Perspective Chapter: Organizational Resilience toward Managing Risks in Digital Marketing

Abstract

Organizational resilience is the ability of an organization to adapt and recover quickly in the face of disruptions and changes, thus ensuring operational continuity and maintaining high performance. The research investigates the evolving landscape of digital marketing, where organizations encounter dynamic risks due to emerging trends and technologies. After an extensive literature review, the authors identified four emerging risks induced by the new technologies that have to be dealt with by marketers in order to preserve business continuity and ensure organizational resilience: the data privacy and compliance issues, the cybersecurity threats, the reputation management and social media risks, and the ethical considerations in digital marketing. For those challenges, the authors suggest possible strategies to be put in practice to achieve organizational resilience, most of them based on new technologies such as, for example, blockchain and artificial intelligence.

1. Introduction

In a dynamic environment where new trends and technologies emerge every day, we face new risks that continually redefine the boundaries of marketing strategy. This approach also considers performance management and business continuity assurance, in addition to other important elements of organizational resilience. Business Continuity Management (BCM) focuses on an organization’s ability to maintain critical operations in a functional state in the event of a major disruption or crisis. This includes planning and implementing preventive and reactive measures to minimize the impact and return to normality as quickly as possible. Organizational resilience, on the other hand, goes beyond the boundaries of BCM and addresses broader issues. We focus not only on navigating disruption but also on adaptability and the ability to learn and grow in the face of constant change in the business environment. The resilient organization will not cease its activity in case of crisis; it will function at lower levels of operability, aiming for at least a minimum acceptable level; what is important is that it will continue business processes.

Organizational resilience places more emphasis on anticipating and preparing for future changes and addresses issues such as innovation, flexibility, and agility. It is an interdisciplinary approach that brings together a variety of disciplines, from systems management and cybernetics to human resources management, risk assessment, economic analysis, and administrative law analysis. It promotes a focus on building a culture of resilience within your organization, employing a proactive approach that goes beyond mere response and recovery aspects.

Additionally, organizational resilience considers an organization’s influence and impact on the environment more comprehensively, taking into account social, economic, and cultural aspects. We recognize the importance of strong relationships with stakeholders and the role of effective collaboration and communication.

Organizational resilience is an organization’s ability to quickly adapt and recover in the face of disruption or change, ensure business continuity, and maintain high performance. Risk management is a crucial aspect of resilience in organizations, as it involves the identification and evaluation of risks. But what are these threats today? Businesses are facing a Volatile Uncertain Complex and Ambiguous (VUCA) environment such as the era of Industry 4.0—the dominance of AI, social media, and widespread automation.

2. Theoretical overview

The present research methodology followed ISO 31000 stages: establishing the context, risk assessment, and risk treatment. Therefore, it started with an in-depth literature review to assess the state of the art in the digital marketing environment. Google Scholar, Scopus, and Web of Science databases were canvassed using as keywords “digital marketing” associated with “risks,” “trends,” or “new technologies.” Following this, we identified the major trends and the tools/technologies used to increase the impact of marketing campaigns. Once the tools and trends were identified, the challenges of new technologies could be more easily outlined. Furthermore, expert elicitation was used to retrieve the best solutions to overcome the obstacles that could prevent a company’s success or mitigate the damage that may occur in case of incident.

The main objective of the research is to provide possible solutions to be put in place by managers interested in building organizational resilience to be able to preserve business continuity at a high level of quality.

Globalization has added layers of complexity to digital marketing, necessitating a sophisticated understanding of diverse markets, cross-cultural nuances, and varied regulatory environments. Digital marketing is that branch of marketing that uses “digital technologies, especially through Web, cell phones, visual advertising as well as any electronic media” [1]. Businesses turn to cloud or at least try embedding more and more features related to internet of things (IoT), not only in terms of marketing strategy but also by integrating innovative elements [2].

In theory, the risks that may occur and prevent businesses from being successful are divided into six categories:

• Hazard risks

• Technological risks

• Physical security risks

• Cyber risks

• Sociopolitical risks

• Financial risks.

The present literature review emphasized that not all those categories are applicable in the case of digital marketing.

New technologies have changed the news gathering and distribution methods. These technologies altered the flow of information; replaced the centralized, top-down model; and created ad hoc distributive information networks. Inconsistency happens when the event is evolving, but the information is not updated regularly [3].

