This week we are going to talk about resilience (for everyone), and, for paying subscribers, about what I learned at the Forum InCyber in Lille (FIC, the Lille cybersecurity forum), where I had a packed schedule:
- A fireside chat on agentic AI (Trust & Safety Forum)
- A debate on the new forms of cognitive warfare (PhilosoFIC)
- A keynote for the Defense track with NATO and the French armed forces
- And of course our meetup at the Bretagne Cyber Alliance pavilion
This year, at last, I get the feeling that things are being taken seriously. It took Covid, two wars and two Trump administrations to understand that the world has changed.
It is no longer about covering specific risks but about having a cross-cutting view.
Resilience is no longer a concept, it is a crash test
The term has long existed in cybersecurity: a company's ability to get back on its feet and become operational again, or not.
Nobody embodies it better than Ashish Shrestha, the former Group CISO of Jaguar Land Rover:
- August 31, 2025: major cyberattack, complete shutdown of IT systems and production lines
- Return to normal: not until mid-November
- Wholesale sales down 43.3% for the quarter
- Down 64.4% in North America
In an op-ed for Le Point, I had extended this question of resilience to the stakes of sovereignty.
Tariq Krim
Three risks now compound one another:
- Techflation: uncertainty over prices (what we saw with VMware)
- Extraterritorial reach of the law: is the actual security of your data guaranteed?
- Transatlantic decoupling: what do you do if a cloud provider degrades or shuts down its service despite a contract?
This new form of resilience was at the heart of the debates at the Forum InCyber this year. In particular through the digital resilience index launched by the Caisse des Dépôts.
Why you need a Chief Resiliency Officer
Cyber is already covered by the CISO, finance by the CFO, legal by the general counsel, and risk, sometimes, by a Chief Risk Officer. These roles belong to a reasonable world where risks are identified, categorized and handled separately. We no longer live in that world.
This is where the role I call Chief Resiliency Officer comes in. Someone who works across the organization to adapt the company's strategy to a world where geopolitics, cyber, politics, or sometimes the absence of politics, force decisions outside the usual scope.
The difference from a Chief Risk Officer:
- CRO: formal audits, risk registers by business unit, vertical approach
- Chief Resiliency Officer: informal check-ins, underlying trends, cross-cutting approach
The regulatory context is accelerating
The transposition of NIS2, which was supposed to be finalized in October 2024, is still pending:
- 95% of French companies had suffered incidents that NIS2 compliance could have prevented (Veeam, 2024)
- 10,000 to 15,000 additional organizations fall within the scope of NIS2, 30 times more than under NIS1
Current events and regulation have made this role, which did not exist a few years ago, a necessity.
What this newsletter offers
This newsletter helps all our paying subscribers become the future Chief Resiliency Officers of their organizations. Geopolitics, agentic AI, cultural and economic questions: there was no user manual for becoming active in the field of resilience. That is what we are trying to offer here.
To become a paying member before the price increase, here is the link.
Here, for our paying subscribers, is everything I learned from my conversations at FIC.
Read the full article
Sign up now to read the full article and get access to all articles for paying subscribers only.
