In September last year, the European Commission unveiled its latest strategic foresight report with a title dripping ambition: Resilience 2.0: Empowering the EU to thrive amid turbulence and uncertainty. The phrasing matters. States are no longer talking about bouncing back from shocks. They are talking about reshaping systems before the next crisis hits. The UK’s own Government Resilience Framework meanwhile describes resilience as proactive, anticipatory, and structural. America’s National Resilience Strategy, published in January 2025, positions it as foundational capacity-building.
What the three documents have in common is that they read more like investment plans than disaster-readiness briefs. Corporate language, by contrast, remains stuck in defensive mode. Flip through any business continuity report and the vocabulary stays predictably tactical: buffers, contingencies, vendor risk assessments, dual suppliers, extra inventory. The Business Continuity Institute’s 2025 survey found that 95 per cent of organisations are moving toward ‘incident-agnostic’ planning—which sounds forward-thinking until you realise it means preparing for effects rather than rethinking causes. The state has moved on. Business has not.
What governments now mean by resilience has little to do with weathering storms. The World Economic Forum’s Resilience Consortium white paper, published this month, frames resilience as “investing, innovating and growing, even when outlooks are uncertain”. The European Commission’s eight priority areas include amplified security, harnessing technology, strengthening economic resilience to “absorb shocks and sustain growth”, and reimagining education systems. Nowhere does it suggest holding more cash or diversifying suppliers. The new doctrine treats resilience as a precondition for competitiveness, not a cost of doing business.
Where’s the private money?
Corporates still think in insurance terms. Protect margins, smooth volatility, wait it out. Tactical moves dominate: dual-source critical components, maintain higher working capital, invest in scenario-planning workshops. All sensible. None transformative. The BCI found that 45.5 per cent of organisations now distinguish business continuity from resilience as ‘separate functions’. But separate does not mean strategic—it often just means one more governance committee with its own dashboards.
McKinsey’s research shows that whilst climate resilience technologies could represent addressable markets worth 600 billion US dollars to one trillion US dollars by 2030, private capital accounts for just 11 per cent of total resilience investment. The rest comes from development banks and public institutions.
In short, it looks increasingly as though businesses are happy to outsource strategic resilience to the state. They assume regulation will stabilise markets, subsidies will absorb risk, policy will buy time. This creates strategic passivity disguised as prudence. Companies build out compliance functions whilst governments rewire entire systems. You cannot outsource resilience to regulation without surrendering competitiveness. The World Resources Institute calculates that every dollar invested in adaptation yields over ten dollars in long-term benefits through avoided losses and economic gains.
Yet adaptation bonds surged in 2024, with corporates representing 54 per cent of issuers for the first time—driven not by vision but by mounting costs after natural disasters triggered over 100 billion US dollars in insured losses in the first half of 2025 alone.
Policy is accelerating whilst corporate adaptation lags
The real test of resilience is capital allocation. Does it change where money flows? If resilience lives in a risk function rather than shaping capex decisions, it is narrative. Real resilience appears in portfolio exits, reinvestment in capabilities over cushions, operational models redesigned around optionality rather than efficiency. Miami offers an instructive case: the city issued a 400 million US dollars ‘forever bond’ specifically for resilience projects, appointed the world’s first chief heat officer, and saw its S&P rating upgraded from AA- to AA in 2023.
Capital reallocation produced competitive advantage. Randstad research reveals the problem: companies are “funding their comfort zones” rather than high-impact levers, with 60 per cent feeling prepared to adjust hiring strategies but only 51 per cent ready to shift compensation models—despite the latter scoring as the highest-impact driver for resilience.
The gap is dangerous now because policy is accelerating whilst corporate adaptation lags. States are building future-facing systems. Firms risk being locked into obsolete ones. The mismatch will surface through distorted incentives, stranded assets, sudden competitiveness cliffs.
The European Commission’s framework anticipates this explicitly, positioning resilience as competitive differentiation in what it calls an ‘Intelligent Age’. Its eight priority areas read less like risk mitigation and more like an industrial strategy for the 2030s. Companies assuming governments will smooth the transition are deluding themselves. Policy creates the terrain; it does not flatten it.
Reinvention before protection
What ‘something harder’ looks like is treating resilience as an operating condition, not a risk function. Rewire decision rights, not just contingency plans. Accept near-term inefficiency in exchange for long-term optionality. The WEF’s findings are damning: only one in four companies feels equipped to manage disruptions across key resilience dimensions, despite 270 executives acknowledging its importance to competitiveness.
That 75 per cent preparedness gap cannot be closed with vendor risk committees. It requires reinvention before protection—portfolio restructuring, operational model rewrites, capital redirected toward capabilities that compound through volatility rather than merely survive it.
Governments are preparing for structural disruption. Many companies are hoping it passes. In the next cycle of shocks, resilience will not be judged by survival but by who was already elsewhere. The doctrine has been upgraded. The question is whether business can afford to stay a version behind.
Photo: Dreamstime.
