Cybersecurity Watch Special Report · October 5, 2026
Cybersecurity Awareness Month is surfacing a shift that matters more than any single threat headline: cyber resilience is becoming a question about infrastructure architecture, not just detection and defense.
For two decades, Cybersecurity Awareness Month has mostly been about behavior: stronger passwords, phishing awareness, patching discipline. This year's commentary from infrastructure and cloud executives points somewhere else entirely — toward questions about where systems actually run, how dependent an organization is on a single environment, and whether critical workloads can move if that environment fails.
That shift is the subject of this analysis. CISA's own 2026 guidance for Cybersecurity Awareness Month, built around a "Reduce, Replace, Recover" framework for critical infrastructure, reflects the same move away from pure prevention toward architecture and recovery. The CODEW view is that this amounts to a structural redefinition of what cyber resilience means.
Key Thesis
Cyber resilience is no longer only about preventing unauthorized access. It is increasingly about maintaining control, flexibility, and recovery options across the infrastructure that supports critical workloads and data.
1. Cybersecurity Is Becoming an Infrastructure Problem
CISA frames 2026 as an accelerating threat environment for critical infrastructure specifically, not businesses in general — a priority reinforced by the White House's March 2026 cyber strategy and visible in CISA's own tracking, which shows published vulnerability disclosures already running ahead of the prior year's total by the end of August. The agency's 2026 Cybersecurity Awareness Month guidance asks critical infrastructure owners to practice a "3Rs" discipline — reduce exposure, replace vulnerable systems, and build recovery capability — rather than treating detection as the whole job.
That framing matters because it quietly concedes something the security industry spent years avoiding saying out loud: prevention will not catch everything, so what the infrastructure does after an attacker gets in is now as strategically important as the perimeter that was supposed to stop them. Three separate infrastructure executives made close to the same point independently this Cybersecurity Awareness Month — from three different angles.
2. Legacy Infrastructure Creates Hidden Exposure
Don Boxley, CEO and co-founder of DH2i, argues that the more dangerous threat for many organizations isn't the next novel attack technique — it's the biggest cybersecurity threat may not be the attack you don't see coming, as he put it, but the aging infrastructure already sitting underneath production systems. His point is less about any specific vulnerability than about an organizational habit: systems stay in production because they still function, technical debt accumulates quietly, and "it still works" becomes the de facto standard for infrastructure that should be held to a much higher bar.
Don Boxley, CEO and Co-Founder, DH2i (https://dh2i.com/):
“The biggest cybersecurity threat may not be the attack you don’t see coming. It may be the aging infrastructure you already know is there.
Organizations are still running critical applications and databases on systems that are years behind, and accumulating technical debt because they continue to work. “It still works” is a dangerous standard for production infrastructure supporting the business. Cybersecurity Awareness Month should be a wake-up call that encourages us to look beyond the latest threats and ask more fundamental questions. Is the infrastructure serving as the virtual backbone of the business truly resilient? Can workloads be moved quickly and safely? Is there a single platform or environment that the organization is dangerously dependent on? Who and what can access critical systems, and is that access limited to only what is actually necessary?
Modernization doesn’t mean immediately ripping and replacing everything. It means eliminating unnecessary technical debt… reducing infrastructure complexity… and building in the flexibility, security, and availability needed to keep critical systems running and safe when something goes wrong. Because when that worst-case scenario actually happens, that is definitely not the time to find out your infrastructure just wasn’t ready for it.”
Boxley's framing reframes modernization away from a binary rip-and-replace decision and toward a narrower, more practical set of questions: Is this system actually resilient, or has it just not failed yet? Can a workload running on it move to another environment quickly if it has to? Is the organization quietly dependent on one platform it has never stress-tested? Who can reach this system, and does that access reflect what is actually necessary today rather than what was granted years ago?
The CODEW Lens: Legacy infrastructure is rarely a single catastrophic liability. It is a slow accumulation of small, reasonable-seeming decisions — each one defensible on its own, collectively adding up to a system nobody can move quickly when they need to.
