Resiliency
Can we detect, contain and recover, and does it hold under repeat? Continuity plans age badly. IO measures whether the organisation can still do the thing the plan says it can do.
Where the boundary sits.
Resiliency owns time to detect, contain and recover. Whether the detection exists in the first place belongs to Threat Detection.
The signals read, and the work prescribed against them.
The summary of each is on the surface. Open one for the specific dimensions behind it.
SignalsWhat IO reads for this domain4 signal and evidence families, correlated deterministically rather than inferred.
- Exercise and tabletop outcomes
- Incident timelines and recovery records
- Dependency and third-party mapping
- Backup and failover verification events
PlaybooksWhat IO prescribes3 representative playbooks, each gated on prerequisites and maturity.
- Prove recovery with a restore test on the critical assets
- Drill and tighten the containment runbook
- Fix the root cause behind the repeating incidents
SeatsWho lands here first3 seats read this domain before anyone else does.
- Security operations
- COO
- CIO
What has to move for this to have worked.
Time to restore the named process in exercise
Share of critical processes with a tested path
Gap count carried from the previous exercise
Sessions that feed this domain.
We deliver these as part of IO Enablement Services.
SOCOM
Special-operations planning applied to enterprise programmes: prerequisites, gating, rehearsal, and after-action review that changes the next plan.
Crisis Leadership
Executive decision-making under incomplete information, run as an exercise with a recorded after-action that feeds the plan.
Adversary
Model the adversary against your actual estate, then convert the model into gated playbooks with prerequisites named.
Observed behaviour, reported culture and completed learning held as one position, and re-measured on the behaviour, not the completion record.
Detections that arrive from tooling rather than a colleague's message, and where the identity pressure is actually landing.
Which AI tools are really in use, what data reaches them, and whether the written guardrails are the ones in force.
See it before you talk to anyone.
Two quarters of recorded activity across sixteen seats. One click, no install.