Luis P.

Aug 16, 2026

What must prevail when we cannot preserve everything?

In 480 BC, Xerxes advanced into Greece with an army whose overwhelming numbers made it unreasonable to face him where the Persians could fully deploy their strength. The Greeks could not match that force, but they could change the conditions under which they faced it.

Thermopylae offered that possibility. The narrow passage between the mountains and the sea limited the space for combat and prevented the Persian numbers from being brought to bear all at once. Leonidas chose a scenario where one of his adversary’s greatest strengths lost much of its relevance.

There is a lesson here. Strategy does not always mean having greater capabilities than your adversary. It can also mean understanding both sides’ capabilities and acting where the relationship between them is most favorable. But no strategy controls every circumstance or guarantees avoiding losses.

For two days, the Greeks resisted the Persian attacks. When circumstances changed and the Persians found a route around the pass, that advantage was no longer enough. Leonidas remained with a reduced force to continue the defense. In the end, lives, resources, and the position were lost.

Thermopylae was a military defeat. Xerxes crossed the pass and continued his advance. Yet Greek resistance continued. Something survived those losses: the identity of those who had decided what they were defending and why.

Organizations also face moments when they cannot preserve everything.

During a cyber incident, they may lose resources, money, information, or operational capacity. They may have to suspend services, abandon assets, or accept consequences no preparation could completely prevent. The strategy may be defensive or take the initiative; either way, there may be losses.

That is why losses alone do not determine the outcome. The question is what we intended to preserve and whether our decisions preserved it.

The opposite of Thermopylae can also happen.

An organization may contain the attack, recover its systems, restore operations, and meet its technical recovery objectives. It may have won the battle. But it may also have abandoned commitments, withheld relevant information, or made decisions contrary to the values it claimed to represent.

Then victory is less certain.

Organizational identity does not reside in the servers, processes, or technologies we recover. These can change. It lies in what gives the organization direction: its purpose and values. When preserving them comes at a cost, they stop being declarations and begin to guide decisions.

A crisis may force us to lose resources, transform the organization, or accept unavoidable consequences without losing who we are. But we can also recover resources, restore operations, even win the battle, while sacrificing what we intended to preserve.

After a cyber incident, perhaps the most important question is not simply whether the organization continued.

We should ask:

**Are we still who we were?

View post

Aug 9, 2026

When a company suffers a cyberattack:

What decision can destroy, in an instant, years spent earning the market's trust?

When a crisis such as a cyber incident occurs, most attention naturally focuses on containing the problem, recovering affected resources, and determining whether the organization's ability to meet its commitments to the market has been impacted. If the answer is yes, another decision begins to demand attention—one that rarely receives the same level of focus.

There is often a temptation to delay that decision until more accurate information is available, the impact is fully confirmed, or simply to avoid harming the organization's reputation. Yet, sooner or later, the truth always comes to light.

The decision is whether—or not—to fulfill the responsibility of communicating that impact to the market in a timely manner.

Every organization is part of a broader market. Customers, suppliers, partners, regulators, and many others depend, to varying degrees, on its ability to honor the commitments it has made. When that communication is delayed, uncertainty increases. More importantly, it reduces the time available for others to adapt to the new reality, because timely communication does more than inform—it triggers the market's response.

A crisis tests an organization's ability to respond. It also reveals the level of responsibility with which it chooses to engage with its environment. Ultimately, it is the market that will decide whether that response strengthens or weakens the trust it has placed in the organization.

View post

Aug 4, 2026

Beyond the Incident: What Else Does a Cyberattack Damage?

When a company suffers a cyberattack, besides the obvious damage, what else may be affected?

When a cyberattack occurs, attention naturally turns to containing the incident, restoring systems, and resuming operations. At the same time, another conversation begins. Customers, suppliers, employees, investors, and the market start asking questions. Some have answers. Others quickly become rumors, assumptions, and speculation.

Uncertainty always looks for an explanation. When an organization fails to communicate with transparency and in a timely manner, people create their own. As hours pass, the attack itself gradually becomes less important. What people begin to evaluate is the organization's response. Did it acknowledge the incident? Was it honest? Did it explain what was happening? Did it take responsibility? Did it deliver on the commitments made during recovery?

At that point, something happens that goes far beyond technology.

Trust depends on the organizational response, not on the incident itself.

But what do we really mean by organizational response?

It is often associated only with incident containment and system recovery. In reality, those are only part of the response.

Organizational response is the way an organization manages its interaction with its immediate environment. That interaction never stops. A crisis simply changes the conditions under which it must continue.

When available capacity is reduced, the organization must adapt the way it interacts with customers, employees, suppliers, investors, regulators, and the broader market. Recovering systems is essential, but so is preserving trust, honoring the commitments that can still be fulfilled, communicating transparently, and maintaining the legitimacy of its decisions.

In other words, organizational response is not only about restoring operations. It is about preserving a coherent relationship with the environment while circumstances change.

No organization is immune to crisis. What remains under its control is how it chooses to respond. Every message, every silence, every commitment made—and every commitment fulfilled—either strengthens or weakens a trust that may have taken years to build.

Ultimately, organizations are remembered not only for the crises they faced, but for the way they responded to them.

View post

Jul 24, 2026

This is not intended to be a framework or a methodology.

It is simply how I have come to understand organizational continuity after years of working with organizations facing uncertainty, disruption, and change.

I would be interested to know how it compares with your own perspective.

#BusinessContinuity #OrganizationalResilience #Governance #DecisionMaking #Leadership #CISO

View post

Jul 18, 2026

When the Incident Ended...

The Real Challenge Began

Imagine an organization that has just emerged from a major cyber incident.

Operations never returned exactly to what they were before.

Some processes changed permanently. Responsibilities were redefined, new controls were introduced, and decisions made during the crisis reshaped the way the organization worked.

Yet the business continued to deliver value. It learned from the experience, strengthened its capabilities, and became better prepared for whatever came next.

That raises an important question.

Was the goal simply to restore operations... or to preserve the organization's ability to fulfill its purpose?

For many years, business continuity has been understood as the ability to return to a previous state.

But organizations do not always need to go back to where they were.

Sometimes they must evolve to preserve what truly defines them.

Perhaps this is where business continuity fulfills its mission.

Organizational resilience begins when an organization learns, integrates its experience, and continues building its future without losing what makes it who it is.

View post