Resilience Is a Leadership Decision

Welcome to the Global Insider Threat Awareness Month 2026. This year's theme is Where Trust Meets Risk. Trust is fundamental to how every organization operates, but every time we extend trust to people, partners, or relationships, we also create opportunity, and with that opportunity comes exposure. To explore that relationship, I'm delighted to be joined by Rod Crowther, founder and CEO of Ops Center. Rod brings more than 25 years experience in risk and resilience, having advised more than 140 organizations across the Asia-Pacific. He also chairs the Adaptive Business Continuity Advisory Group, an international think tank focused on advancing resilience and business continuity practices. So with that, Rod, welcome to GIDM.

Thank you, Boaz. Thanks for the invitation this afternoon.

Excellent. Rod, before we get into the discussions, perhaps you could briefly tell us about your background and what has shaped your perspective on organization resilience.

Well, we started the business out in, back in the days of Y2K. So sort of late 1990s. And our focus at that time was obviously looking at that big, that Y2K bubble, which was about to burst and cause a lot of organizations a lot of problems. And fundamentally what we do is since then we've evolved the business into multiple different areas. And fundamentally we help organizations to understand and assess what the risks are to their business, what operational risks exist. whether that's things like fires or floods or cyberattacks or AI risks or insider threats, etc. And we help them to develop mitigation plans and test and exercise those because that's one of the really key parts of this whole resilience, operational resilience framework is to make sure that you actually test and exercise and really understand your capabilities. So yeah, we've sort of started out with a fairly technical sort of approach to this, but now much more these days, much more business focused.

Okay. So is that— has operational resilience become more difficult, or is it simply they're more aware of the vulnerabilities than they were 10 years ago?

Very good question. In fact, it's probably both.

Good questions.

Yes, of course. So what's the answer? It's a great question, Boaz. It's actually both. It's more difficult. It's more difficult. And organizations are also more aware. I think 10 years ago, resilience meant a backup data center and a disaster recovery plan that probably sat on a shelf and didn't get much airtime, right? And today's environment is, is way more complex and harder to navigate. Cloud dependencies, sprawling third-party ecosystems, AI-driven processes. It's just a minefield that most organizations can't can't map or don't bother to try and map. And if you overlay that on top of that with all the regulatory requirements like SOCI and APRA and CPS 230 and so on, yeah, the resilience bar has really raised significantly since then. So the biggest shift, I guess, is that leaders can now see their exposures that they always carried, but they weren't previously necessarily aware of them. So awareness hasn't really created new risks. It's surfaced risks that are already there and that can be a bit uncomfortable, but effectively it's a better start point. At least if you're aware of where your risks are, then, you know, you've got a good basis on which to start, right? So, yeah.

And from your perspective, have you noticed over the past 10 years that specifically around insider risk has changed?

I think there's certainly more awareness of it, but I think it's still very immature, to be honest. A lot of our clients, and when we look at, you know, because one of the first things we do when we onboard a client is look at their operational risk register. So we look at the categories of risk. So IT risk and supplier risk and financial risk, AI risk, etc. Insider risk sometimes features there, but it's quite scant usually in terms of—

Yep.

organizations understanding that. So yeah, I think it's definitely hitting the radar, but it's probably not as mature as where we would expect it to be relative to some of the other risks that organizations carry. Yeah.

Yeah.

Interesting.

Every organization talks about resilience, but what does a genuine resilient organization look like in practice?

Yeah. So

look, Do they know to start off with?

Well, so they know their critical services and the minimum viable level that each of those are and what the cost of downtime is. So it's not just about what's our organization chart, what's our product and service catalog. It's about saying, you know, what are those most critical services and what's the minimum viable level that we need to keep them running? It's about having tested plans under real-time pressure and realistic simulations, not just, you know, very scant basic walkthroughs to tick a compliance box. And really, it's about organizations that can recover functions and processes these days in minutes as opposed to hours and rather than days, you know. Used to be, you know, things used to be able to, you know, used to be able to turn the lights off for days, weeks, whatever it might be. But these days with the pace of business, it's just, you know, very, very different, much faster. I think the other key thing in terms of, you know, genuinely resilient organizations is those that learn from near misses and actually play that back into their framework, right? So, yeah. And finally, I guess it's taking a leadership approach as opposed to just purely an operational approach, you know, Maybe we'll talk about that a bit more as we go through. But fundamentally, you know, this shouldn't just be seen as a compliance thing. It's actually about leadership driving resilience conversations day in, day out. So, correct.

