Foreword Cyber resilience matters. As businesses and governments continue to evolve their use of digital technologies and data, global dependence on cyberspace continues to grow. This increasing reliance exposes organizations and individuals to heightened cyber risks at a time when threat actors are becoming more sophisticated, well-resourced and innovative. Cyber resilience acknowledges that no system is entirely secure. Traditional cybersecurity efforts have evolved from merely implementing technical security controls to a broader strategy focused on safeguarding core business objectives. The goal is not just to prevent cyber incidents but to minimize their impact on an organization’s primary goals and objectives, such as maintaining critical services, safeguarding stakeholder confidence and protecting strategic value, while promoting long-term growth. Building on our previous white paper Unpacking Cyber Resilience, this publication delves into the practical aspects of cyber resilience, offering insights drawn from the front-line practices of leading organizations globally. It emphasizes the need to move beyond technical solutions and develop comprehensive strategies that align with business objectives. Through consultations and workshops with cybersecurity practitioners, this work distils real-world lessons on what works – and what does not – when confronting cyber risks. Ultimately, cyber resilience is a practice, not a theory, and sharing learnings about “what works” is key to building collective knowledge in the field. The Cyber Resilience Compass should not be seen as a static tool but as a vehicle for organizations to exchange experiences and identify front-line practices as they seek to make progress along their cyber resilience journey. We invite you to access additional insights and contribute to the Cyber Resilience Compass here.Akshay Joshi Head, Centre for Cybersecurity, World Economic ForumSadie Creese Professor of Cybersecurity; Director and Technical Board Chair, Global Cyber Security Capacity Centre, University of OxfordThe Cyber Resilience Compass: Journeys Towards Resilience April 2025 The Cyber Resilience Compass: Journeys Towards Resilience 3

The Cyber Resilience Compass 2025