A week of relentless cyber incidents — ransomware attacks on critical infrastructure, data breaches at major firms, and disruptions to everyday services — has led security professionals to ask a sobering question: is this the new baseline? Drew Silcock’s reflection on the pattern captures the unease many feel. When one attack barely fades before another makes headlines, it is tempting to conclude that chaos has become permanent. But the data suggests something more nuanced: the frequency of high-impact incidents is rising, yet our collective response remains stuck in a reactive loop.
Why is this happening? The surface causes are familiar — ransomware-as-a-service lowering the barrier to entry, state-backed groups exploiting geopolitical tensions, and a digital infrastructure that expands faster than its defences. Yet the deeper issue is systemic. Many organisations still treat cybersecurity as a compliance checklist rather than a continuous discipline. Patch cycles lag, third-party risks are poorly understood, and incident response plans gather dust. The result is a fragile ecosystem where a single compromised credential can cascade into national disruption.
The Islamic principle of “do not harm and do not reciprocate harm” offers a constructive lens here. It places an affirmative duty on individuals and institutions to avoid causing harm through negligence. In a digital age, that duty extends to securing the systems we build and use. Foresight — tadabbur — is not just a spiritual virtue but a practical one. Preparing for the worst while hoping for the best is an act of stewardship.
What good looks like is a shift from defending perimeters to building resilience. That means threat intelligence sharing across sectors, regular red-team exercises, and investing in training for non-technical staff. It also means accepting that breaches will happen and focusing on swift containment and transparent communication. Several mid-sized firms now publish post-incident reports voluntarily — a practice that builds trust and raises the collective defence.
The new normal does not have to be permanent resignation. By embracing a culture of proactive care — and recognising that security is a shared responsibility, not just an IT problem — we can tilt the odds back in our favour. The question is whether we will learn the lesson before the next wave arrives.