Business Resilience in 2026: 10 Lessons from Our Churchill War Rooms Workshop

1. Innovation should belong to everyone

Innovation doesn’t happen exclusively in boardrooms or innovation teams. The people solving customer and operational challenges every day are often best placed to identify opportunities for improvement.

Businesses should actively create mechanisms that allow employees across the business to contribute ideas and influence strategic change. The most resilient businesses foster a culture where innovation is everyone’s responsibility.

2. Experiment, but with discipline

Innovation requires investment, but it also requires accountability. Businesses should build room for experimentation through pilot funding, scalable budgets, and clear project kill-switches.

Being willing to stop or pivot initiatives that are no longer delivering value is just as important as backing the right ideas. Resilience means remaining adaptable rather than becoming emotionally invested in technology or projects.

3. Business outcomes must drive technology decisions

Technology projects that succeed are those that are clearly aligned to business objectives. Without that alignment, transformation programmes can quickly become change for change’s sake.

Whether you’re adopting AI, modernising infrastructure, or improving operational processes, every initiative should have a clear business outcome and a plan for user adoption from the outset.

4. AI readiness starts with strong foundations

Many businesses are eager to adopt AI, but successful implementation requires more than simply choosing the right tools. Businesses must address governance, shadow IT, data security, and platform readiness before they can unlock AI’s full potential.

The discussion highlighted that AI is often misunderstood at board level, with conversations frequently focused solely on cost savings. In reality, AI presents an opportunity to improve resilience, productivity, and competitive advantage when adopted strategically and securely.

5. Translate technology into business language

One of the biggest challenges businesses face is translating technical requirements into business outcomes.

Boards don’t necessarily need to understand the intricacies of AI governance frameworks or cyber controls, but they do need clarity on the value, risks, and success criteria associated with technology investments. Building a common language between business and technology leaders is essential for resilient decision-making.

6. Cyber resilience is a board-level responsibility

Cyber security is increasingly becoming a boardroom discussion, and rightly so. Effective cyber resilience programmes are measured against recognised frameworks and communicated in ways that make risk visible, understandable, and actionable for leadership teams.

Resilience cannot sit solely within IT or security functions. It must be embedded across the business.

7. You can’t protect what you don’t know exists

Many businesses still struggle with maintaining accurate asset inventories and understanding the full extent of their technology estates.

The introduction of new requirements around multi-factor authentication for cloud services has highlighted just how difficult it can be to identify every SaaS application in use. Dormant user accounts, unmanaged applications, and service accounts with excessive permissions remain significant sources of cyber risk.

Understanding what exists within your environment is the first step towards protecting it.

8. People remain one of the biggest attack surfaces

Security awareness training has evolved significantly over the past decade. Annual compliance-based training is no longer enough.

Today’s most effective programmes use behavioural science and personalised learning approaches to help employees recognise and respond to cyber threats. Human risk remains one of the biggest challenges businesses face, making continuous education a critical component of resilience.

9. Preparation matters more than documentation

Having an incident response plan is important, but having people who know how to execute it is what makes it valuable.

Businesses should regularly conduct cyber incident exercises and simulations to ensure stakeholders understand their responsibilities when an incident occurs. Red teaming exercises and resilience testing provide invaluable experience that cannot be replicated by simply reviewing a document.

The businesses that recover most effectively from incidents are often those that have practiced their response before they need it.

10. Resilience is broader than cyber security

Perhaps the biggest takeaway from the workshop was that resilience extends far beyond cyber security.

Businesses must understand their critical services, supply chain dependencies, operational tolerances, and strategic priorities. Investment decisions should be driven by what matters most to the business rather than attempting to address every possible risk equally.

Resilience is about building a business that can continue to innovate, adapt, and grow regardless of the challenges it faces.

Benchmark Your Business Resilience

The conversations at Churchill War Rooms reinforced an important point: resilience is not a destination – it’s a continuous journey. The businesses that thrive in 2026 and beyond will be those that take a strategic approach to resilience, balancing innovation with governance and agility with security.

If you’d like to understand how resilient your business is today, download the Business Resilience Index 2026 to explore the five pillars of business resilience and the maturity model that underpins it.

Once you’ve read the report, take the Business Resilience Assessment to benchmark your business’s resilience maturity and identify practical opportunities for improvement. And don’t forget, our experts are always happy to discuss your results and help you build a roadmap towards becoming strategically resilient.