When support does not equal resilience

Public organizations increasingly depend on external consultants for cyber crisis management expertise. This is understandable: cyber threats evolve quickly, internal budgets are limited, and competition for skilled professionals is intense. However, the paper argues that many consultancy engagements unintentionally reinforce dependency.

Traditional approaches often emphasize tangible outputs such as reports, playbooks, or tabletop exercises. While these deliverables have value, they do not automatically create understanding, ownership, or the ability to act independently when a real cyber crisis unfolds.

The consequence is familiar: once consultants leave, knowledge dissipates, responsibilities remain unclear, and organizations revert to ad‑hoc responses when pressure rises.

A shift from deliverables to ownership

The case described in the paper shows a different approach. During the engagement, it became clear that cyber crisis response could not be treated as a purely technical or isolated domain. Instead, it required alignment between cyber expertise, IT operations, incident management, and existing crisis management structures.

Together with internal stakeholders, governance structures were clarified, internal ambassadors were identified, and shared responsibilities were defined. Rather than “delivering” exercises, the focus shifted toward transferring knowledge, building routines, and embedding cyber crisis management within existing organizational processes.

This approach allowed the organization to gradually take ownership of its cyber crisis management capabilities, with external consultants stepping back into an advisory and validating role.

Three key insights for cyber crisis consulting

Based on this experience, Max Tijmann and Rosa Edema identify three core insights that are relevant to many public sector organizations:

• Cyber crisis consulting should go beyond one‑off activities. Long‑term resilience requires deliberate capability building, not isolated assessments or exercises.
• Effective cyber crisis management is inherently multidisciplinary. Cyber response must be integrated with IT, incident response and traditional crisis governance.
• Consultants have a professional responsibility to prevent dependency. Sustainable resilience means helping organizations become capable of operating independently over time.