Correct. And so, and I'm sure you're aware, many organizations are sort of spending quite heavily in preventing disruptions. But do they spend enough time preparing for disruptions that they cannot prevent? I know it's sort of a side question, but yeah.

Yeah, most investment still flows to prevention because it feels controllable and it's tangible. And the people that control and spend the money can point to concrete deliverables. They can point to firewalls, they can point to insurance, they can say we've got multiple suppliers in place, we've got diverse data centers, etc. preparing for what you can't prevent, collapse of a supplier, regional outage of a major cloud provider, insider event, etc.

Yes.

Kind of means accepting failure is inevitable and, you know, rehearsing the response instead. So it's a different kind of mindset. And I guess across our client base, in terms of all of our clients, the gap's almost the same. There's a big investment in strong prevention controls, But that sits alongside very thin and untested real response capabilities.

Yeah, yeah, yeah. And, you know, we talked about it just before we got on air. Organizations tend to focus on resilience or after crisis. Why is it so difficult from your perspective to build resilience before something goes wrong?

It's resilience investments always competing for budget. against initiatives which have visible near-term returns. So when you're investing in resilience, you're effectively paying to prevent a cost or an impact that people can't really directly quantify or point to today. I mean, let's face it, who knows what the actual cost and impact of an incident might be that you plan for today but happens in 6, 9, 12 months down the track?

Correct.

So that mindset shift in terms of investing in that proactively is very different. So it also asks leaders to rehearse failure openly and be vulnerable, which is kind of against the instinct of a lot of organizations, which need to project confidence and control. And so that maturity is a big thing. So I guess what we tend to find is resilience tends to get funded reactively. And then once a near miss, something that actually, you know, becomes actually tangible, then organizations will start to want to invest more, be prepared to invest more in those types of countermeasures. Yeah.

Yeah. Now you briefly talked about it, I think, in your opening statement. So the question is, with the change or the massive change that we see in technology, third parties, AI, is resilience becoming more about managing complexity or sort of more about managing individual risks?

Definitely about complexity. I mean, organizations these days are so much more complex than they used to be. Cloud platforms, complex third parties, outsourcing arrangements, now AI laid over the top of all that. They've turned individual resilience components or aspects from a list of effectively sort of discrete risks into an intertwined web, which most organizations can't get their mind around. Years ago, we used to look at, you know, sort of categories of loss or impact to people, loss or impact to premises, loss or impact to IT, etc. And then we sort of got things like 9/11 that came along where, you know, they had actually sort of brought all those risks together. And business disruptions today rarely announce themselves as one of those individual threats. it's a cascade of all those different things, all interrelated. So managing that complexity and sort of understanding, you know, what are your single points of failure? Is it a piece of technology? Is it a critical vendor? Is it an AI model? And so on. That kind of ripples across the whole organization and no one's really got their mind around exactly what's gonna be impacted. It's a, it's definitely a very, very much more complex minefield these days. In terms of trying to understand, you know, where the impacts might be and where to build contingency measures. Yeah,

specifically when you compare this state to 10 years ago. And the key part is that all the interconnected, so you could talk about the risk of AI, but realize that there are other interconnected assets or resources that need to be built into that equation. So with that, The question is, do leadership often ask what could disrupt our organization? But is there a more important question that they should be asking?

Other than— sorry, other than

what could disrupt our organization? Because that would be the sort of the typical mindset. But is there a better question that they could be asking?

Yeah. So there's a term in business resilience and organization resilience planning called all hazards approach.

Yes.

