The New Resilience Challenge: Turning Programs Into Capability

For years, much of the focus within resilience has been on building the program: establishing governance, conducting Business Impact Assessments, developing recovery strategies and plans, exercising capabilities, implementing technology, gaining executive support, and building the appropriate team.

Those fundamentals remain important. However, findings from Resilience360 Advisory’s 15th Global Resilience Management Trends Report suggest that many organizations are reaching a different stage in their resilience journey. Nearly 73% of programs represented in the research have existed for four years or longer, and most organizations have established many of the foundational practices associated with Business Continuity, Crisis Management, Disaster Recovery, Emergency Management, and broader Operational Resilience.

The more interesting question may therefore be what organizations do with those foundations next.

The operating environment is changing quickly. Artificial Intelligence, cyber and technology dependencies, geopolitical instability, third-party concentration, supply-chain disruption, regulatory expectations, and increasingly interconnected operations are altering both the risks organizations face and the capabilities they may need. The next resilience challenge may be less about building another process, framework, or plan and more about turning established programs into actionable business capabilities that can adapt as the organization and its risks change.

This year's research provides several indications of where that transition may already be occurring.

Resilience Is Moving From Governance Toward Action

One of the more interesting long-term findings is the continued shift in where resilience programs reside organizationally. Risk Management remains the most common department owner at 21%, but Emergency/Crisis Management has steadily increased from 4% in 2019 to 7% in 2022, 10% in 2024, and 12% in 2026. Over the longer term, Information Technology ownership has moved in the opposite direction, declining from 23% in 2010 to 9% in 2026.

These movements should not be interpreted as Risk Management or Information Technology becoming less important to resilience. Instead, they may reflect a broader change in what organizations need their resilience programs to accomplish. Significant attention has been devoted over the past decade to governance, risk identification, controls, frameworks, and regulatory requirements. Increasingly, organizations must also demonstrate whether those structures translate into an ability to respond, make decisions, coordinate leadership, and recover when disruption occurs.

This creates an important question for program leaders. Is your program primarily structured to govern resilience, or can it demonstrate the organization's ability to execute resilience? The two are not mutually exclusive, but mature programs increasingly need to accomplish both.

Executive sponsorship provides another perspective. The Chief Risk Officer remains the most frequently identified sponsor at 18%, followed by the CIO/CTO at 11% and COO at 10%. More broadly, sponsorship is now distributed across Risk, Technology, Operations, Security, and other executive functions, reinforcing the increasingly enterprise-wide nature of resilience.

Access to leadership also appears important. Forty-two percent of program sponsors sit directly on the Executive Committee and nearly three-quarters, 73%, are within one level of it. Respondents whose sponsors sit directly on the Executive Committee were also more likely to believe their program was positioned appropriately for maximum effectiveness.

For program leaders, the implication is broader than simply identifying an executive sponsor. The more meaningful question may be whether that sponsor has sufficient visibility, engagement, and organizational influence to elevate resilience issues when decisions about risk, priorities, and investment are being made.

Program Maturity Is Increasingly About Validation

Another important distinction in the research is the difference between having established resilience practices and continually validating that those practices remain effective.

Nearly two-thirds of organizations, 64%, review and update their BIA annually. When the data is cross-referenced by program maturity, however, 82% of mature programs conduct BIAs annually compared with only 39% of immature programs. Thirty percent of immature programs are still developing their BIA process, compared with just 2% of mature programs.

A similar pattern emerges in exercising. Overall, 80% of respondents exercise their programs. Among mature programs, that figure reaches 96%, compared with 46% among immature programs. Mature programs are also more likely to use simulations and live exercises rather than relying solely on less complex forms of validation.

The distinction matters because the existence of a BIA, recovery strategy, or plan does not by itself establish capability. Business operations change. Technology changes. Suppliers change. Organizational structures change. Recovery assumptions that were reasonable several years ago may no longer reflect how critical products and services are actually delivered.

For organizations with long-established programs, this may warrant a different maturity discussion. Rather than asking only whether the required components exist, leaders may need to ask when those assumptions were last challenged, how recovery capability has been demonstrated, what weaknesses exercises have exposed, and whether corrective actions have actually been completed.

In other words, the measure of maturity may increasingly shift from documentation to evidence.

The Resilience Mandate Continues to Expand, and Investment Has Not Disappeared

The scope of today's resilience program also looks considerably different from a program centered primarily on Business Continuity and Disaster Recovery. Business Continuity remains the most commonly managed discipline at 89%, followed by Crisis/Incident Management at 86%, but respondents also identified Resilience Management (70%), Pandemic Planning (66%), Emergency Management (58%), Crisis Communications (52%), Third-Party Risk Management (32%), Operational Risk (28%), and Supply Chain Resiliency (27%) among the responsibilities incorporated into their programs.

That broader scope has implications for staffing, governance, technology, and the capabilities expected of resilience professionals. It also raises a practical question for organizations: Has the operating model supporting the resilience program evolved at the same pace as its responsibilities?

The staffing and budget data suggest organizations continue to recognize the need for investment. Looking toward 2027, 29% expect to add dedicated resilience personnel, while only 6% anticipate reducing staff. Among organizations anticipating reductions, financial pressures and organizational restructuring were the most frequently identified reasons; only 8% attributed the expected reduction to a decreased scope of resilience work. Twenty-eight percent also expect increased investment in full-time personnel, while 25% anticipate increased investment in BCM/Resiliency technology.

These findings do not suggest unlimited resources. In fact, they may make effective benchmarking more important. As resilience responsibilities expand, simply asking whether a program needs “more people” or “more budget” provides limited guidance. The more useful questions concern whether staffing and investment are appropriate for the organization's size, industry, program scope, maturity, regulatory environment, geographic footprint, technology dependencies, and actual responsibilities.

