Deloitte Sri Lanka convened a gathering of board directors and business executives for a forum titled “Cyber Resilience Starts at the Top: The Board’s Strategic Role in Building a Resilient Organization.” The event focused on enhancing organizational preparedness against complex cyber disruptions. Topics discussed included organizational resilience, cyber readiness, risk quantification, and crisis management, featuring an engaging cyber wargaming exercise that simulated real-world incidents to help leaders evaluate their decision-making capabilities and readiness prior to a crisis.
Malinda Boyagoda, Partner in Audit and Assurance and Industry Leader for Financial Services at Deloitte Sri Lanka and Maldives, opened the session by situating cyber resilience within the broader landscape of disruption. He addressed various risks stemming from geopolitical instability, cyber threats, AI-driven fraud, weaknesses in supply chains, and increasing regulatory demands.
Malinda differentiated between risk management and resilience, explaining that while the former aims to minimize exposure, the latter focuses on maintaining essential services and ensuring effective recovery during disruptions. He articulated, “Cyber resilience extends beyond merely preventing interruptions. It involves ensuring that critical services remain operational, allowing for confident decision-making, and fostering recovery and learning post-disruption.” Board members were encouraged to define their responsibilities clearly, test extreme scenarios, and seek tangible evidence of preparedness rather than merely accepting reassurances.
Submit Your Press Release
Get your company news, announcements, launches, appointments and events in front of a wider audience.
Expanding on this theme, Mayuran Palanisamy, Partner and Leader in Digital Trust and Privacy at Deloitte South Asia, discussed the distinction between superficial confidence and authentic readiness. He emphasized that board members should critically assess the organization’s cyber preparedness, including the assurances provided by management. By demanding evidence that response and recovery strategies function effectively in practice, boards can ensure that the organization is truly equipped to handle a cyber incident.
Mayuran underscored the necessity for leadership to play a proactive role in enhancing cyber readiness, stating, “Cyber resilience requires boards to move past mere oversight and engage actively in execution. This entails asking management pertinent questions regarding the cyber strategy, ensuring funding flexibility in the face of emerging risks, and routinely including cyber oversight in board discussions.”
The conversation then transitioned to the financial ramifications of cyber risk. Rukshan Bharatha, Partner in Controls Assurance at Deloitte Sri Lanka and Maldives, introduced Cyber Risk Quantification (CRQ) as a methodology for translating technical cyber threats into financial implications relevant for board and executive decision-making. Instead of relying solely on qualitative ratings such as high, medium, or low, CRQ allows organizations to comprehend the monetary impact of potential cyber events.
Rukshan articulated, “To truly grasp cyber risk, we must quantify it. Cyber Risk Quantification transforms qualitative assessments into financial figures, providing boards with a clearer understanding of potential impacts and a solid foundation for decisions regarding investments and acceptable risk levels.” He elaborated on how assessing business exposure, incident scenarios, and existing security measures can be integrated with statistical modeling to estimate potential losses, aiding decisions on cyber investments, regulatory compliance, and insurance needs.
The final segment, led by Bhawna Pahuja, Associate Director in Cyber Defense & Resilience at Deloitte India, brought the previous discussions to life through an interactive cyber crisis scenario. Participants were immersed in a hypothetical financial institution confronted with a worsening cyber incident and tasked with making urgent decisions regarding containment, business continuity, communication strategies, regulatory engagement, and ransom negotiation.
This exercise was designed to mimic the uncertainty and pressure that leadership teams encounter during actual cyber incidents, requiring participants to make choices based on limited information as circumstances evolved. It illustrated how swiftly a cyber issue can escalate into a full-blown organizational crisis, impacting customers, regulators, investors, reputation, and operations. The session emphasized the necessity of clearly defined crisis roles, tested recovery strategies, and leadership teams capable of making informed decisions under duress.
Collectively, the sessions underscored that cyber resilience is a shared organizational responsibility, bolstered by informed board participation, precise risk assessments, validated response plans, and decisive leadership. In reflecting on the overarching message, Vengadasalam Balagobi, Cyber and Technology Risk Head and Information Security Leader at Deloitte Sri Lanka and Maldives, remarked, “Cybersecurity focuses on safeguarding the organization, while cyber resilience ensures it can continue to function, recover, and adapt amidst disruptions. Organizations that proactively prepare, test, and learn prior to incidents are better equipped to respond swiftly, confidently, and clearly.”
