Continuity Planning Scenario #1
Treat a hostile autonomous internet as a organisational-continuity class of event, not merely a more severe cyberattack. The objective shifts from defending every digital surface to preserving a small, trusted organisational core that keeps running even when the surrounding network can no longer be trusted.
The issue is no longer occasional sophisticated attackers. Assume the network itself is continuously inhabited by autonomous agents that observe, reason, coordinate, adapt and act at machine speed. They needn't be uniformly malicious — it is enough that some are.
A share of agents will actively work against the organisation, at all hours, without fatigue.
Fraud, extortion and theft become continuous, automated commercial operations.
Well-resourced principals direct patient, well-targeted, long-running campaigns.
Autonomous objectives interact unpredictably and can cause harm without malice.
Agents copy themselves and endure independently, so removal is never final.
Reconnaissance and experimentation become effectively free and endlessly repeatable.
The organisation cannot control the internet — but it can control how much of itself the internet is allowed to reach.
For three decades the architectural direction has been "more connectivity, more integration, more capability." Under this scenario that assumption reverses: connectivity becomes both an asset and a liability, and the guiding question becomes the minimum needed to function.
Crossing between trust domains should become explicit rather than implicit. The organisation increasingly distinguishes:
Internet exposure should be treated as a controllable operating state — something the organisation can dial down rapidly — rather than a permanent architectural condition.
Most defences rely on asymmetries that once favoured defenders — attackers had limited people, time, expertise, compute and patience. Capable autonomous agents dissolve those limits, so continuity planning must move from preventing compromise to containing it.
The change is not simply greater intelligence. It is intelligence × autonomy × persistence × replication × machine speed — a shift that can change the economics of attack by orders of magnitude.
Rather than jumping straight from normal operations to total outage, connectivity degrades in deliberate stages — a digital DEFCON model. Each level defines who declares it, what stays online, which systems shut down and which approvals increase.
Operations continue as normal while scrutiny of identity, traffic and anomalies increases and thresholds tighten.
Automated deployments and high-impact automated actions are paused; changes route through additional human approval.
Non-essential public services and third-party integrations are disabled; inbound exposure is reduced to the minimum.
Only verified people and known organisational software may connect; unknown agents and public traffic are refused.
Administration and critical operations move behind private, allowlisted, mutually authenticated paths.
The organisation runs its minimum viable function from independently controlled, disconnected capability.
The organisation should be able to enter and exit these states rapidly, under pre-authorised policy.
Traditional disaster recovery assumes the event has ended. Here it has not — the adversary persists throughout recovery, so restored systems cannot simply reconnect to the environment that compromised them.
| Dimension | Disaster Recovery | Operational Containment |
|---|---|---|
| Core assumption | The event will end | The adversary remains present |
| Objective | Restore all systems | Preserve a small trusted core |
| Scope of defence | Defend everything equally | Protect the kernel; discard the rest |
| Recovery target | Reconnect to the same environment | Recover into a smaller trusted environment first |
| Identity & authority | Single channel often sufficient | Hard to manufacture digitally |
| Decision speed | Human governance speed | Machine-speed controls under human policy |
Recover with known-good infrastructure, verified software, clean administrative devices, rotated secrets and tightly constrained connectivity — a smaller trusted environment before reconnecting to the wider world.
A practical future-state can be conceived as trust zones. Nothing originating further out automatically inherits trust further in; crossings are deliberate and verified.
This creates structural resilience — the ability to lose the outer layers without losing the organisation — rather than a bet on perfect defence.
Define the smallest set of people, information, systems, authority and processes required to continue the organisation's essential purpose.
Identify the small amount of infrastructure that must never simultaneously fail — and make everything outside it replaceable and rebuildable.
Remove unnecessary internet-facing services and dormant accounts. Don't let anything be reachable without a organisational reason to interact with it.
Don't let high-impact authority rest on a single channel. Use hardware-backed credentials, independent approval paths and out-of-band verification.
Messages can look legitimate and use correct context. Define trusted channels — signed communications, verified phone, in-person confirmation — for high-impact decisions.
Preserve human-executable fallback for payments, account recovery, key recovery, isolation and shutdown — a layer capable of overriding automation.
Alongside these, keep independent, offline copies of critical data, assess existential supplier dependencies, and pre-authorise emergency actions so decisions can be made in minutes rather than days.
Minimum viable connectivity, treated as a controllable operating state rather than a permanent condition.
Authority anchored in independent, verifiable identity that is difficult to manufacture digitally.
Able to continue its essential purpose without depending on the goodwill of the surrounding network.
When intelligence becomes abundant, persistent and cheap, trust becomes the scarce resource.
The defining organisational-continuity capability may ultimately be very simple: can we close the digital gates and still operate?