Social media is a new source of information to improve situational awareness [4], but it is more than that. Many people use social media as their only source of information; therefore, they are easy and vulnerable targets of malicious attacks or disinformation. Even if the primary goal of social media platforms was not promoting brands, nowadays almost all companies use social media as communication platform as the embedded algorithms used by organizations enable the targeting of potential customers in a better and easier way, and with lower costs.

Cloud computing has emerged as a mature technology and has the potential to revolutionize the information and communication landscape. Moreover, cloud computing allows the development of reliable, agile, and incrementally deployable and scalable systems at low cost and access to large, shared resources on demand, leading to paradigms such as Software-as-a-Service or Infrastructure-as-a-Service.

IoT provides new types of services to improve daily life. The IoT-based sensors provide efficient monitoring of various processes. The IoT-generated sensor data has the following characteristics: real-time, large amounts, and unstructured [5]. IoT technology can play a critical role in developing effective monitoring infrastructure and information sharing in crisis management.

The authors identified four emerging risks induced by the new technologies that have to be dealt by marketers in order to preserve business continuity and assure organizational resilience:

• The data privacy and compliance issues

• The cybersecurity threats

• The reputation management and social media risks

• The ethical considerations in digital marketing

2.1 Data privacy and compliance

Globalization has added layers of complexity to digital marketing, necessitating a sophisticated understanding of diverse markets, cross-cultural nuances, and varied regulatory environments. Businesses are no longer confined to localized spheres; they are integral components of a global network of suppliers, partners, and customers. Navigating the challenges posed by globalization requires a strategic approach that acknowledges the interconnectedness of markets. As all businesses strive for personalized campaigns; collecting and leveraging consumer data is essential for better digital marketing campaigns. However, handling this data improperly poses significant risks.

California’s Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR) are two examples of regulations regarding consumer privacy in recent times. Both laws are focused on user privacy rights and putting control over personal data back into users’ hands. While GDPR applies for business that hold personal data of EU/EEA residents, CCPA applies for profit-business that hold personal information of California residents and meet one of the following criteria: [6]

• Earns at least 24 million $ in gross annual revenue.

• Buys, sells, or receives personal information about at least 50,000 California consumers, householders, or devices for commercial purposes, or

• Derives >50% of its revenue from the sale of personal information.

Violating data protection regulations can have serious consequences. This includes hefty fines, lawsuits, and reputational damage. For example, the fines in CCPAs case can reach up to 2500$ for each violation and 7500$ for each intentional violation. For GDPR, the fines can reach 2% of annual turnover, for less severe violations, and up to 20 million Euro or 4% of annual turnover, whichever is highest, for severe violations [7]. The privacy of customer data has even become a geopolitical issue, with EU legislative projects such as the Digital Markets Act and the Digital Services Act introducing additional protections for the data of EU individuals and entities (under the heading of data sovereignty) that American companies such as Google and Meta have complained constitute a targeted limitation of the access to information on which they build their advertising business today and their AI business tomorrow [8].

Business continuity is at risk when customer trust is compromised due to perceived misuse of confidential information. The actual loss of that data can lead to direct financial losses, market reactions (loss of market value and goodwill), and the effects of uncertainty on economic prospects.

Mitigation strategies include implementing robust data protection measures, regularly updating privacy policies, and conducting comprehensive audits to ensure compliance. Companies must educate employees about privacy practices and use encryption technology to protect customer information.

Establishing clear and transparent communication channels with customers regarding data usage and privacy policies can help build trust and reduce the potential impact of noncompliance.

Furthermore, for better data protection, we consider that companies should use blockchain technology applications. Blockchain is a new technology with applications in many economic, administrative, and governance fields. It offers the possibility of carrying out transactions or database changes without an intermediary and under increased security, revolutionizing the models of organizing and providing mass services. At its simplest level, blockchain is a distributed database among many participants of the respective network, which uses specific, continuously developing algorithms to validate and distribute changes to the database automatically, without a central authority. Thus, a new industrial revolution is taking shape based on solving an important problem in the organization of human activities, that of trust and control. Blockchain’s applicability is much wider than the current media fixation on cryptocurrencies such as Bitcoin and other instruments of financial speculation would suggest. We are witnessing the rapid development of a new business sector developing applications for “smart contracts,” supply chain management, facilitating financial transactions, and more.