3. The Risk of Having Nowhere Else to Go
Richard Copeland, CEO of Leaseweb USA, names the risk more directly: the most dangerous discovery a company can make mid-incident is that it has nowhere else to go. When critical applications, data, and infrastructure are concentrated with a single provider or platform, one incident — a breach, an outage, a vendor-side problem that has nothing to do with the customer's own security posture — can cascade into a business-wide crisis rather than a contained event.
Richard Copeland, CEO, Leaseweb USA (https://www.leaseweb.com/):
“One of the most dangerous things a company can discover during a cyberattack is that it has nowhere else to go. If critical applications, data, and infrastructure are concentrated with one provider or on one platform, a single incident can quickly become a business-wide crisis. Cybersecurity Awareness Month should be a reminder that cyber resilience isn’t only about keeping attackers out. It’s about making sure that when something does go wrong, one compromised environment, outage, or provider problem can’t take the entire business down with it.
Organizations consequently need to start thinking about infrastructure differently. Every workload does not belong in the same cloud, platform, or provider. Security, sovereignty, availability, performance, and risk should determine where a workload lives. Certainly, not vendor loyalty or convenience. Infrastructure should follow the workload, not the vendor. Because the worst time to discover that you’ve put all your eggs in one basket is after someone has already kicked over the basket.”
Copeland's argument is not a case against concentration for convenience's sake — it's a case against letting vendor loyalty or operational inertia, rather than security, sovereignty, availability, and risk, be the thing that decides where a workload actually lives. His formulation of the principle is memorable precisely because it inverts the usual vendor-selection logic: infrastructure should follow the workload, not the other way around.
The CODEW Lens: Provider concentration is often treated as an operational simplification — fewer vendors, fewer contracts, fewer integrations to manage. Copeland's point is that simplification and resilience are not the same thing, and an organization rarely discovers the difference until an incident forces the question.
4. Where Your Data Lives Matters
Estelle Azemard, CEO of Leaseweb Canada, extends the same logic into jurisdiction. Her framing for Canadian organizations is a question many have not had to answer precisely: do they actually know where their critical data sits, who controls the infrastructure underneath it, and what laws could reach it? A cyberattack is disruptive enough on its own; discovering mid-crisis that a critical workload is tied to a single provider, governed by a foreign jurisdiction, or simply too costly and slow to move, turns a security incident into a far larger business and legal problem.
Estelle Azemard, CEO, Leaseweb Canada (https://www.leaseweb.com/):
“For Canadian organizations, Cybersecurity Awareness Month should raise a question that is becoming increasingly difficult to ignore: do you actually know where your critical data is, who ultimately controls the infrastructure underneath it, and what laws could reach it? A cyberattack is frightening enough. Discovering during a crisis that your most important workloads are tied to a single provider, governed by another jurisdiction, or difficult and expensive to move can turn a security incident into a much larger business problem. Canadian companies need to think about cybersecurity not simply as protecting data, but maintaining control over it.
That means resisting the idea that every workload should automatically go to the same cloud or provider. Some applications may belong in public cloud, while sensitive data may be better suited to private or Canadian-based infrastructure, and other workloads may require dedicated environments. The point is having the freedom to make that decision based on security, sovereignty, compliance, performance, and business requirements — and to change it when those requirements change. Infrastructure should follow the workload, not the vendor. For Canadian businesses, maintaining that independence isn't simply an infrastructure strategy anymore. Increasingly, it's part of protecting the business itself.”
Azemard's version of the argument adds a dimension Boxley's and Copeland's do not emphasize as directly: control is not purely a technical or operational question; it is also a legal one. Which jurisdiction's courts, regulators, and disclosure obligations apply to a given dataset depends on where it is physically hosted and who owns the infrastructure it sits on — a variable most organizations never examine until a regulator, auditor, or opposing counsel forces the question.
The CODEW Lens: Data sovereignty used to be a compliance checkbox for a narrow set of regulated industries. It is increasingly a general-purpose resilience question, because jurisdiction determines not just where data can be stored, but who can be compelled to hand it over and under what legal process.
