Arguments
Two named arguments
One about how institutions are built to hold. One about how the people who hold them are made. Each has a reference page that does not move.
The institutional layer
The Resilience Operating Discipline
A standing practice for keeping a critical service inside its stated tolerance, and for holding the evidence that it did.
The discipline exists to produce evidence during normal operation, so the evidence is already in hand when a service is tested. The reference page sets out six operations in the order they run, the regulatory instruments across six jurisdictions the discipline is built against, and four things it deliberately does not do.
Where it applies
Operational resilience, board oversight of technology risk, and regulatory engagement in financial services.
Built against DORA, the UK PRA regime, APRA CPS 230, OSFI E-21, MAS requirements, and SEC Regulation S-K Item 106.
The human layer
The Pipeline Paradox
Agentic AI is automating the entry tier of cybersecurity. That work was repetitive and burned people out, so automating it is good. It was also the profession’s only apprenticeship.
The reference page sets out how the loss is lagged, correlated across the industry, and not solved by adding training seats, along with what the term does not claim. The argument has a stated disconfirming condition and an author who advises in the category, disclosed.
Where it applies
Cybersecurity workforce policy, entry-level hiring, and what a security organization will be able to staff in five years.
Carried forward in Becoming Cyber.
Why two
Resilience is designed. Expertise is apprenticed.
The first argument is about systems and the second is about the people who run them. Neither holds on its own. An institution that designs for continuity and cannot staff the function has solved half a problem, and so has one that trains well and builds badly.
Colophon
An index page. Each argument’s reference page carries its own version, sources, and review date. Last reviewed 31 August 2026.