In recent times we witnessed many organizations who are facing numerous cyber attacks hold confidential customer, employee and supplier personal data. Such data is attractive to attackers, as they can steal it and demand ransom payments to stop them revealing it out in public. There is a constant fear against threat actors looming and that actually demands organizations to be cyber resilient.
What is the way out to create a cyber resilience culture that are meaningful both for employees and leaders ?
The U.K. National Cyber Security Centre on Wednesday published six cybersecurity culture principles developed through extensive research with industry and government partners.
The principles define the cultural foundations essential for building a cyber-resilient organization and offer guidance on how to cultivate that environment.
The principles are based on many factors on what leads to weak or misaligned cultures leading to poor security outcomes so that organizations understand how outcomes have deeper cultural issues and require urgent attention.
Cyber attack on Retail sector
This was followed by multiple cyber-attacks on the retail sector have gathered media attention over the first half of 2025. This included breaches on Co-op, Harrods, Adidas, The North Face, and Cartier.
Notably, a long-term disruption for UK brand Marks and Spencer, whose online sales are still paused seven weeks after the initial attack, was caused by phishing on a third-party supplier.
Over the Easter weekend, customers in M&S stores were unable to make contactless payments, click and collect services were unavailable. M&S has been quick to respond to cyber attacks faced and been applauded for its response to the attack, particularly its handling of external communications.
The newly released Operational Resilience Report 2025 has found organizations are taking a more integrated approach to resilience. Recognizing that people are vital to cybersecurity,
Cyber security culture The 6 principles laid by National Cyber Security Centre (NCSC) to build a cyber security culture within an organization.
- Frame cybersecurity as an enabler, supporting the organization to achieve its goals
- Build the safety, trust, and processes to encourage openness around security
- Embrace change to manage new threats and use new opportunities to improve resilience
- The organization’s social norms promote secure behaviours
- Leaders take responsibility for the impact they have on security culture
- Provide well-maintained cybersecurity rules and guidelines, which are accessible and easy to understand.
The first principle identifies that cybersecurity exists to protect the technology and information that keep an organization running.
But when it operates in isolation, its role as an enabler of every other function is often overlooked. This disconnect creates tension. Security may be seen as a blocker, its policies misunderstood or ignored, and controls bypassed, opening the door to further risk.
A shared purpose across the organization changes this dynamic. When everyone understands and works toward common goals, decisions reflect what supports the whole rather than just individual departments. Cybersecurity becomes part of how work gets done, not an obstacle in the way.
An effective culture recognises that secure behaviour is essential to meeting shared goals. Staff understand the value of cybersecurity in protecting systems and information. Controls are designed with an awareness of how people work, and security teams engage directly to reduce friction.
Clarity around purpose, consistent internal messaging, and strong leadership support all help integrate cybersecurity into the wider mission.
When people no longer see security as a separate concern, but as part of their contribution to organizational success, stronger and more resilient practices follow.
No amount of training can replace the value of open dialogue, especially when facing unfamiliar or fast-moving threats. When people are comfortable reporting mistakes, raising concerns, or suggesting improvements, the organization becomes more adaptive and resilient.
The second principle depends on a culture where people feel safe to speak up.
Without psychological safety, self-protection takes over. People stay silent, avoid reporting errors or tolerate behaviour that undermines security. Fear of blame or punishment blocks the flow of vital information and ideas.
To counter this, organizations need trusted, accessible channels for communication. Whether through help desks, portals, or local experts, these paths must be easy to use and free from friction. When people do reach out, their efforts should be acknowledged and, where possible, acted upon.
Security incidents should be investigated to understand what happened and how to improve, not to assign fault. Fair treatment and transparent processes build trust and make it more likely that people will engage in the future. Psychological safety is not a soft extra. It is a core condition for real-time responsiveness and continuous learning in security. When people trust the system and those behind it, they help protect it.
The third principle On cyber resilient organizations treat change as a constant and improvement as a shared responsibility. In cybersecurity, this mindset is critical.
As threats evolve and technologies shift, staying still is not neutral, it increases exposure and limits growth. Rather than viewing incidents or disruptions as setbacks, forward-looking organizations treat them as signals for refinement. Ignoring these moments in favour of maintaining the status quo leads to blind spots and missed opportunities.
