Reza Sibilant, Managing Director, GSA Global
Building organisational resilience means recognising that the risks organisations face rarely sit neatly within one area of security. Cyber threats can begin with people, insider risk can expose wider organisational vulnerabilities, and events elsewhere in the world can quickly create new challenges for employees, operations and leadership teams.
For the third in our Meet GSA Global series, we sat down with Managing Director Reza Sibilant to talk about his career, how the security landscape has changed and what he is hearing from organisations as they navigate an increasingly complex risk environment.
From understanding emerging threats to building resilience and making better-informed decisions, we asked Reza what organisations should be thinking about and what his experience has taught him about managing risk.
Reza, let’s start with your own story. How did your career in security begin, and what ultimately brought you to GSA Global?
I finished a sports science degree fully expecting to go into teaching, but during the course I realised it wasn’t my passion. Following my graduation and with no plan, a friend introduced me to a recruitment firm who lined up an interview with a company called Trend Micro which was my entry into cyber. It was the first time I’d seen how vulnerabilities could be exploited and how spyware worked, and I found that world fascinating. What kept me in the industry was the client side of the work, because I enjoyed listening to the problems organisations were facing and working out what would help them. Over the 18 years since, including several years at Accenture, much of my work has been in critical national infrastructure (CNI), where I saw human, physical and cyber threats converging in ways that few organisations or advisers were looking at together.
That gap is a large part of why I joined GSA Global, as clients increasingly need to understand and manage these converging threats. Another key reason is Mark Raeburn and Bill Trent, who have been mentors to me for many years. GSA combines their cyber experience with colleagues from policing, counter-terrorism, the military and government, which puts us in a position to address those risks as a whole.
You’ve worked across different areas of security and risk. How has the nature of the threats facing organisations changed during your career?
When I started, most of the conversation was about keeping outsiders away from networks and data. Today the more serious attacks are aimed at an organisation’s ability to operate at all. Over the last couple of years several well-known UK retailers and manufacturers have lost weeks of trading after attacks that began with someone persuading a service desk to reset a password. The attackers exploited people and process first, and the technology followed. Geopolitics also plays a much larger part than it used to, with state-linked groups targeting infrastructure and supply chains. At the same time, artificial intelligence (AI) is making impersonation and fraud cheaper and more convincing, which puts more pressure on the everyday judgement of staff and the processes around them.
When you speak to clients today, what are the security and risk issues they are most concerned about?
The question I hear most often from chief executives and business leaders is whether the business could keep running through a serious incident, and for how long it could keep operating before recovery plans need to be invoked. That concern has grown as leaders have watched peers lose revenue and customer trust after attacks they assumed would stay within IT. The second concern is dependency on third parties, because many organisations now rely on suppliers and service providers they have limited visibility of. Leaders are also more conscious of their own personal exposure, both through regulation that places accountability on named individuals and through the amount of information about senior people that is available online and can be used to target them or the business.
Are organisations getting better at understanding how different risks connect, or do they still tend to look at cyber, physical security, people and organisational risk separately?
Some are, but most still manage cyber, physical security, people risk and investigations through separate teams, with separate budgets and reporting lines. That structure made sense when the risks looked different from one another, although it no longer reflects how incidents actually unfold. A leaked personal phone number can lead to a convincing phishing call, which can lead to access to systems, which can lead to a physical threat against an executive. Each team may see its own part of that sequence while nobody sees the whole of it. The organisations making progress are those where a senior leader owns the overall picture and the teams share what they know as a matter of routine.
How important is it to understand what an organisation is actually trying to protect before deciding where to invest in security?
It is the starting point, and it is often skipped. Many organisations invest in security according to what their peers are buying or what the last audit highlighted, while being unable to say clearly which functions the business could not survive losing. When you work back from those critical functions, the systems, people, suppliers and locations they depend on become visible, and investment decisions become much easier to make and to defend. It also changes the conversation at board level, because leaders are discussing the business they run in terms they recognise, which makes it far more likely they will take ownership of the decisions.
Where do you see cyber security and insider risk coming together, particularly when it comes to trusted people and access?
They meet at the point of trusted access. Most serious attacks now involve someone using legitimate credentials, whether those belong to a real employee who has been manipulated or to an attacker who has stolen them. We have also seen hostile states place people into remote technical roles using false identities, which turns recruitment into a security control. Technology can flag unusual behaviour on systems, although it cannot tell you whether someone is under financial pressure, disaffected or being approached from outside. That context sits with line managers, HR and the vetting process, so insider risk has to be led as a leadership and culture issue, with the technical controls supporting it.
What can organisations do to bring together the different teams responsible for cyber, physical security, investigations and people risk, and what difference can that make?
Restructuring is rarely the answer, and it tends to cause more disruption than it resolves. The more practical steps are to give one senior executive clear ownership of the overall risk picture and to agree a shared view of what matters most to the business. From there, the teams can use a common way of describing and escalating risk, share information about people and events of concern, and exercise together against realistic scenarios. The difference shows up most clearly during an incident, because decisions are made faster, fewer issues fall between teams, and leadership receives one assessment instead of several competing ones. Unfortunately, silos remain a real issue, and there needs to be a step change in how teams collaborate and respond together.
We often talk about resilience rather than simply security. What does resilience look like in practice?
Resilience starts with accepting that some attacks will succeed, however well defended an organisation is, and planning for how the business continues when that happens. In practice that means knowing which functions must keep running, and having a way to run them if the main systems are unavailable. In my work with a nuclear sector client, we built an isolated environment that allowed critical operations to continue during a catastrophic cyber event, and colleagues at GSA have helped other organisations define and build similar minimum viable secure environments, sometimes described as a ‘lifeboat’. The other part is people, and that cannot be forgotten. A resilient organisation has rehearsed its response, its leaders know their roles, and the plan has been tested under pressure before it is ever needed.
How important are leadership and decision-making when an organisation is dealing with a serious security incident or emerging threat?
They largely determine the outcome. In the first 48 hours of a major incident, leaders have to make consequential decisions with incomplete information: whether to shut systems down, what to tell customers and regulators, and how to respond to extortion demands. Organisations that have agreed in advance who holds which decisions, and have practised making them, move with far more confidence than those improvising under pressure. Several of my GSA colleagues have commanded responses to terrorist incidents and major operations, and the lessons carry over directly. Clear authority, disciplined communication and a calm, visible leadership presence matter as much as any technical response.
If you could get every board or senior leadership team to ask themselves one question about their organisation’s security and resilience, what would it be?
“If we lost our most important systems tomorrow, how long could we keep operating, and have we tested that answer?” Most boards can describe their security controls in some detail, although far fewer can say with confidence what would happen to the business in the days after a serious incident. Asking that question tends to reveal where ownership is unclear, where dependencies have been overlooked and where plans exist only on paper. It also moves the discussion away from technology and towards the decisions only the board can make about how much disruption the organisation is prepared to accept.
Reza’s perspective reflects something we see increasingly across our work: organisations rarely face risks in isolation. People, technology, information, physical security and external events are increasingly interconnected, and understanding those relationships is an important part of building resilience.
For organisations, that means looking beyond individual threats or security disciplines and considering how risks connect, where vulnerabilities overlap and how prepared they are to respond when something changes. Whether the challenge involves cyber security, insider risk, protective security, security vetting, travel risk management or investigations, understanding how these areas interact can provide a much clearer picture of an organisation’s overall risk.
One question to leave with you
As Reza puts it:
If we lost our most important systems tomorrow, how long could we keep operating, and have we tested that answer?
