Know Your Network
Real network resilience and NIS2 compliance both start with actually knowing your network in real time, not scrambling to map it after something breaks.
When major breaches hit well known European companies like Booking.com recently, the headlines focused on the moment of entry. However, the harder question lives one layer deeper: once an attacker is inside, how much can the network itself limit what they do next?
The Quality That Sets Good Incident Response Apart
At Connect4Cyber in Stockholm last week, this came up repeatedly. The organisations handling incidents well share one quality.
They know their network.
They have a live picture of what exists, how it is connected and what changed recently. That clarity is genuinely hard to maintain.
Three Things That Build Network Resilience
Building NetSymphony has taught us that network resilience comes from three things working together: a reliable source of truth so operators understand impact immediately, automated lifecycle management because drift and human error cause more outages than sophisticated attacks, and integrated visibility so troubleshooting does not require stitching together five fragmented systems under pressure.
Why NIS2 Changes the Equation
This is where NIS2 lands differently from previous regulations, which I find very interesting. It asks whether you can demonstrate that your controls are actually working and can be traced back to real assets all in real time. The 24 to 72 hour reporting window is the part most organisations underestimate as that timeline assumes you already know what you have. Most do not.
A Governance Posture, Not a Once a Year Audit
What the regulation is really encoding is a governance posture. Resilient network infrastructure as something you are continuously accountable for, not something you hand off to a team and audit once a year. Managing directors and board members can be held personally liable if they cannot demonstrate that adequate network controls were in place. The organisations that will handle this well have already started treating their network as a managed, documented asset. The ones that have not are about to find out what that gap costs.
Network resilience, in the end, is about knowing your network well enough to trust it when things go wrong.