Cyber resilience in firms, organizations and societies

Abstract Cyber resilience involves most societal actors, i.e. organizations, individuals, threat actors, governments, insurers, etc., at most levels of organization. Actors are embedded within each other and choose strategies based on beliefs and preferences which impact and is impacted by cyber resilience. The article reviews the literature, attempting to capture the core ingredients of cyber resilience. Non-threat actors seeking to obtain cyber resilience are distinguished from threat actors. Actors have resources, competence, technology, and tools. They make choices that impact the cyber resilience for all actors, including themselves. Cyber resilience relates to cyber insurance through entry requirements or preconditions for cyber contracts, need for various services such as incident response, data gathering, and cover limitations. Cyber resilience is linked to the internet of things which in the future can be expected to simplify life through artificial intelligence and machine learning, while being vulnerable through a large attack surface, insufficient technology, challenging handling of data, possible high trust in computers and software, and ethics.