Smart contracts could be the best solution in order to protect sensitive data of clients or customers. A smart contract is a software program that stores policies and rules for negotiating terms and actions between parties. The smart contract concept was introduced by Nick Szabo in 1994 where the computerized transaction protocol executes the terms of a contract [9] intending to reduce costs and delays of traditional contracts and satisfy common contractual conditions. The smart contract includes first the functions that receive input parameters of the contract and get invoked when the transactions are made. The second is the state variable that is dependent on the logic developed in the functions. Smart contracts in blockchains enable creating a self-governing partnership with enforceable rules of interactions without the need for a central authority [10].

A medium- and long-term challenge to data privacy and compliance is represented by the advances in quantum computing, which promise to render most current forms of encryption obsolete. Companies have been developing post-quantum strategies for data protection involving air-gapping databases, investing in stronger encryption protocols given the relatively slow advance of quantum hardware, adopting quantum-safe encryption methods developed by entities such as the National Institute of Standards and Technology in the US, and waiting for quantum-secure products and devices to become available.

2.2 Cybersecurity threats

The increasing digitalization of marketing activities also exposes companies to cybersecurity threats.

Information security involves ensuring the confidentiality, integrity, and availability of data and information during storage, processing, or transfer, with the help of the procedures implemented in the organization and the technologies used.

The main categories of IT threats that an organization may face are mentioned below:

• Malware—“Malicious” software that requires the installation of a program that can track activity on a specific device. This type of attack is carried out by means of e-mails in which the provision of data is requested, or even those that encourage access to certain sites through the links sent in the e-mail. These links can also be shared via social networks (Facebook and WhatsApp).

• Ransomware—A category of malware that blocks access to the computer until a ransom is paid, or individual files are encrypted, and then, a sum of money is requested to be paid within a few days to recover data or access to the respective data. As with malware, ransomware attacks are most often carried out via email or social media. Thus, advertisements that promise certain free goods or services, for example, downloading books or movies for free, after having previously installed a certain software program, are likely to attack a computer system. Or sites that ask you to go to another link to get access to the information you are looking for with the help of search engines are also a cyber hazard.

• Phishing—The term comes from the English language, from the verb fishing (to fish); more precisely, the attackers use a bait by which they convince the users of certain social networks or the customers of certain online service providers to disclose personal information, such as the password of banking applications, passwords to certain accounts, and so forth.

• A variant of phishing is smishing; that is, the attack is initiated via SMS, and then continues similarly to other types of attacks—the victim is encouraged to access a link and divulge certain information.

To address these risks, companies must invest in advanced cybersecurity measures. There is a wide awareness of firewalls, intrusion detection systems, and encryption protocols. Regular penetration testing helps identify vulnerabilities, allowing businesses to address them before they can be exploited by malicious attackers. Unfortunately, the insider threat is equally relevant, if not more dangerous. Human error is often a key factor in security breaches, so it is very important to train the employees in cybersecurity best practices, as it is less costly to prevent than to treat. Additionally, companies could transfer this type of risk toward a third party—a company specialized in cybersecurity. A robust incident response plan ensures a quick and effective response to cyber threats, minimizing the impact on business operations. However, in our opinion, these strategies alone are not enough. Therefore, we suggest innovation in cybersecurity systems of companies. Innovation in cybersecurity is a complex process which includes, among others:

• Financial issues

• The rate of development for new technologies, new products, and new services

• Advances in information sharing

• The advances in cybersecurity culture, strategic culture, and education

• The resilience by design of our future infrastructures

• Education that prioritizes lifelong training, competence certification, and retention

An example of innovation in cybersecurity is the use of AI and machine learning in cybersecurity processes. Promises of artificial intelligence in cybersecurity are many and mainly related to risk identification systems. While automation provides detection of any wrongdoings, it can also safeguard the attack targets. Deep learning is being used to track logs, transactions, and real-time data to discover threats in the network. The ability of unsupervised machine learning is to find all kinds of unknown patterns and detect anomalies. It can “learn” to spot patterns and signal a potential attempt of attack. Innovative technologies like this are getting better every day while providing valuable insights on steps that can be taken to avoid issues caused by sophisticated attacker methods. The advantages of AI technologies in cybersecurity defense mechanisms have been very useful in ensuring the accuracy and speed of detection of cybersecurity threats alongside mitigation, thereby improving the security orchestration, automation, and response system of the security operations center.

Johnson and Gheorghe [11] added two new concepts to resilience theory, based on Nassim Taleb’s research in finance:

• Fragility—A fragile system is susceptible to all manners of external stressors, leading to damage in the system and problems with other attributes of resilience such as adaptability, redundancy, and substitutability. Therefore, fragility is an endogenous quality of the system, contrasting with vulnerability, which is an exogenous quality related to a particular threat.

