# Steve Durbin on Cyber Resilience and Infrastructure Threats Expert analysis on how DIY hackers and outdated systems challenge modern corporate security strategies. - **Source:** [ISF Podcast](https://brifing.si/source/79b0fddc-4e90-46d5-ae51-4389c80ea5c7) - **Published:** 2026-11-03 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/dc707c68-8285-40eb-9120-c7ca8a6b73dd ## Critical Infrastructure Vulnerabilities Steve Durbin highlights that critical infrastructure faces increased targeting due to its essential societal role. Attackers prioritize these sectors because disruptions trigger immediate, high-stakes responses. Many organizations currently operate with outdated systems directly connected to the internet, creating clear pathways for malicious actors to exploit legacy vulnerabilities within these sensitive operational environments. ## The Rise of DIY Hackers The threat landscape is shifting as do-it-yourself hackers and crime-as-a-service models lower the barrier to entry for cybercriminals. These emerging threats allow less sophisticated actors to execute complex attacks against established organizations. This democratization of cybercrime forces businesses to rethink their defensive perimeters against a broader, more unpredictable range of adversaries. ## Shift Toward Cyber Resilience Leaders must pivot their primary security focus from pure prevention to robust recovery capabilities. Since absolute prevention is increasingly difficult, organizational resilience depends on the ability to maintain operations during an active breach. This strategic shift requires boards to acknowledge that total security is impossible, making rapid restoration of critical processes the priority. ## Protecting the Crown Jewels The gold standard for security involves identifying and isolating an organization's most critical data, often referred to as crown jewels. Durbin emphasizes that companies must map their key processes to understand the specific operational impact of potential failures. Protecting these core assets ensures that the business can survive even if peripheral systems are compromised. ## Boardroom Risk Awareness Corporate boards are currently struggling to keep pace with the rapid evolution of emerging technologies and associated risks. Durbin argues that directors must improve their understanding of how these technologies impact business operations. Without a firm grasp of these technical risks, boards cannot effectively oversee the security investments required to protect the enterprise. ## Investment During Economic Slowdown Organizations face a difficult dilemma regarding whether to invest in cyber resilience during periods of slow economic growth. Durbin suggests that despite financial constraints, neglecting security infrastructure creates long-term exposure. Boards must weigh the immediate cost of security upgrades against the potentially catastrophic financial and operational consequences of a successful, unmitigated cyber attack. ## The Virtual Trusted Insider The concept of the virtual trusted insider represents a significant challenge for modern security teams. This threat involves actors who gain legitimate access or mimic trusted entities to bypass traditional perimeter defenses. Identifying these threats requires a deeper focus on behavioral monitoring and internal process verification rather than relying solely on external firewalls. ## Practice and Rehearsal Importance Technical defenses alone are insufficient without regular practice and rehearsal of incident response plans. Durbin concludes that organizations must move beyond theoretical security policies to active simulation. By testing recovery procedures under pressure, companies ensure that their teams can execute effectively when a real-world breach occurs, minimizing downtime and overall organizational damage. ## Sources covering this story - https://audioboom.com/posts/8971952 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._