AI Is Becoming Both a Resilience Tool and a Resilience Risk

Artificial Intelligence introduces perhaps the clearest example of why established resilience practices will need to continue evolving.

More than half of respondents, 55%, describe their use of AI within resilience as experimental or pilot-based, while only 10% report integrating AI across multiple resilience processes. Current applications already include risk identification and horizon scanning, crisis decision support, BIA and dependency mapping, early warning, and stakeholder communications.

The more significant finding, however, may be the gap between AI adoption and AI resilience. Fifty-seven percent of respondents do not currently test AI-enabled tools or assumptions during resilience exercises, and less than 1% explicitly include AI failure scenarios. Only 6% report actively mitigating AI as an operational risk through controls and contingency planning.

Questions around data and skills add another dimension. Only 4% are highly confident in the quality and resilience of the data supporting their AI tools. Forty-six percent indicate their resilience teams have limited AI awareness, while another 30% report no dedicated AI capability. At the same time, nearly half expect AI to moderately improve insight and decision speed, and 23% anticipate significant transformation of resilience processes.

The opportunity for resilience leaders is therefore broader than determining where AI can improve efficiency. Organizations may also need to understand where AI is becoming embedded within critical activities, what dependencies it creates, how decisions will be made when AI outputs are unavailable or unreliable, and whether those scenarios are represented within existing resilience strategies and exercises.

AI can strengthen resilience. It can also become another dependency that needs to be made resilient.

Financial Impact May Be the Bridge to More Strategic Resilience Conversations

One of the persistent challenges for resilience professionals has been communicating program value in terms that resonate beyond the resilience function. The financial-impact data in this year's research illustrates one way that conversation may evolve.

Many organizations continue to report difficulty quantifying the financial consequences of downtime. Among those able to estimate exposure, however, the impact increases substantially as disruption continues. Ten percent estimate losses exceeding $1 million per hour after one hour of downtime. That increases to 28% when critical products or services remain unavailable for 72 hours or longer.

The exposure is greater among larger organizations. Fifty percent of organizations with annual revenues exceeding $20 billion estimate losses above $1 million per hour following a disruption lasting 72 hours or longer. Among financial services organizations of that size, the figure increases to 71%.

This type of information can change the nature of an executive resilience discussion. Rather than focusing only on the cost of a resilience initiative, organizations can consider the financial and operational exposure associated with not having the required capability. Recovery priorities, staffing, technology investment, third-party dependencies, insurance, and exercise strategies can then be evaluated within a broader discussion of acceptable business risk.

This does not require every organization to calculate downtime exposure to the dollar. It does suggest that resilience programs may benefit from becoming better at translating operational disruption into the measures leadership already uses to make decisions. What products and services matter most? What dependencies create the greatest exposure? How long can disruption realistically be tolerated? What would failure mean financially, operationally, regulatorily, and reputationally? And is current resilience investment aligned with those answers?

The Next Measure of Resilience May Be What the Program Enables

Taken together, the findings from the 15th Global Resilience Management Trends Report suggest a profession that has established many of its foundations but is now being asked to do more with them.

Governance remains important, but organizations also need execution. Plans remain important, but organizations increasingly need evidence that recovery strategies work. Technology can improve resilience, but it also creates dependencies that must be understood. Broader program scope may strengthen enterprise resilience, but only if staffing, skills, governance, and investment keep pace. Executive sponsorship provides visibility, but engagement and influence determine whether resilience becomes part of meaningful business decisions.

This may require organizations to rethink how they assess program maturity. A mature program is not necessarily one that has accumulated the greatest number of processes, plans, tools, or frameworks. Increasingly, maturity may be demonstrated by the organization's ability to understand its exposure, anticipate changing risks, validate its capabilities, adapt to business change, and provide leadership with information that supports better decisions.

For resilience leaders, that creates a useful challenge when looking at their own programs. It is relatively easy to compare current practices against a framework or confirm that required program components exist. It is more difficult, and potentially more valuable, to understand how those capabilities compare with organizations facing similar business realities.

That may be the question worth carrying into 2027: Are we maintaining a resilience program, or are we continually building the resilience capability our organization will need next?

The 15th Global Resilience Management Trends Report explores these and other findings across program maturity, organizational structure, executive sponsorship and engagement, assessments and exercises, staffing, budgets, financial impact, regulations and standards, Artificial Intelligence, technology, and emerging resilience priorities.

For organizations that want to look beyond the broader findings, the research also provides a basis for comparing resilience practices against more relevant peer organizations. Sometimes the most useful benchmark is not the overall average, but understanding who your true peers are, where your program differs, and whether those differences reflect an intentional strategy or an opportunity to improve. 

That is where benchmarking becomes more than a comparison. It becomes a better set of questions.

Want to Take a Closer Look at Your Program?

The broader findings tell an important story, but every resilience program operates within a different environment. Industry, organizational size, regulatory requirements, program maturity, scope, staffing, and structure can significantly change what a meaningful comparison looks like.

If this article raised questions about how your own program compares, Resilience360 Advisory can help you move beyond broad averages to benchmark your program against relevant peers, identify gaps and opportunities, and support more informed conversations with leadership.

Explore our Resilience Program Benchmarking & Strategic Insights: Resilience Program Data Insights | Resilience360 Advisory & our Resilience Compensation Insights: Resilience Compensation & Career Studies | Resilience360 Advisory.

About Resilience360 Advisory

Resilience360 Advisory combines more than 25 years of resilience expertise with global market intelligence to support organizations and professionals through specialized staffing and talent solutions, program and compensation benchmarking research, and career coaching and development. Our data, industry network, and experience help organizations build stronger programs and teams while helping resilience professionals advance their careers.