Most governments still hold cyber in the wrong part of the building. It sits with the technical directorate, is measured in incidents closed and systems patched, and reaches the national security council only after something has gone wrong. Meanwhile the same government's adversaries treat it as an instrument of statecraft: a way to impose cost, shape a negotiation, or degrade a decision without crossing a threshold that would invite a conventional response.
That asymmetry is the whole problem. One side is running a maintenance function. The other is running a campaign. The mismatch is not in capability, many states have excellent technical services, but in where the capability sits and who it answers to.
Dependencies are discovered at the worst possible moment
Ask a ministry which systems it could not operate without and it will produce a list. Ask which suppliers those systems depend on, and which suppliers those suppliers depend on, and the list thins out into assumption. The dependency that matters is rarely the one being defended. It is the payment rail, the logistics scheduler, the certificate authority, the single vendor whose update channel reaches every endpoint in the country.
This is knowable in advance. It is simply nobody's job. Mapping national dependency is a tedious, cross-departmental exercise with no natural owner and no political reward, which is why it is usually done for the first time during the response to an incident, when the mapping has to be completed in hours by people who are also trying to restore service.
Resilience is not the absence of intrusion. It is knowing, before the day, what you can lose and still govern.
Resilience is a decision structure, not a product
The useful question is not whether a network can be breached, it can, but how quickly a government can establish what happened, decide what it is willing to say publicly, and act. That is a command problem. It depends on whether the technical service can reach a minister in minutes, whether there is a pre-agreed threshold for attribution, and whether anyone has rehearsed the moment when the answer is genuinely unclear and a decision is needed anyway.
Nations that handle this well have usually done three unglamorous things. They have put cyber inside the national security decision structure rather than beside it. They have rehearsed with the actual decision-makers, not their deputies. And they have decided in advance which functions must survive, not which systems, which functions, so that a degraded state is a plan rather than a discovery.
The instrument, not the shield
Treating cyber as an instrument of national power also means being clear about what a state will do in response, and making that clarity credible. Deterrence in this domain is weak partly because responses are slow, deniable and rarely announced. A government that cannot say what it will do, and has never demonstrated it, is relying on an adversary's restraint.
None of this begins with procurement. It begins with a decision about where the capability sits and who is accountable for it, which is a governance question, answerable this quarter, and the one most likely to still be open when it matters.