5. The Four Dimensions of Cyber Resilience
Taken together, Boxley's, Copeland's, and Azemard's independent commentary describes the same underlying shift from four different vantage points. The CODEW framework organizes that shift into four dimensions that build on each other rather than substitute for one another.
| Security | Can the organization prevent and contain attacks? The traditional core of cybersecurity — perimeter defense, access controls, detection, and incident response. |
| Resilience | Can critical systems keep operating despite disruption? This is Boxley's territory — whether the infrastructure underneath the business can absorb a shock without the business stopping. |
| Optionality | Can workloads and data move if an environment fails? This is Copeland's territory — whether concentration has quietly removed the organization's ability to shift elsewhere. |
| Control | Does the organization know where its data resides, who controls the infrastructure, and what jurisdiction applies? This is Azemard's territory — the legal and operational layer underneath the other three. |
The sequence matters. Security without resilience just means an organization is good at stopping some attacks and unprepared for the ones that get through. Resilience without optionality means systems can keep running — right up until the single environment they depend on becomes unavailable. And optionality without control is close to theoretical: an organization cannot exercise the freedom to move a workload if it does not actually know where that workload lives or who, legally, can reach it.
The CODEW Lens: Most enterprise security programs are still built almost entirely around the first dimension. The organizations best positioned for the next decade of threats will be the ones that have started building out the other three.
6. What Enterprises Should Reassess During Cybersecurity Awareness Month
The practical value of Cybersecurity Awareness Month is not the awareness campaign itself — it is the forcing function it creates to ask questions that are easy to defer the other eleven months of the year. Based on the four-dimension framework above, five of those questions stand out as overdue for most organizations:
| 01 | Which production systems are running on infrastructure that has accumulated unexamined technical debt simply because it has not yet failed? |
| 02 | If the organization's single largest provider or platform became unavailable tomorrow, what fraction of critical operations would stop? |
| 03 | Does workload placement actually follow security, sovereignty, and performance requirements — or does it mostly follow whichever vendor relationship already exists? |
| 04 | For the organization's most sensitive datasets, is there a clear, current answer to where they are hosted, who owns that infrastructure, and which jurisdiction governs it? |
| 05 | Has the organization actually tested moving a critical workload between environments — or is portability an assumption nobody has verified? |
The CODEW Lens: None of these questions requires a large budget to answer honestly. They require an organization willing to find out it does not like the answer, before an incident forces the discovery on a worse timeline.
7. The CODEW Intelligence Takeaway
Cyber resilience has quietly expanded from a security question into an infrastructure strategy question — and most organizations' governance structures have not caught up to that shift.
Security, resilience, optionality, and control are not four competing priorities to balance against each other. They are sequential layers, each one dependent on the layer beneath it, and most enterprise security spending still concentrates almost entirely on the first. CISA's own framing this year — reduce, replace, recover — is itself an acknowledgment that prevention alone is no longer an adequate strategy for critical infrastructure.
What legacy infrastructure, provider concentration, and data sovereignty share is that none of them show up as an incident until the moment they do — and by then, the available options are whatever was already built in, not whatever would be ideal in hindsight. Cybersecurity Awareness Month is as good a forcing function as any to find that out on a calmer week than the one an actual incident provides.
Editorial Note
Cybersecurity Watch Special Report: Cyber Resilience Is Becoming an Infrastructure Strategy examines how 2026 Cybersecurity Awareness Month commentary from CISA, DH2i, and Leaseweb reflects a broader shift from threat detection toward infrastructure resilience, optionality, and control. Executive commentary is used as source material for independent CODEW analysis via the Security–Resilience–Optionality–Control framework, not reproduced as standalone promotional content.
Educational content only. Not a substitute for a formal security or compliance assessment. Analysis is based on public commentary published for Cybersecurity Awareness Month 2026, CISA public guidance, and original editorial judgment as of the article's last-updated date.
No comments:
Post a Comment