Change must be coordinated across the organization. If one area races ahead or stalls without alignment, the imbalance can cause harm. Cybersecurity teams have a key role in guiding this process. They help ensure that risks are managed by those equipped to handle them, instead of being pushed onto teams lacking the resources or context to respond effectively.
Strong cultures embrace change as a path to better outcomes. They are measured in how and when they implement changes, mindful of fatigue and disruption. People feel supported during transitions and trust that new risks are handled responsibly. To sustain this, organizations need systems in place to identify emerging challenges and bring the right voices into decision-making. Clear roles, timely choices, and shared accountability allow security and resilience to move forward together.
The fourth principle identifies that workplace behaviour is shaped not just by formal rules but by unwritten ones picked up through observation.
These social norms often influence how people approach cybersecurity. When aligned with security goals, they help reinforce good habits and guide new staff toward secure practices.
But not all norms work in favour of security. Some, like cutting corners to be helpful or following senior examples, can quietly encourage risky behaviour. These norms are hard to change if they help people get their work done more easily than formal processes allow. Addressing this requires understanding the values behind these norms. Without doing so, even well-designed policies will be ignored, increasing risk and weakening trust in security measures.
A strong security culture identifies both helpful and harmful social norms and finds ways to align them with formal policies.
This may involve redesigning controls to support productivity or shifting behaviors through influence, incentives, and role models.
The fifth principle recognizes that cybersecurity culture depends on leadership that leads by example.
When leaders align with a shared purpose, model secure behaviors, and foster trust, they help embed security into daily work. Their influence shapes norms and drives change.
Leaders who engage openly and share lessons from past challenges build confidence and inspire action. Those who ignore this responsibility risk undermining progress, as teams often follow their lead. Strong leadership means linking security to business goals, promoting learning, and removing incentives for risky behaviour.
Supporting leaders with the right knowledge and encouraging honest dialogue strengthens a culture where security becomes a collective effort.
The sixth principle calls for creating a cyber-secure workplace that depends on finding the right balance between clear expectations and practical flexibility.
Rules must support people in solving problems locally while setting consistent standards across the organization. When done well, this balance builds trust between staff and leadership.
Overly rigid rules risk becoming outdated and burdensome, while vague guidance leaves teams confused and vulnerable. Both extremes can lead to frustration and disengagement from cybersecurity efforts. A better approach involves understanding where different teams struggle, inviting their input, and refining the rules based on real-world use and ongoing feedback.
Security rules should be integrated into daily workflows and onboarding. They must be easy to find, clearly written, and regularly updated, with changes communicated. Where gaps exist or the rules do not apply, teams must have quick access to experts who can help manage risk at the moment.
In practice, effective cybersecurity guidance is inclusive, tested for usability, and aligned with organizational goals. People should know what is mandatory and what is advisory. Feedback is actively used to improve the rules, and outdated material is removed to prevent confusion.
IntruceptLabs products are influencing cyber culture by promoting proactive security measures, automation, and a focus on user behavior and training.
IntruceptLabs enable organizations to improve their security posture by providing tools for patching vulnerabilities, managing access, and responding to threats, ultimately contributing to a more secure and resilient cyber environment.
GaarudNode is an all-in-one solution designed to empower development teams with the tools they need to secure their applications throughout the development lifecycle. By combining the power of SAST, DAST, SCA, API security, and CSPM, GaarudNode provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.
The platform offers:
- Identifies security flaws early in the development process by scanning source code, helping developers detect issues like insecure coding practices or logic errors.
- Tests running applications in real-time to identify vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and other runtime threats.
- Detects vulnerabilities in third-party libraries and open-source components, ensuring that your dependencies don’t introduce risks.
- Continuously tests and monitors your APIs for vulnerabilities such as authentication flaws, data exposure, and insecure endpoints.
Conclusion:
The importance of cyber resilience helps set businesses who have a solid response plan and test it regularly so that the organization is prepared for any cyber incidents.
The cyber-security incident plan should be part of a wider business continuity plan, considering the impact of a cyber incident on the business and defining steps to recover and respond.
NCSC emphasized that creating the culture takes time and is not a one-off exercise, but needs a focused and sustained effort from cyber security professionals, innovators and culture specialists, and organisations’ leaders.
Sources: https://www.thebci.org/news/retail-under-attack-the-growing-movement-towards-operational-resilience.html
