What must prevail when we cannot preserve everything? In 480 BC, Xerxes advanced into Greece with an army…
Luis P. — Strategic Advisor | Resilience, Risk & Cybersecurity
What must prevail when we cannot preserve everything?
In 480 BC, Xerxes advanced into Greece with an army whose overwhelming numbers made it unreasonable to face him where the Persians could fully deploy their strength. The Greeks could not match that force, but they could change the conditions under which they faced it.
Thermopylae offered that possibility. The narrow passage between the mountains and the sea limited the space for combat and prevented the Persian numbers from being brought to bear all at once. Leonidas chose a scenario where one of his adversary’s greatest strengths lost much of its relevance.
There is a lesson here. Strategy does not always mean having greater capabilities than your adversary. It can also mean understanding both sides’ capabilities and acting where the relationship between them is most favorable. But no strategy controls every circumstance or guarantees avoiding losses.
For two days, the Greeks resisted the Persian attacks. When circumstances changed and the Persians found a route around the pass, that advantage was no longer enough. Leonidas remained with a reduced force to continue the defense. In the end, lives, resources, and the position were lost.
Thermopylae was a military defeat. Xerxes crossed the pass and continued his advance. Yet Greek resistance continued. Something survived those losses: the identity of those who had decided what they were defending and why.
Organizations also face moments when they cannot preserve everything.
During a cyber incident, they may lose resources, money, information, or operational capacity. They may have to suspend services, abandon assets, or accept consequences no preparation could completely prevent. The strategy may be defensive or take the initiative; either way, there may be losses.
That is why losses alone do not determine the outcome. The question is what we intended to preserve and whether our decisions preserved it.
The opposite of Thermopylae can also happen.
An organization may contain the attack, recover its systems, restore operations, and meet its technical recovery objectives. It may have won the battle. But it may also have abandoned commitments, withheld relevant information, or made decisions contrary to the values it claimed to represent.
Then victory is less certain.
Organizational identity does not reside in the servers, processes, or technologies we recover. These can change. It lies in what gives the organization direction: its purpose and values. When preserving them comes at a cost, they stop being declarations and begin to guide decisions.
A crisis may force us to lose resources, transform the organization, or accept unavoidable consequences without losing who we are. But we can also recover resources, restore operations, even win the battle, while sacrificing what we intended to preserve.
After a cyber incident, perhaps the most important question is not simply whether the organization continued.
We should ask:
Are we still who we were?
3 reactions · 2 comments
Comments
Mario M.: Strong perspective. What stands out to me is that preserving organizational values during an incident also depends on whether those values have been translated into actual decision-making before the crisis happens. Under pressure, teams fall back on priorities, workflows, and escalation paths. A technically successful recovery does not necessarily mean the organization made the right decisions alo
Luis P.: That's exactly the point Mario! A shared criterium and clarity of organization value is key for an autonomous response from each area pointing to the same purpose, preserve what must prevail: Identity