As Threats Spread Across Connected Systems And Suppliers, CIOs Orchestrate Resilience End To End

The views and opinions expressed are those of Ali Katkhada and do not represent the official policy or position of any organization.

Enterprise security rarely fails at the firewall anymore. It fails in the connections: the files, suppliers, integrations, and employees moving data in and out of the business every day. As companies wire together hundreds of applications and thousands of outside partners, the space between those pieces becomes the real exposure, and no single tool closes it. The discipline leaders are converging on is cyber resilience, governing those connections so a threat can be contained and recovered from fast, without grinding operations to a halt.

Ali Katkhada is Group Chief Information Officer at NAFFCO Group, where he leads technology, cybersecurity and digital transformation across a global manufacturing and supply-chain operation. He's spent close to two decades running enterprise IT for publicly listed, multi-entity groups across London, Singapore, and the Gulf, including a long tenure as Group CIO at Depa Group and earlier Oracle work at EDS, an HP company. Most of that career has played out in regulated environments where boards, auditors and regulators scrutinize every technology decision. For Katkhada, the boardroom's relationship to security has flipped over those years.

"A decade ago I was standing in front of the board trying to justify why we needed a cybersecurity budget at all. Today it's the opposite: cybersecurity sits in the KPIs of every CEO, not only the CIO or the CISO. Nobody can guarantee you're one hundred percent safe, so the real question has moved to recovery," Katkhada said. The boardroom no longer asks whether the company will be breached, he explained, but how fast it can be back on its feet. Among security chiefs, ransomware and supply chain disruption have been the top two concerns two years running, and that reality is what pushes recovery time to the center of the program.

• Drills over assumptions: Katkhada doesn't trust a recovery plan he hasn't watched run. "I don't want to wait until something bad happens to find out if it works. Every six months I pause daily operations and test whether the disaster recovery site actually takes over, and how many minutes it really takes to move all the traffic across." The exercise doubles as a readiness check on his team and his runbooks, not just the technology, and it surfaces the gaps a green backup dashboard hides.

• Inspecting the inbound: The exposure he worries about most sits in the traffic between organizations. With a third party now figuring in nearly half of confirmed breaches, one weak counterparty can undo controls everywhere else. "Before we do business with anyone, we ask to see their security measures, because I'm going to be sharing drawings and files with them. Anything that reaches our environment, any email, any attachment, any USB, passes through three layers of checking before it can land on a server," Katkhada said. Vendors that can't clear a basic bar don't get the connection.

• Security you don't notice: Controls that strangle the work fail on his scorecard even when nothing gets breached. "The best security is the security nobody notices," Katkhada said. "We're here to generate revenue and deliver, so if I lock everything down and the business can't move, that's not a security strategy worth having." He treats adoption, not lockdown, as the signal that a control is actually working.

Giving people safe options only holds up if the rules behind them are consistent, and consistency is the hard part across a business that spans jurisdictions and a long supply chain. For large organizations, third-party and supply chain exposure is now the single biggest barrier to resilience. Policies that look minor on paper are often the ones that decide whether a gap stays closed. So Katkhada's aim is to make the right behavior routine, until following it stops being a decision at all.

• Governance as the default: New hires absorb the security culture in their first week, and the guardrails don't bend for seniority. "If you're traveling to a country we don't operate in, you have to tell the security team first so we can open up access. People find it annoying at the start, but once it's the norm, nobody argues. They understand why saving sensitive data on a public cloud isn't allowed, because we've given them a corporate alternative for it." What's left after the policies and the alternatives is a residual risk he logs and watches rather than pretends away, ranked by what a failure would actually cost the business.

• AI on both sides: The same technology reshaping the defense is sharpening the attacks, and the tells people were trained to spot are disappearing. The failures slipping through now are the ones standard accuracy and compliance checks don't catch. "You get a Teams invite to a meeting that looks completely real. It uses your client's name, the right project, the right people, and it was all generated by AI. The place we invest most is awareness, and we've put the CEO himself in front of it, because a person who gives away the key opens a door no tool can keep shut," Katkhada said. Technology filters most of it, and the company uses AI to flag suspicious inbound mail, but the last line is a trained employee who stops and thinks before clicking.

None of it holds together as a pile of separate tools. What Katkhada describes is a single discipline: inspect what comes in, vet who you connect to, test that you can recover, and make the rules routine enough that people follow them without being forced. The work is coordinating all of it across a business that never stops moving, and he's built his security team around giving people a safe way to do what they need rather than a locked door.

As Katkhada put it, "You do your homework, you do your due diligence, you keep the governance and the measures in place, and when the bad day comes, you're ready to recover quickly. You can't promise nothing will ever happen. You can promise you won't be standing still when it does."