: resilience isn't about preventing every incident. It's about reducing confusion, delay, and damage when something eventually goes wrong.

The specific regulations differ by country. The underlying challenge doesn't: translating technical risk into language a business leader can act on. That's why this conversation belongs in leadership meetings, not just IT.