And, and what that really advocates is we're, we're less interested in the particular incident itself, and we're more concerned about the impact of resources or what it means to us as a business. So rather than saying what could disrupt our organization, more— a better question is what resources or capabilities can't we afford to lose, and how quickly do we need them back? Because that forces leaders to think and prioritize the services from a customer sort of focused perspective. And the way is you do a business impact assessment across every single sort

of

stovepipe of your business, you know, operations, IT, etc. And a lot of organizations are doing that. Where are the high priority value delivery activities that our organization delivers. And maybe that's only 3 or 4 things that maybe generate 80% of the revenue or 80% of the value and then focus on those from that resource and capabilities perspective as opposed to saying what are all the different things that could actually impact us.

Okay, cool. Now, Rod, I did miss probably like 30 seconds of your text. So if you could just summarize your answer again just for the Because we could see you talking, but there was no sound coming through. So I'm just assuming that it wasn't recorded. So I'll take your answer again.

Yeah. Okay.

So just summarize your answer, which is basically, you know, is there a better question that you should be asking? And you mentioned something, maybe what could we not afford to lose could be—

Yeah, absolutely. So yes, rather than looking at specific events and incidents that could impact you, look at it from the perspective of what does that mean to us in terms of what resources and what capabilities can't we afford to lose and how quickly do we need to get those back, which is really what we talk about as an all-hazards approach. Whether it's a fire, whether it's a flood, whether it's a cyber incident, whether it's an AI outage, whatever it might be, what does that mean to us in terms of our resources and our capabilities that we can't afford to lose and how quickly do you want them to get them back? And the shift in thinking is rather than looking at every single area of the business is to look at those top value streams for the organization in terms of, you know, what are the things that generate the most value from a company perspective? And that might be value the CEO might term as revenue, but it might be services if you're in a different industry, say, for example, healthcare, and then sort of look at it from that perspective as opposed to just looking at all the different types of incidents because there are thousands of different types of incidents that can impact you, right?

Yeah. Is organization resilience a leadership issue, or should it be more of an operational or technical responsibility?

Sorry, but it's both.

It's a leadership— That was a trick question.

Yeah, well, there you go. And I've got a trick answer for you. It's a leadership issue that needs to be delivered operationally. So technical and operational teams can build controls. But only leadership can really make those big decisions about trade-offs, what to invest in, what's the level of acceptable risk, how much redundancy is enough, how much they're prepared to invest, etc. Only leadership can really make those, those big picture decisions. And then at the next level down, it's up to operations to work out how to implement those strategies to keep the lights on at an operational level, right? So, you know, it becomes a— if it's managed at that lower level, at an IT or risk team level, it becomes very much a technical response rather than a strategic or an operational one. And I can hand on heart tell you that the most successful resilience and business continuity programs we see from our clients are those that are actually led right from the top of the organization.

They need to. Correct. The same with insider risk. Can organizations realistically measure resilience? And I know we sort of briefly talked about measuring capability, or is resilience something that is only proven when organization is tested?

You can. This is a very interesting topic and one that the business continuity and the organization resilience industry has grappled with for quite some time. Because if you can measure it, you can put dollars around it, you can therefore demonstrate your value. And it's one of the big things that business continuity and organization operational resilience practitioners have a problem with is that how do they demonstrate value to an organization? Because you can measure resilience indicators. What are my recovery time capabilities? How current are my plans? What were the exercise outcomes last time around an exercise? How well are our dependencies mapped? How well do we understand our IT? But they're only the foundations. And what really helps you measure resilience is well-designed and thoroughly thought-through exercises that actually are realistic and stressful. And so in the face of a genuine disruption, do you really know how you're going to be able to respond and what everybody's roles are, how they're going to enact those, as opposed to saying, well, we've got current plans and on paper, we, you know, we know our recovery time objectives, recovery time point objectives, and so on. But knowing how the organization can actually perform under pressure by realistic simulation exercising, that's a much greater—

Yeah, that's where it matters. Absolutely. The crux of it. Otherwise, there's no point of it, no point of developing a resilience plan or something like that.

Absolutely. Yeah, that's right. Yeah.

You know, so, so this, this year's, um, theme is Where Trust Meets Risk. And, you know, we briefly talked about, you know, organization trust in people and systems and partners. But from a resiliency perspective,

Mm-hmm.

How should— do you think that leaders should think about the relationship between trust, organization capability, And organizational exposure?

