Digital resilience has become a boardroom issue, according to Knowit's new trend report. But the step from strategy to actual capability remains a long one. Nordic Defence Sector has spoken to Micael Bydén, former Supreme Commander of the Swedish Armed Forces and now an adviser to Knowit's management, about what is required for an organisation to withstand a real crisis, and why Sweden needs to build its own capacity to act independently.
Knowit's trend report, a survey conducted by Verian, paints a picture of a Sweden that has woken up. In the public sector, 92 percent say digital resilience is a high priority for management, compared with 53 percent in the private sector. Almost everyone views the issue as strategic. At the same time, only 57 percent in the public sector and 45 percent in the private sector feel fairly or very confident in their ability to handle a major digital crisis.
It is this gap, between awareness and confidence, that catches Micael Bydén's attention.
"Many organisations have strategies and policies in place, but still feel uncertain about how they would actually act when a major disruption occurs," Knowit notes in its trend report. The report defines digital resilience as the ability to prevent, detect and continue delivering critical services despite digital disruptions, and to recover quickly afterwards.
That the public sector rates itself higher does not surprise Bydén. The sector has been under pressure on these issues, he argues, pointing to wake-up calls such as the Swedish Transport Agency data breach, where it became clear that the agency did not have control over its information.
Exercise, exercise, exercise
The question Bydén keeps returning to is how plans and presentations turn into actual capability. The answer, he says, comes from the world he himself hails from.
"We are world champions at exercising," says Micael Bydén. "It's about testing, putting yourself in situations where you're under pressure, and then you see which systems you have and test them."
This is also where he sees one of the report's clearest gaps. Only 49 percent in the public sector and 28 percent in the private sector work continuously and systematically on training and exercises linked to digital incidents. Exercise activity, he says, is probably one of the answers to how organisations take the next step.
Responsibility for making this happen ultimately rests with management. Bydén describes a chain running from the government down through the agencies, with experts at the far end monitoring logs and firewalls, but in the end it comes back to leadership.
"It's like an accident investigation," he says. "There are safety nets along the way, and there are holes in the nets. Sometimes the holes line up, and then things can slip through in several places. The key is to have as fine-meshed a net as possible, with expertise at different levels."
Being an expert in every single system as a manager is impossible, and that is not the point either.
"You need self-awareness of your own weaknesses; you must not turn a blind eye to the problem but recognise that there are shortcomings within your own organisation," says Bydén. "See the problems as the tool and the opportunity to improve."
"Politics has done its part"
Bydén is careful to shift responsibility from documents to action. When he speaks publicly, he now states plainly that the governance framework is already in place.
"I think politics has done its part. No further governance is needed," he says, referring to the 2024 Total Defence Bill. "If everyone adheres to it, we have a fantastic opportunity."
The problem is that too many wait and hide behind a lack of resources or regulatory constraints. His call to action is brief.
"Go home and do the job. As long as we don't break the law or regulations, we have the baseline in place. Everything beyond that, working methods and processes designed for a different era, is what we need to challenge right now to gain momentum."
He also calls for good examples to be highlighted, a procurement process that took months instead of years, an agreement that allows an agency to move forward, so that others can follow suit.
Capacity to act within one's own country
The report shows that supplier dependencies are a source of concern. In the private sector, 34 percent answer "don't know" when asked how robust their own suppliers are. Bydén broadens the question to the national level. He speaks of the few major cloud providers, based in a large country to the west, and of the need to be able to stand on one's own feet when it comes to matters that are critical to society.
"We shouldn't aim to be fully independent; dependencies will always exist, and not everything needs to be Swedish," he says. "But reducing dependency and creating a capacity to act that we ourselves own within the country, that I believe is extremely important."
He draws strength from history. During the post-war period, Sweden built not only a welfare state but also a defence industrial base far beyond what a country of our size could normally sustain, driven by a clear vision.
"There is no country in the Western world with ten million inhabitants that has such fantastic conditions as we do to build this kind of independence," says Bydén. "But it will require tough political decisions, and it will cost a great deal of money."
Not everything needs to be done domestically. Certain complex weapons systems exist within NATO (North Atlantic Treaty Organization), and Sweden does not need to develop them alone. But functions critical to society, such as communications and healthcare, simply cannot be allowed to stop working. For Bydén, the consequence of failing to make these choices is the ultimate concern.
"The risk is that it takes too long, that we suffer more, that in the worst case more people die because we weren't ready in time," he says. "You have to start with the worst-case scenario, with war, and then work backwards to make sure everything is in place."
Back to cooperation
This is also where the role of industry and consultants comes in, and with it companies such as Knowit. Bydén's advice to those who want to contribute is concrete.
"Leave the polished PowerPoint slides at home," he says. "Seek out your counterparts in the public sector and say: this is what we can do, we are ready to solve your problem. Do it with the mindset that we're here to make the country better, not just to sell something."
What he wants to see is a return to close cooperation between academia, the public sector and industry. And he reminds us that technology is only half the picture: competence and culture, as the report points out, weigh just as heavily as the systems themselves.
The interview with Micael Bydén is sponsored by Knowit. If you would like to read the company's trend report in full, you can do so here.