From Resources to Resilience

I recently spent some time listening to a House hearing on state and local cybersecurity.

Hearing: link

What struck me most wasn't what I expected.

At first, I thought the conversation was about funding. State and local governments are facing increasingly sophisticated threats while operating with limited resources, limited staff, and in many cases little dedicated cybersecurity expertise.

Then I thought the conversation was really about AI. Several witnesses discussed how AI is accelerating vulnerability discovery, exploit development, and attack execution. The time between threat emergence and exploitation is shrinking, forcing defenders to adapt faster than ever before.

But the more I listened, the more I realized the hearing was actually about capability.

Everyone agreed that resources matter. Funding matters. Technology matters. People matter.

Yet the examples that seemed to demonstrate the greatest success weren't focused on how much money was spent, how many tools were deployed, or even how many cybersecurity professionals were hired. They focused on maturity improvements, shared services, workforce development, coordination, and helping communities access capabilities they could not realistically build on their own.

That may have been the most interesting insight of all.

The strongest examples weren't focused on making every organization self-sufficient. They were focused on creating scalable models that helped organizations access capability they could not realistically build alone. In many cases, resilience wasn't being built organization by organization. It was being built across an ecosystem.

That distinction matters. Too often, we confuse the resources we invest with the capability we actually create.

Many organizations measure inputs:

• Budget

• Headcount

• Certifications

• Training completions

• Technology deployed

Those things are important, but they are not the outcome.

The outcome is whether an organization can detect, respond, recover, adapt, and continue operating when it matters most.

That's capability.

And when that capability can be sustained as threats evolve, that's resilience.

Capability isn't just about what people know. It's about what people, teams, and organizations can do under changing conditions.

One thought kept coming back to me throughout the hearing.

Workforce development has always evolved alongside the threat landscape. As new technologies, attack methods, and risks emerge, organizations identify the skills required, develop people, and adapt.

But what happens when the threat landscape begins evolving faster than our ability to identify, develop, and deploy those skills at scale?

Historically, organizations have had time to assess emerging threats, build training and development programs, and strengthen workforce capability.

Increasingly, organizations may need to prepare people not only for known threats, but for challenges that do not yet exist.

As AI continues to accelerate the pace of change, the focus may need to shift from developing skills for known conditions to building adaptable capability.

The challenge is no longer simply teaching people what to do. It is developing people, teams, and organizations that can respond effectively to situations they have never encountered before.

To me, that's where the conversation becomes especially interesting.

Resources are essential, but they are only the starting point.

Resources → Capability → Readiness → Resilience

The goal isn't resources. The goal is readiness.

The organizations that thrive may not be the ones with the most technology or the biggest budgets. They may be the ones that can learn, adapt, and develop capability the fastest.

That's the difference between activity and readiness.

And increasingly, it may be the difference between readiness and resilience.

I'm also left wondering what all of this means in an era where AI is accelerating the pace of change.

That may be an even bigger workforce and capability conversation.