CYBER resilience starts with identity. The piece argues that as enterprises rely increasingly on cloud identity providers and a mix of IdPs, maintaining identity resilience is essential to overall cyber resilience. If staff cannot access apps because identity infrastructure is unavailable, recovery plans for data and applications alone will not restore operations.
The author notes that AD remains a frequent target for attackers and recalls Maersk’s NotPetya incident, where only one AD domain controller survived thanks to a disconnected office, underscoring how fragile identity ecosystems can disable global operations.
The article emphasises that identity teams and IT operations must collaborate on resilience, recognising that organisations often manage dozens or even thousands of apps and may operate multiple workforce and customer IdPs. It highlights risks from drift (upstream configuration changes, HR or AI drift) and human error, which can feed a drift-to-vulnerability pipeline.
After an IdP incident, there is a complex, ordered restoration process that must reconnect applications to IdPs and consider dependencies both upstream and downstream. The piece frames cyber recovery as aligning backup, recovery and cyber resilience to restore a “minimum viable company” and meet RTO/RPO goals, while acknowledging that identity recovery cannot be treated as a simple feature toggle.
Practical guidance centres on understanding the identity estate, achieving real-time observability of changes and drift, and clearly mapping dependencies and recovery steps. The author argues that identity resilience must be orchestrated with the broader resilience programme to prevent “resume‑generating” events and sustain critical access to apps and data.