• Antifragility—It is another endogenous system quality. The antifragile system becomes stronger through repeated exposure to various stressors that trigger reactions that improve system resilience overall. In this way, the presence of system threats that causes disruptions and damage, but at a much lower level, fosters the capacity to successfully avoid a disaster or alleviate its impact. The total prevention of small stressors should therefore be viewed in a negative light, as dulling the incentives and signals that a system needs to invest in its resilience. Taleb and others have identified numerous instance in a wide range of fields, showing that antifragility, like resilience, has multidimensional applications. For instance, the frequent small forest fires that appear during the summer or are triggered as part of traditional forestry practices prevent the accumulation of dead plant matter that can lead to a hugely destructive fire; on the other hand, regulations limiting these practices from a misguided sense of conservation actually produce larger and more destructive fires down the line, as we have seen in California. The concept is also featured in banking, where a steady supply of bankruptcies and stressful events placing pressure on poorly run or overexposed banks fosters attention from regulators, investors, and creditors that increase overall resilience, through capital requirements, early elimination of risky practices, and better information on risk. On the other hand, a too forgiving system, especially one with a “too big to fail” mentality, fosters moral hazard and permits the accumulation of systemic risk, as seen in the 2008 global financial crisis and the 2011 sovereign debt crisis.

Organizations are exposed to many of the same issue at a micro level, and their resilience changes over time in reaction to stressors, incentives, and impulses coming from their environment and their leadership team. Organizations that have experienced small-scale cyberattacks have received early and less costly wake-up calls that they need to invest in cybersecurity and turn their handling of these threats into a comparative advantage in a crowded market. State regulation may also create a level playing field by imposing minimum cybersecurity preparedness obligations on all actors, thereby removing the incentive to underinvest in order to increase profits or decrease operational costs at the expense of future vulnerability.

2.3 Reputation management and social media

There are several examples of risks that may occur under this category. Almost all of them require a certain level of trust between companies and stakeholders—in this case the stakeholders being the customers, not the shareholders. There are mentioned only few threats:

• Ad fraud is a pervasive risk in digital marketing, more and more encountered nowadays, as generative AI can impersonate famous and trustworthy people

• Negative reviews, social media backlash, or viral controversies can swiftly damage a brand’s reputation, impacting customer trust and loyalty

• Technology and platform dependency

• Ineffective content strategy or lack of talent on the part of advertisers

Mitigating ad fraud involves using advanced analytics and ad verification tools to detect and prevent fraudulent activities. Businesses should work with reputable advertising platforms and continuously monitor and analyze campaign performance. Staying informed about the latest ad fraud trends and industry best practices allows marketers to adjust their strategies and adopt preventive measures.

As far as the risk of brand reputation damage is concerned, the implemented strategy requires a proactive approach. Companies should monitor online channels for brand mentions, customer feedback, and emerging trends. A well-elaborated contingency plan is essential for addressing issues swiftly and minimizing reputational damage at the same time as investing in a positive online presence through genuine engagement. Corporate Social Responsibility (CSR) campaigns are also potential contributors. Engaging in socially responsible marketing, supporting ethical causes, and avoiding campaigns that exploit sensitive issues are essential for maintaining a positive brand image.

Nevertheless, new technologies such AI—used as an early warning system—could help in detecting, from the early stages, suspicious activities/advertisements. First, AI will lead to an increase in the ability to process data to yield actionable information for decision makers. For example, bank accounts with suspicious activity could be identified for further investigation, or suspicious patterns of activity in complex systems would be identified to prevent long-term infiltration by criminal actors. This is very important given that according to Coburn et al. [12], “the average time from infiltration to discovery by a corporation has increased globally to 101 days.” Thus, AI will be widely used in security and decision support systems, precisely because it represents a step forward for the analysis of situations out of the ordinary, highly uncertain, and with varied parameters. Increasingly, software will be a large part of the added value and differentiation of tomorrow’s products, and this reality will also be felt in the field of cyber security. AI will become an active part of the real-time fight against cyber intrusions, at speeds that humans cannot track but can only analyze the event post-factum.

Furthermore, companies should diversify their marketing channels and strategies. This involves exploring multiple platforms and technologies to reach a broader audience. Staying informed about industry trends and adopting an agile approach to marketing allow businesses to adapt quickly to changes in platforms or technologies. Building a robust omnichannel marketing strategy ensures that the business is not overly dependent on any single channel, reducing the impact of disruptions. Regularly analyzing key performance indicators (KPIs) allows marketers to identify areas for improvement and adjust their content strategy accordingly.

