For many organisations, scenarios that once belonged in crisis exercises now feel uncomfortably plausible, reports F24.
Employees might get refused entry at borders, access to critical cloud accounts might get restricted without warning, international commitments might get delayed by political decisions beyond the organisation’s control.
What once sounded like a remote, worst-case simulation has now become a credible stress test for business continuity, security and leadership.
In 2026, risk managers and security leaders face a landscape defined by speed, interdependence and uncertainty. Traditional crisis management remains essential, but it is no longer enough on its own.
To remain functional, organisations now need to operate under pressure, make sound decisions with incomplete information and adapt before disruption becomes damaging.
Resilience is no longer a supporting capability – it is a strategic requirement.
When supplier relationships become systemic risks
Supply chains have moved beyond operational dependency.
In today’s environment, supplier ecosystems are risk networks. A technology provider, logistics partner, data processor or specialist service provider may sit several steps away from the customer, but a disruption in one part of the ecosystem can quickly affect compliance, availability, service levels and trust.
Geopolitical fragmentation, shifting regulation and strategically motivated cyber-activity can trigger chain reactions across suppliers, regulators and customers.
The challenge is rarely a complete lack of information. More often, the issue is whether the organisation can interpret weak signals quickly enough and act before the full picture is available.
This is where risk intelligence becomes a leadership discipline. Legal, procurement, IT, security, operations and communications teams need a shared understanding of exposure.
If risk is systemic, silos become risks in their own right. Resilient organisations connect information across functions and turn it into timely action.
Technology is no longer neutral
Stable digital infrastructure is now a business prerequisite. Cyber-crime remains one of the most significant threats facing organisations and is becoming more professional, automated and scalable.
Attackers increasingly use automated reconnaissance to identify weaknesses, while AI accelerates disinformation, impersonation and social engineering.
As innovation cycles are now shortening, technology can no longer be treated as a neutral tool. It has become an efficiency driver, a source of dependency, a target for adversaries and, in some cases, an instrument of geopolitical influence.
For leaders, resilience requires monitoring and early warning capabilities that detect “invisible” risks before they become visible failures.
These may include supplier compromise, gradual restrictions on access, changing political direction or long-term infiltration of critical infrastructure.
Organisations cannot assume that digital stability will be maintained simply because it has held in the past.
Trust must become a control objective
Even political announcements can have disruptive effects before they become law or regulation.
They can influence planning certainty, procurement confidence, data protection assumptions and compliance obligations. Trust must therefore be treated as a control objective.
This is not only about trusting the technical competence of a service provider. It is also about understanding the operational, legal and regulatory environment in which that provider operates.
A supplier may be technically capable but exposed to external pressures that create risk for customers.
Boards and executive teams should ask two direct questions. Where are we dependent in terms of instability that we cannot influence? Where can we deliberately build stability into our ecosystem?
Stability as the foundation of resilience
There is no single model that fits every organisation, sector or jurisdiction.
But the emerging logic of resilience is consistent: secure stability wherever possible and build the ability to respond rapidly where stability cannot be guaranteed.
The first step is to analyse digital and analogue infrastructure together.
Critical interfaces, failure points and emerging vulnerabilities must be identified not only in technology, but also in contracts, supply chains, access rights, escalation routes and workforce awareness. Resilience is weakened when treated purely from a technical perspective.
The second step is decision speed. Organisations need processes that verify signals quickly, bring the right people together and enable action before all facts are confirmed. In a volatile environment, waiting for perfect information can become a form of exposure. The goal is disciplined speed.
The third step is reducing systemic gaps. This means working with partners that demonstrate reliability, accountability, transparent operations and mature security standards.
It means challenging legacy dependencies that may have been efficient in stable times but fragile in unstable ones.
Finally, organisations need to plan for cascade effects. Scenario tests should examine how legal changes, sanctions, market disruption or supplier failure could affect compliance, service availability and customers. The aim is to reveal where coordination breaks down.
Procurement as a resilience lever
Procurement has become one of the most practical ways to change an organisation’s risk profile. Buying decisions are no longer just about cost, functionality and service level agreements.
They can materially affect exposure to geopolitical and regulatory uncertainty.
For many European organisations, prioritising European suppliers can reduce certain categories of risk, particularly for business-critical systems. This is not about closing markets or rejecting innovation from elsewhere.
It recognises that regulatory alignment, jurisdictional clarity, proximity and shared standards can become resilience advantages.
European procurement can support data ownership and security by keeping sensitive information within familiar legal frameworks and expectations. It can also provide greater predictability in relation to duties, dispute resolution, compliance assurance and liability.
For organisations affected by DORA, NIS2, KRITIS or GDPR, suppliers with established European compliance structures can reduce friction, close contractual gaps and improve auditability. Shorter escalation routes, consistent teams and aligned time zones can also improve crisis response and day-to-day resilience.
Collaboration is also becoming a resilience factor. European ecosystems, common standards and cross-border cooperation can strengthen shared intelligence and coordinated response.
In a period of uncertainty, partners who understand the same regulatory and operational context can be decisive.
From intention to execution
Resilience cannot remain a boardroom ambition or a policy document.
It must become an operating model with early warning systems, rehearsed response processes, documented decision pathways and regular testing. Disruption now escalates faster and punishes slow coordination.
Governance is also becoming more personal, as leadership responsibility and liability move closer together. Decision-making must therefore be repeatable, auditable and clear.
Leaders need to know who has authority, what information is required, which partners must be involved and how customers or regulators will be informed.
Turning uncertainty into advantage
Geopolitical and technological change has shifted crisis mode from an exception to a baseline condition.
That is uncomfortable, but it also creates opportunity.
Organisations that invest in resilience can differentiate themselves through reliability. They can identify threats earlier, protect continuity better and maintain trust when competitors are forced into reactive firefighting.
The time for a resilience check is now. Responsibilities must be clarified.
Supply chains must be tested. Procurement must be treated as a strategic lever. Dependencies that cannot be influenced directly should be reduced where possible and managed deliberately where they cannot be removed.
Resilience is the ability to remain successful despite disruption, adapt under pressure and continue operating when conditions change.
It combines flexibility, technical robustness, leadership discipline and a willingness to learn. In 2026, that combination will be more than a defensive capability.
It will be a source of competitive strength.
For security leaders, the message is simple: organisations cannot control every geopolitical, regulatory or technological shock.
But they can decide how exposed they are, how quickly they respond and how much stability they build into the systems on which they depend.
