Accidents and Incidents Will Happen: What Road Safety Can Teach Us About Cyber Resilience
For more than a century, society has invested enormous effort into making road travel safer. Driver training was introduced to improve competence. Driving tests were introduced to validate capability. Laws were established to create consistency. Regulation was introduced. Seat belts, airbags, anti-lock braking systems and countless other engineering advancements were developed to reduce the likelihood and severity of harm.
Roads became safer. Vehicles became safer. Drivers became better educated. Yet despite all these improvements, accidents still happen every day. No reasonable person concludes that road safety has failed simply because accidents (malicious or accidental) still occur.
Instead, we recognise that the objective of road safety is not to eliminate risk entirely, but to reduce risk to an acceptable level and improve our ability to prevent, respond to and recover from accidents when they occur.
This simple observation offers one of the most useful ways to think about cyber resilience.
Many organisations still approach cyber security as though the ultimate objective is the complete prevention of incidents. Conversations often focus on technologies, controls and technical safeguards designed to stop attacks from happening. While these controls are important and necessary, they are the cyber equivalent of seat belts, speed limits and driving lessons. They reduce risk, improve outcomes and help prevent harm, but they do not remove risk altogether. Just as no amount of driver training can guarantee that a vehicle collision will never occur, no amount of cybersecurity investment can guarantee that a cyber incident will never happen.
The challenge is that many Boards and senior leaders continue to evaluate cyber security through a prevention lens. There is no criticism here, we are dealing with decades of computing history and a rapid evolution of how organisations operate, influenced now of course by AI evolution. Success is often measured by the absence of incidents rather than the organisation's ability to withstand and recover from them.
Yet in every other area of organisational risk management, leaders understand that resilience matters. Businesses develop continuity plans because disruptions may occur. Organisations buy insurance because losses are possible. Emergency procedures exist because adverse events happen.
Cyber resilience deserves to be viewed in the same way.
This is where the National Cyber Security Centre's Cyber Assessment Framework (CAF) provides an important shift in thinking. The CAF was not designed to guarantee that incidents never occur. It was developed to help organisations understand whether cyber risks affecting critical services are being managed appropriately and whether those services can continue to operate when faced with disruption.
Viewed through the lens of road safety, the logic behind the NCSC CAF becomes remarkably clear. Before anyone takes a vehicle on the road, a significant amount of governance, planning and risk management has already taken place. Roads are designed. Traffic laws are established. Driver training is completed. Vehicles are tested. Responsibilities are assigned, etc... It is something we all familiar with.
Similarly, the CAF begins with governance, risk management, asset management and supply chain security. The framework recognises that resilience starts long before an incident occurs. Organisations need to understand their critical services, identify their dependencies and establish clear accountability for resilience outcomes. Good governance does not eliminate risk, but it dramatically improves an organisation's ability to manage it.
The same principle applies to protective controls. Modern vehicles contain numerous safety features designed to reduce the likelihood and severity of accidents. Organisations implement cyber controls for exactly the same reason. The goal is not perfection. The goal is proportionality. Effective controls reduce exposure, increase resilience and improve outcomes. Yet no transport authority would ever claim that airbags eliminate crashes, just as no cyber professional should claim that technical controls eliminate cyber incidents.
Detection provides another useful comparison. Modern vehicles contain warning indicators and sensors because drivers need visibility of emerging problems before they become serious failures. Organisations require similar visibility into their technology environments. The earlier a cyber issue is identified, the more opportunities exist to contain it and prevent wider disruption. This is why monitoring and detection play such a significant role within the CAF.
The framework acknowledges an uncomfortable but important reality: organisations cannot respond effectively to incidents they cannot see.
Perhaps the most powerful part of the analogy relates to recovery. Society does not stop planning once an accident occurs. Emergency services respond. Recovery operations begin. Lessons are learned. Improvements are made. Recovery is not considered evidence that safety measures failed. It is simply recognised as a necessary component of a resilient system.
The CAF adopts exactly the same perspective. Response and recovery capabilities are treated as essential outcomes because disruption is always a possibility. Resilience is demonstrated not by preventing every incident, but by maintaining critical services and recovering effectively when adverse events occur.
This way of thinking is particularly valuable for Boards and Executive teams. Too often, cyber incidents are viewed as proof that something has gone wrong. In reality, the existence of an incident does not necessarily indicate governance failure. A vehicle collision does not automatically mean that road safety systems failed. What matters is whether risks were understood, whether appropriate safeguards were in place, whether responsibilities were clear and whether the response was effective. The same principle applies to cyber resilience. Effective governance is measured by preparedness, oversight, resilience and continual improvement, not by the impossible expectation that incidents will never occur.
One of the reasons the road safety analogy is so helpful is that it makes the CAF easier for non-technical stakeholders to understand. Many people initially perceive the framework as another cybersecurity model. In reality, it is a resilience framework that happens to operate within a cyber context. When leaders understand CAF through the familiar concepts of risk management, safety, preparedness, monitoring and recovery, adoption often becomes easier. Discussions move away from technology and towards business outcomes. The conversation shifts from compliance to assurance, from prevention to resilience and from technical controls to governance.
This is increasingly important because regulators, customers, investors and stakeholders are becoming far more interested in resilience than perfection. They understand that incidents can occur. What they want confidence in is an organisation's ability to manage those incidents effectively. Digital trust is rapidly becoming a discreet business discipline.
Can critical services continue operating? Can the organisation recover quickly? Can leadership demonstrate oversight and due diligence? Can lessons be learned and improvements made? These are the questions at the heart of the CAF, and they are remarkably similar to the questions society has been asking about road safety for generations.
Ultimately, society has never sought to create a world without vehicle accidents. Instead, it has built systems that combine governance, regulation, education, engineering, monitoring and recovery to make transport safer and more resilient.
The outcome is not perfection. The outcome is confidence.
Cyber resilience should be viewed in exactly the same way. Incidents will happen. The objective is not to eliminate risk entirely but to ensure organisations are prepared to withstand disruption, protect critical services and recover effectively when challenges arise.
That is the essence of resilience, and it is precisely the mindset embedded within the National Cyber Security Centre's Cyber Assessment Framework.
ENDS//
Comments