[Keynote] Buying Protection vs. Building Preparedness: Creating Resilience in the Age of AI

Organizations are investing heavily in cybersecurity technology, artificial intelligence, identity protection, threat detection, and increasingly sophisticated defensive capabilities. These investments are essential. But protection and preparedness are not the same thing. The rapidly evolving AI-enabled threat environment is exposing that distinction. Artificial intelligence is increasing the speed, scale, personalization, and sophistication of cyberattacks. Deepfakes can challenge traditional assumptions about identity. AI-enabled social engineering can exploit trusted relationships. Compromised accounts can reveal organizational structures, financial processes, and communication patterns that adversaries can rapidly use against employees and executives. Increasingly autonomous systems may further compress the time available for organizations to recognize threats and make consequential decisions. The result is a growing preparedness gap. Organizations can purchase technologies designed to prevent, detect, and contain cyberattacks, but technology alone cannot ensure that executives know who has decision authority during a crisis, that employees know how to verify a convincing but fraudulent request, that critical business functions can continue when primary systems are unavailable, or that leadership teams can make effective decisions with incomplete information and severe time pressure. This keynote examines the difference between buying protection and building preparedness. Using current cybersecurity research, emerging AI-enabled threats, and real-world incidents, I will explore what happens when preventive controls do not stop the disruption. The presentation will compare organizations facing similar cyber conditions but possessing very different levels of operational preparedness and examine why their responses, and potentially their business outcomes, can differ dramatically. The presentation introduces four practical organizational capabilities leaders can strengthen before the next disruption: Planning - Understanding critical operations, dependencies, decision authorities, communications requirements, recovery priorities, and alternate ways of operating. Training - Preparing employees and leaders to recognize abnormal circumstances, verify consequential requests, understand their responsibilities, and operate effectively under uncertainty. Tabletop Exercises - Giving leadership teams opportunities to confront realistic cyber and AI-enabled scenarios, practice decisions, identify weaknesses, and improve coordination before consequences are real. Response - Establishing practiced authorities, trusted communications, containment procedures, continuity actions, and recovery priorities that allow the organization to act decisively when normal operations are disrupted. The keynote does not argue that organizations should spend less on cybersecurity. Quite the opposite: strong cybersecurity protection remains indispensable. The challenge is ensuring that investments in protection are matched by investments in the human and organizational capabilities required when prevention is not enough. The presentation ultimately asks executives to reconsider how they define cybersecurity readiness. Protection reduces the likelihood and impact of disruption. Preparedness determines what the organization does when disruption occurs. Resilience is the demonstrated ability to keep operating through it. The message for leaders is straightforward: Buy protection. Build preparedness. Demonstrate resilience. Because in an AI-enabled threat environment, organizations may not be able to out-advance every threat. But they can out-prepare it.