Mitigating the risk of a skills gap involves investing in ongoing training and development for marketing teams. Businesses should prioritize hiring individuals with the necessary expertise and staying abreast of industry advancements. Collaborating with external agencies or consultants can supplement in-house skills and bring specialized knowledge to the team. Creating a culture of continuous learning and adaptability ensures that the marketing team remains well-equipped to navigate the ever-evolving landscape of digital marketing.

2.4 Ethical considerations in digital marketing

In 2023, Forbes stated: “Ethics in digital marketing refer to the moral principles guiding a company’s conduct online” [13]. Ethical concerns in digital marketing have become increasingly prominent as technology continues to evolve and marketers leverage sophisticated tools and strategies to reach their target audiences. Ethical considerations are crucial in maintaining trust with consumers, protecting user privacy, and ensuring responsible and transparent practices. Forbes considers that the main principles that accompany a trustworthy company are:

• honest advertising

• transparency in communication

• responsible data management

• respect for customer privacy

• fair competition and

• not making false promises

We all may agree upon the fact that digital marketing often involves the collection and utilization of user data for targeted advertising, yet the ethical concerns arise when businesses fail to obtain proper consent for data collection or when they misuse personal information. To address this, businesses should prioritize transparent data practices, obtain explicit consent from users, and comply with relevant data protection regulations.

At the same time, while personalized marketing can enhance user experience, that practice raises ethical questions when it becomes overly invasive or relies on deceptive tactics. In this case, there should exist a balance between personalization and respecting user boundaries. Being transparent about how personal data is used and providing users with control over their preferences can help mitigate ethical concerns related to targeting.

Furthermore, marketing practices that use the so-called influencers is a popular strategy, but ethical concerns arise when influencers fail to disclose paid partnerships or when they promote products without genuine experience or belief in them. On one hand, companies should prioritize transparency in influencer relationships, and at the same time, influencers should be transparent about their relationships with brands to maintain authenticity and trust.

There is a technological dimension here as well, since AI regulation has concerned itself with promoting “ethical and trustworthy AI” development. The High Level Commission on AI of the European Union made a series of recommendations regarding categories of AI applications divided by danger and therefore requiring more or less supervision and regulation. These applications run the gamut from minimal risk to unacceptable risk, and many marketing-oriented AI applications will slot into the limited or high-risk categories due to the potential of discrimination, bias, improper data usage, potential manipulation, lack of protection for vulnerable categories, and more. In this regard, there are both directives and other forms of legislation regulating AI in general terms and voluntary codes of behavior and standards that marketing departments can employ to avoid ethical, legal, and financial pitfalls.

3. Results and discussions

In order to remain competitive in a constantly changing economic environment, industrial organizations must be resilient, including through strategies to understand consumer behavior and how they make purchasing decisions, thus making it easier for them to meet the needs and consumer desires. Understanding customer behavior has been a topic of interest for both companies and researchers. Gaining more details about how customers feel, act, and choose from available options would help marketers improve their campaigns [14].

Digital technologies have introduced new channels for marketing communication, data-driven insights, and enhanced customer engagement. Online platforms, data analytics, and automation play pivotal roles in reshaping the marketing landscape. Marketers must adapt to this evolving paradigm, leveraging digital tools to enhance visibility, streamline processes, and engage with business customers in a manner aligned with contemporary expectations but at the same time pay attention to element like data privacy and social media in order to preserve a good reputation and gain costumers’ trust. In this digital environment, cybersecurity has become a priority in a rapidly shifting and complex security environment beset by hybrid threats. Investing in cybersecurity could ensure the owners that they have a resilient company that could preserve the business continuity in best-quality conditions.

Resilience is a term used very promiscuously in the current period, being applied in many fields, including psychology and ecology. We can interpret this fact not only as the success of the term in penetrating the public consciousness and that of the academic area, regardless of the sector, but also as the suitability of the concept for a wide number of fields in which the objects of analysis can be described as systems subject to risks, vulnerabilities, and threats that justify the use of the term to describe the endogenous quality of resisting the resulting crises.

Organizational resilience is an emerging term of art that encompasses a wide variety of issues and therefore requires a multidisciplinary approach. In this article, we approached the topic from the perspective of digital marketing. Figure 1 describes our conclusions.

Figure 1.

Summary of study conclusions.

