Just_Super / E+ / Via Getty Images
Companies are getting faster at disclosing cyberattacks and slower at explaining what those attacks actually cost. Since the SEC’s cyber disclosure rule took effect, a public company has four business days to file an 8-K once it determines an incident is material, often before it knows the full scope. The filing says some version of the same thing: Systems are affected, operations are disrupted, and whether the impact will be material has not yet been determined.
Increasingly, these incidents get discussed as one problem, with cybersecurity, business continuity, and enterprise resilience collapsed together, when each does something different. Cyberattacks are hitting more often and doing more damage when they land, which makes the distinction matter more. Cybersecurity focuses on detecting and stopping the attack itself. Business continuity and enterprise resilience determine how the organization keeps operating once that happens. Detection and containment alone aren’t enough. When disruption hits, the business continuity function must be able to answer what is impacted, what happens next, what is the financial exposure, and what should be prioritized.
Why the Distinction Matters Now
Cybersecurity as a discipline is mature. Most large organizations know how to detect threats and contain attacks. But a single incident can now disrupt far more than the organization it targets. Cyberattacks spread across supplier and partner ecosystems, reaching well beyond where an incident begins. AI is expanding that exposure further, creating new attack surfaces and giving attackers tools that make incidents harder to contain. Stopping a threat is only part of the problem. Organizations also need to understand what happens to the business if the threat succeeds: which services must continue, and if three go down at once, which gets restored first.
Most organizations aren’t there yet. PwC’s 2026 Global Digital Trust Insights survey found that only 6% of business and tech leaders consider themselves “very capable” of withstanding cyberattacks across the vulnerabilities they face and points to unclear ownership of critical systems as a root cause. BDO’s 2026 Global Risk Landscape reaches a similar conclusion from a different angle: 80% of business leaders now say the risk environment is defined by crisis more than ever, and the organizations managing it best have moved risk ownership out of a single function and into shared, cross-functional accountability. Business continuity is where that ownership question lands hardest, because it’s the function actually accountable for keeping the business running once an attack succeeds. Many organizations are resolving the ambiguity by pushing that accountability onto their CISOs, expecting them to own business continuity and disaster recovery alongside incident response.
What CISOs Should Own
None of this means CISOs should pull back. The expansion is happening, and boards are right to expect more from security leaders than incident response. But there’s a real difference between direct ownership and influence, and getting that wrong is its own failure mode. A CISO who tries to run business continuity for the entire enterprise ends up accountable for outcomes in parts of the business they have no visibility into and no authority to fix, including supplier risk, facilities, and HR continuity, none of which sits inside a security function’s normal remit. The mandate is better spent building a detailed picture of business impact and pushing the organization toward shared visibility and defined decision rights across functions.
That shift becomes obvious in the first hour of an incident, when a board wants answers about business impact, financial exposure, and key priorities. Most organizations can’t provide those answers quickly. The information needed lives in separate plans and spreadsheets and in the heads of individual team leads. Almost nobody has it in one model everyone trusts. Building that shared model and making sure it’s fed by cybersecurity, IT, operations, and the business units that run the affected services are what actually closes the gap, not adding another functional owner to an already stretched security team.
How Resilient Organizations Operate
Companies handling this well have connected their cyber incident response to a live view of how everything in the business depends on everything else. That connection does more for them than the size of their security budget.
I watched one healthcare customer work through this. They operate under CMS’s 72-hour recovery requirement, and before they centralized their resilience data, an incident meant days of manual work just to figure out which departments, systems, or vendors were affected. In healthcare, that kind of delay has real consequences.
After connecting their business processes, applications, and vendors in a single model, that same analysis takes minutes. During an actual cloud-provider outage, the team completed a full dependency and impact analysis in under an hour, work that used to take three to five days. And rather than treating everything as critical, they ranked their processes and found that only about 30% actually are, so the team knows where to focus the moment something breaks, instead of relearning it live.
Where to Start
Closing that gap comes down to a few concrete actions:
- Decide who owns which decisions before an incident happens.
- Build a current view of how technology, suppliers, facilities, and people connect to the services the business depends on, so when something breaks, the impact is visible right away.
- Run response drills across functions with the cyber and continuity teams in the same room.
- Revisit that dependency map on a set schedule. Suppliers and architecture change faster than plans do.
Cybersecurity incidents are increasingly business disruptions, because the systems under attack already sit at the heart of business operations. The organizations that close this gap treat incident response as connective work across functions, not a security team’s solo assignment. That’s what determines whether a CISO can answer the board’s questions in the first hour or is still reconstructing the timeline a week later.
