Arguments
Two named arguments
One about how institutions are built to hold. One about how the people who hold them are made. Each has a reference page that does not move.
The institutional layer
The Resilience Operating Discipline
A standing practice for keeping a critical service inside its stated tolerance, and for holding the evidence that it did.
The discipline exists to produce evidence during normal operation, so the evidence is already in hand when a service is tested. The reference page sets out six operations in the order they run, the regulatory instruments across five jurisdictions the discipline is mapped against, and four things it deliberately does not do.
Where it applies
Operational resilience, board oversight of technology risk, and regulatory engagement in financial services.
Mapped against DORA, PRA SS1/21, APRA CPS 230, OSFI E-21, and the MAS Business Continuity Management Guidelines, and against SEC Regulation S-K Item 106 on disclosure.
The human layer
The Pipeline Paradox
Agentic AI is automating the entry tier of cybersecurity. That work was repetitive and burned people out, so automating it is good. It was also the profession’s only apprenticeship.
The reference page sets out how the loss is lagged, correlated across the industry, and not solved by adding training seats, along with what the term does not claim. The argument has a stated disconfirming condition and an author who advises in the category, disclosed.
Where it applies
Cybersecurity workforce policy, entry-level hiring, and what a security organization will be able to staff in five years.
Carried forward in Becoming Cyber.
Why two
Resilience is designed. Expertise is apprenticed.
The first argument is about systems and the second is about the people who run them. Neither holds on its own. An institution that designs for continuity and cannot staff the function has solved half a problem, and so has one that trains well and builds badly.