The talk will challenge the conventional prevention-first mindset and make the case that the more honest — and more useful — question organisations should be asking is not "are we secure?" but "Are we resilient?" The speaker will draw on my experience as a security leader to walk through a practical framework built on three pillars: detecting threats early, containing their impact, and recovering with confidence. The talk will also touch on cross-sector collaboration and what both security teams, management and boards can do today to close the resilience gap.