Very interesting one. They're all interesting questions. Every grant of trust is also a grant of exposure.

Correct.

Which is exactly the tension in the Gitam theme, where trust meets risk, right? I think leaders need to think of trust as something which is architected and not assumed. So you can build things like monitoring, segmentation of duties, segregation of duties, verification, etc., proportional to the access and the reliance being granted to people. And then you can continually revisit that and balance it around, you know, the organization's operational policies and processes and systems and so on. But fundamentally, it needs to be something that the leadership team needs to design And not just assume that everybody that walks in the door can be absolutely trusted, you know, in all circumstances because that's proven not to be the case, right?

Exactly. So we've come down. That's amazing how quickly it's come. We're down to the last question. So if you could leave executives, leaders with one piece of advice about building a more resilient organization over the next 5 years, what would it be?

I think it would be to make sure that you build resilience into all business decisions that get made in your day-to-day operations rather than being something that's baked into a document that sits on a shelf or as a compliance obligation. What I mean by that is every major decision, new vendor, new partner, new system, new market we enter, new products and service, etc., needs to carry risk and resilience questions alongside the commercial ones. So organizations often go into these kind of things with a very much commercial— this is going to be this for the bottom line, this much more revenue, this much more profit. But what are these new initiatives doing to our exposure? And do we know what we need to do to recover if they fail? And I think that, you know, organizations that embed that habit into their, into their DNA outlast the ones that only revisit resilience after a crisis or a near miss or an incident.

They

actually, the leadership actually bakes it into ongoing management meetings, decisions, et cetera, et cetera. So that would be the, yeah.

Yeah, this is sort of the similar talk that I've heard many, many years ago, especially with software coding. And then, and the question was, do you design software or do you design software with security in mind? Because if you just design and develop the software code and then think about, oh, we better do something around the security side, bolt something on,

right?

Correct. Becomes super more expensive and most of the time it doesn't work. And so I think what you just said sort of hammers point that if the mindset right at the start starts with having that sort of a resilient approach to the things that they want to adapt into the organization, it's by far more valuable and useful moving forwards. Because this is the key here. There's no certainty to anything. There's no certainty to a situation. Right. So if, if there's an exposure, or a vulnerability or something, uh, unwanted happened, how quickly can they get back up to a normal state and so forth? Yeah. And if they just assume, well, 6 months from today we'll look at it, uh, yeah. And, you know, we did talk about what— why do, you know, leadership not look at resiliency before crisis hits? But that's more of a human behavior and an emotional Thinking.

Yeah, it continues continually and we probably shouldn't be surprised anymore. But when you work in the field we work in on a day-to-day basis, it still sometimes surprises us that organizations don't have that leadership and that level of thinking throughout their organizations. They're going out there, getting into new markets, opening new offices, starting new products and services, bringing on new applications, without that kind of thought process around what are the resilience aspects, what are the risks. And we just sort of say, why aren't organizations thinking about that? But that's not the culture that the organizations necessarily have. So even if you can start with small things like getting management to tag on 5 minutes of a weekly or monthly management meeting about risks and resilience and that sort of thing and start to build that culture and allowing people to sort of step up and say, hey, I think there's a risk in that new initiative or in this system or in that partnership, whatever it might be, et cetera, then over time you start to build that leadership, that leadership starts to build that culture and it starts to flow through the organization and becomes part of every conversation. You know, every conversation has an element of, and they're the ones that we look back and say, oh, we've kind of done our job when we see them talking about that sort of thing and in everyday conversations, not as a You know, a specifically set up venue or agenda, whatever it might be.

And you're talking about setting up a habit. 100%. And it's not something that's costly. So if they can get, you know, have a conversation that's 10 or 15 minutes and talk about briefly what are the sources of resiliency or risk associated with it and then reengage, rethink, Re-understand, then I think it's sound advice there, Rod. Great. Fantastic. Well, thank you very much for your time. I really appreciate you having on GIDM 2026 and I look forward to talking to you more.

Yeah, thanks very much for the opportunity to be part of it today, Boaz. And yeah, we'll talk again soon.

Thank you, Rod.

Excellent. Thank you.