Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
September 28, 2026
Originally published in ACTIO E-Magazine Edition 30 (September 2026). Law as of September 2026.
Expert: Edwin Djakaria, S.E., M.Sc., Director, Stevland Bridge
Organisations invest heavily in cybersecurity technology, but resilience is not the responsibility of IT alone. Cyber resilience is the ability to anticipate, withstand, recover from, and adapt to attacks on cyber-enabled systems, and it is strengthened by the daily actions of everyone who uses, manages, and leads the organisation.
Organisations invest heavily in cybersecurity technology, and beyond cybersecurity they aim for cyber resilience. Cyber resilience is not the responsibility of IT alone. Every employee, at every level of the organisation, has a role to play, and that role must be proactive, not merely reactive. IT may build the systems and controls, but resilience is strengthened by the daily actions and decisions of everyone who uses, manages, and leads the organisation.
The harder question is therefore not only whether an organisation has strong cybersecurity technology, but how people behave when cyber risk becomes part of their everyday work. An employee can report a suspicious email or ignore it. A manager can address repeated non-compliance or tolerate it. A senior leader can challenge a critical control being bypassed or accept it because “the business needs to move quickly”. Each decision sends a message about what the organisation truly values.
For an entry-level employee, being proactive may mean questioning a suspicious email, refusing to share credentials, reporting unusual activity immediately, or asking when a process appears unsafe. For a middle manager, it means reinforcing security practices, addressing non-compliance, encouraging employees to speak up, and escalating risks rather than assuming someone else will handle them. For top management, it means setting clear expectations, allocating resources, following the same controls themselves, asking difficult questions about cyber risks, and holding leaders accountable.
These actions may look different at each level, but together they form the organisation’s human line of defence. When these decisions are repeated across an organisation, they become more than individual behaviours: they shape organisational culture. Culture is reflected in what people consider normal, what they feel safe to say, what leaders choose to tolerate, and which behaviours the organisation rewards or challenges.
Policies, technology, and training can establish expectations, but culture determines how those expectations are translated into behaviour. This is why organisational culture is at the heart of cyber resilience.
In May 2023, Bank Syariah Indonesia (BSI) experienced a major cyber incident that disrupted its banking services. Customers reported difficulties accessing services, including ATM transactions and mobile banking, while the bank worked to restore its systems. The incident attracted significant public attention, and the Financial Services Authority (OJK) coordinated with BSI and requested an accelerated forensic audit. BSI subsequently strengthened its cybersecurity, data protection, and risk-management capabilities.
The incident is often viewed through a technical lens: how did the attack happen, how quickly could systems be restored, and what security controls were in place? These questions are important, but they tell only part of the story.
A cyber incident is also a test of organisational culture. How do employees respond to risk? Do managers reinforce critical controls? Do people feel safe reporting mistakes? Are leaders willing to confront unsafe behaviour? These cultural conditions influence how effectively an organisation can respond when its systems are under pressure. The BSI case therefore offers a broader leadership lesson: cyber resilience becomes sustainable when risk awareness is embedded in organisational culture, when speaking up, following critical controls, challenging unsafe behaviour, and taking accountability become normal ways of working.
A resilient culture is not one where nobody makes mistakes. It is one where people are willing to identify, report, and learn from risks and mistakes. The real test comes when rules compete with urgency, hierarchy, or convenience. A blame culture teaches people to hide problems. A learning culture encourages people to report problems early and improve.
Managers may see risky behaviour but avoid addressing it because they do not want to create tension. Employees may hesitate to challenge superiors, while leaders may be reluctant to confront high performers. But every time risky behaviour is ignored, the organisation receives a message: what leaders tolerate becomes part of the culture. Feedback is therefore not punishment. It is organisational risk control. A resilient culture allows people to say, “I think something is wrong”, “I made a mistake”, or “I see a potential risk”. Psychological safety makes this possible; accountability makes it meaningful.
Culture is also shaped by what organisations reward and penalise. Employees who report risks, challenge unsafe practices, and follow critical controls should be recognised. At the same time, leadership must distinguish between honest mistakes, negligence, and intentional violations. Honest mistakes should create learning; negligence should create accountability; intentional violations should have consequences. No blame for honest reporting. Clear accountability for irresponsible behaviour.
Culture cannot be delegated entirely to HR or IT. IT can build controls, Risk and Compliance can establish policies, and HR can support behavioural change. But top leadership determines whether these mechanisms become everyday organisational behaviour. When leaders follow procedures, accept difficult feedback, and recognise responsible behaviour, they demonstrate what the organisation truly values. Every leadership decision is a cultural signal.
What is cyber resilience?
The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.
Is cyber resilience only an IT responsibility?
No. IT may build the systems and controls, but resilience is strengthened by the daily actions and decisions of everyone who uses, manages, and leads the organisation.
What is the difference between a blame culture and a learning culture?
A blame culture teaches people to hide problems. A learning culture encourages people to report problems early and improve. A resilient culture is one where people are willing to identify, report, and learn from risks and mistakes.
How should organisations treat mistakes?
Honest mistakes should create learning; negligence should create accountability; intentional violations should have consequences. There should be no blame for honest reporting.
What was the lesson of the Bank Syariah Indonesia incident?
Beyond the technical questions, the May 2023 incident showed that cyber resilience becomes sustainable when risk awareness is embedded in organisational culture: speaking up, following critical controls, challenging unsafe behaviour, and taking accountability as normal ways of working.
The ultimate question is not simply, “How strong is our cybersecurity?” It is: “How will our people behave when our cybersecurity is tested?” Technology protects systems. Culture determines how people protect the organisation.
