Cyberattacks strike without warning. Most organisations aren’t as ready as they claim and the consequences are mounting.
Peter Lee, CEO at Simspace talks through ‘readiness’ that can be declared without being tested.
“Confidence without evidence is just hope.” Said Lee.
Companies love to talk about resilience, but hope really is not a strategy. Boardrooms are filled with assurances. Certifications are waved around like proof of strength. But Mr. Lee isn’t buying it, proof really is in the pudding.
“Readiness really only matters if it holds up under significant adversarial pressure.” Lee Added.
Real readiness, he argues, isn’t whimsical, it’s battle tested. If your defences haven’t been pushed to the breaking point in real world conditions, you’re not really secure, you’re guessing – but blindfolded.
Organisations are pouring millions into cybersecurity. Multi layered defences, advanced tooling and compliance frameworks, so on paper, it looks impressive. Attackers aren’t playing by the same game and rules unfortunately.
“We believe that the confidence that really comes from seeing performance under pressure is really going to be built from joint training and having humans and AI being held to the same standard.” Lee went on to say. “That’s really what we see as kind of the next evolution… of where security investment is being directed.”
Cyber threats are no longer isolated incidents. They’re constant, spiralling out of control and relentless. And many companies are stuck treating security like a checklist instead of a live fire exercise.
The main problem is the growing gap between perceived readiness and reality.
Lee, drawing on experience from US cyber operations, reflects on past experiences.
In military environments, there’s no room for ambiguity, you either succeed under pressure, or you simply fail. Every mission is rehearsed. Every weakness is exposed before it matters. Corporate cybersecurity? Not so much, alas.
Instead, many organisations avoid stress testing their systems at full intensity, leaving vulnerabilities hidden until it’s way too late.
As we know, AI becomes embedded in both attack and defence, the rules are changing. It’s no longer just about human teams, it’s about how humans and AI perform together under extreme pressure. And right now, most organisations aren’t training for that reality.
Lee warns that certifications and isolated skills training create a false sense of security. They set a minimum bar, not a real standard.
“We’re seeing that humans plus AI has to be the rallying cry.” Lee went on to say. “And that means organisations need to invest in the team training, in the tooling, in the testing, in a real -world production grade environment like a ‘Cyber Range’ in order to best prepare.”
Because when an attack hits, it’s not about individual credentials. It’s about how the entire system people, processes and machines, performs in real time.
You don’t get to claim cyber readiness. You have to prove it.
The organisations that are willing to test, fail, adapt and rehearse relentlessly will survive.