Rather than considering digital marketing as a business process with potential business repercussions, our approach sees it is as a process with systemic impact, engaging with the resilient organization at multiple levels and impacting it in various ways. This approaches produces not only complexity but also a better description of the outcomes for a system stemming from the lack of resilience. A failure in the digital marketing space for a fragile, vulnerable organization can lead to legal repercussions, disruptions of operation, financial losses, as well as a destabilization of the entity in its relationship with clients, suppliers, competitors, and the state authorities. Failures in resilience related to digital marketing expose deep issues with the organization, from strategic and organizational levels, to those pertaining to the actual security of networks, systems, and the wider system-of-system such as a particular industry. Ultimately, even other entities can be affected through a cascading disruption, as, for instance, a hacker may use supply chain attacks to infiltrate the customers of the affected organization, compounding the damages, prolonging the crisis, or possibly achieving the real objective, such as infiltrating a particular entity (as in the Solar Winds attack). The interplay between information collection, access, processing, and disbursement inherent in digital marketing generates new risks, vulnerabilities, and threats that a resilient organization can mitigate or ameliorate.

4. Conclusion

Building organizational resilience is a must nowadays. Achieving it means prevention first. Therefore, a rigorous risk assessment could help managers more easily overcome crises and emergency situations.

Within the chapter, the authors highlighted four major sources that may induce vulnerabilities toward business continuity and the action that could be put in place in order to achieve resilience.

Usually, new technologies handle the risks and vulnerabilities induced by new technologies. For example:

• Fake news or deepfake advertisements could be identified by other AI algorithms built as monitoring systems on social media regarding posts that are related to a company’s name or activity.

• Theft of sensitive data as a consequence of cyberattacks could be prevented by using blockchain technology, namely, smart contracts when transmitting data.

• The risk of becoming uncompliant can also be mitigated by using new technologies for monitoring the updates of the relevant regulations.

Disturbances are inevitable, and the existence of internal factors of organizations such as technologies and human resources, as well as of external factors such as those of a political, legislative, and economic nature, can contribute to their challenge. When discussing resilience, the major concern is the vulnerability of an entity and the dimensions of its vulnerability.

We have built up an argument that an organizational resilience perspective on digital marketing goes beyond considerations of operational security and enters into areas of technology, ethics, incentive structures, regulatory issues, and their intersection with new business model. The evolving face of digital marketing, as seen in controversies surrounding the use of Big Data in the targeting of political ads on social media or in the use of predictive models in order to target potential client profiles, will generate new challenges ultimately affecting the resilience of an organization, as it exposes itself not just to legal liabilities or public opprobrium but also to targeted attacks across its value chain. Our model proposes six main tools to foster resilience. Some are obvious, such as cybersecurity and compliance management tools, others not so, especially the importance of security culture across the whole organization backed up by resilience-oriented human resources management, a critical infrastructure approach to key organizational assets, networks and other systems (usually preserved for actual critical infrastructures as defined by state authorities), and, last but not least, the pursuit of resilience communication and signaling in relation to customers, partners, the authorities, and other stakeholders. The stakes of digital marketing can be quite high, as many business models and product categories can encounter resilience-diminishing pathologies as they employ new technologies (AI, blockchain, and machine learning) to better match their product to the rapidly evolving market.

Lastly, for the way ahead, we identified six key pillars for a resilient approach in digital marketing that adequately manages the risks we have identified. Education and new digital solutions are obvious in light of the issues we have identified, but we advocate for the restructuring of organizations to favor resilience (the literature specifies placing security departments close to the corporate suites, cross-disciplinary teams, decentralized infrastructures and databases, etc.) backed by human resources management that emphasizes resilience (cross-training, proper cybersecurity hygiene, security knowledge as a factor in hiring, etc.). This enables the organization to turn its resilience into a competitive advantage in the market and move past the paradigm of security investments as sunk costs to be minimized rather than business-enhancing investments. Lastly, none of this can be achieved without a strategic planning element, both general, such as a cybersecurity strategy or a strategy for access management in complex business operations (where individuals and teams require access to multiple databases and other proprietary data, often on an ad-hoc basis), and specific, where we purposefully highlighted a post-quantum transition strategy since the mainstreaming of quantum cryptography will require new technologies and approaches for securing valuable data.

Further research should result in tools and methodologies that are adequately sized and tailored for enhancing resilience in small and medium organizations, given their resource and knowledge constraints.

Conflict of interest

The authors declare no conflict of interest.