Resilience9
From signals to action.
Resilience9 brings signals, intelligence, risk, recommendations and workflow together into a connected resilience operating model.
Under active development and internal testing. Not generally available.
Enterprise resilience system
Illustrative example · synthetic data
Resilience9
- Applications
- Cloud
- Data
- People
- Processes
- Vendors
- Security
- Infrastructure
- Resilience score
- 66/ 100 3
- Open risks
- 4
- Awaiting approval
- 1
Connected layers: Applications · Cloud · Data · People · Processes · Vendors · Security · Infrastructure
01
Signal
observed
02
Risk
resolved
03
Impact
weighted
04
Recommendation
evidenced
05
Action
approved
06
Monitoring
measured
The problem
Resilience is assembled from fragments
Enterprise resilience is currently assembled from fragments. Risk registers live in spreadsheets, incident data in a service management tool, control evidence in document repositories, and business context in the heads of the people who happen to know.
Nobody can answer "how resilient are we, and where is that changing?" without a manual exercise that is out of date before it finishes.
Resilience9 is being built to make that a continuous question rather than a periodic project.
01 · Complexity
The enterprise is not a system. It is many systems that were never designed together.
Applications, cloud, data, people, processes, vendors, security and infrastructure each hold part of the picture, in a different tool, on a different cycle, owned by a different team. Nobody is negligent; the map simply does not exist in one place.
02 · Signals
Each of those systems is already telling you something.
A change rate rising. A dependency going single-sourced. A restore test that did not happen. Individually these are rows in somebody else’s report. Collected continuously, with their source and their time attached, they are the raw material of a position.
03 · Intelligence
One engine reads all of them, not nine tools reading one each.
The Resilience Intelligence Engine applies rules and analytics across every signal, resolves what each one touches, and calculates risk and impact. Building it once and sharing it between modules is what makes this a system rather than a suite.
04 · Understanding
A score you can take apart is a measurement. One you cannot is an opinion.
The Resilience Score reports a position across defined dimensions with explicit weights and thresholds, each supported by evidence, each carrying its own trend. Every figure decomposes into the signals that produced it, and the run is versioned so it can be reproduced.
05 · Decision
The hard part is not knowing. It is choosing what to do first.
Recommendations are prioritized with their rationale, their evidence, their confidence and the approvals each would require. Effort estimates are the weakest input in any prioritization, so they are shown as inputs to a leadership discussion rather than as the answer to one.
06 · Action
An approved recommendation becomes work, with the authorization recorded.
Workflow turns the decision into tasks, approvals and notifications with retries and a complete execution history. Nothing executes before its approval is recorded — which is the difference between automation an enterprise can adopt and automation it has to supervise.
07 · Resilience
The effect is measured and returns as a new signal.
That return path is the product. Most resilience tooling stops at the score and leaves the organization to work out what to do about it; the stages that change a position are the ones after that, and the loop is what makes the next measurement mean something.
Resilience Intelligence Engine
One engine reads the whole system
The engine sits beneath every module. It consumes signals from the platform and from connected systems, applies rules and analytics, resolves what each signal touches, and calculates risk and impact. Building it once and sharing it is what makes this a system rather than a suite of separate tools with a shared logo.
The network below is the model it works on. Resilience is a property of the relationships between enterprise layers, which is why a signal in one place lights several others.
The system at rest. Every layer is connected and reporting, and signals move continuously along those connections.
Illustrative states. Nothing here is live monitoring, and the platform is not connected to any customer system.
Enterprise layers
Point at a layer to light it and its dependencies. Select one to keep it lit — which is how this works on a touch screen, where there is no hover.
Resilience Score
A score you can take apart
A number on its own changes nothing. What matters is whether you can see which dimension moved, what signal moved it, and what the system thinks you should do next — with the approvals that action would need.
Resilience score
Watchimproving
+3 against the previous scoring run
Illustrative scoring model, version 0.4
The ring above is redrawn as five arcs, each the width of its weight and filled to its score. Weights total 100.
- Operational continuityweight 2578improving
inside policy. Two services moved inside their continuity objective after a configuration change.
- Third-party exposureweight 2054declining
below policy. A secondary provider was decommissioned, concentrating a tier-one dependency.
- Data and access controlsweight 2081unchanged
inside policy. Access review coverage unchanged since the previous scoring run.
- Change safetyweight 1566improving
watch. Emergency change rate fell below the configured threshold.
- Recovery readinessweight 2047declining
below policy. Two tier-one services passed their recovery test-by date.
Risk signals
Emergency change rate above threshold in one domain
Change management · 2h ago · medium
Single-supplier dependency on a tier-one service
Dependency map · 9h ago · high
Two systems past their recovery test-by date
Recovery testing · 3d ago · high
Review completion below threshold in the finance domain
Access review · 4d ago · medium
Business impact
- Customer-facing servicesHigh
Two tier-one paths affected
- Regulatory obligationsMedium
Evidence gap in one domain
- Internal operationsLow
No change since the last run
Risk trend
Twelve scoring runs. Direction is the part an executive can act on; a single composite figure is not.
Top priorities
- P1Recovery capability unproven for two tier-one servicesOperational continuity · likelihood Medium · impact High
- P1Single-supplier concentration in identity verificationThird-party exposure · likelihood Medium · impact High
- P2Access review coverage below policy in one domainData and access controls · likelihood High · impact Medium
AI recommendations
Schedule a witnessed restore test for the payments platform
REC-2041 · confidence High · approvals: Platform owner, Change advisory
Qualify a secondary identity verification provider
REC-2044 · confidence Medium · approvals: Procurement, Risk, Service owner
Open actions
- Restore test schedulingACT-3310 · Platform ownerAwaiting approval
- Secondary provider qualificationACT-3307 · ProcurementIn progress
- Access review closureACT-3291 · Domain ownerIn progress
Workflow status
WF-0871 · 3 of 6 stages complete
- Risk detected
- Analyze
- Recommend
- Approve
- Execute
- Monitor
Held at Approve. Nothing executes until both recorded approvals are in.
System health
- Signal ingestionnominal
- Scoring enginenominal
- Workflow queueprocessing
- Evidence storenominal
- AI gatewaynominal
AI assistant
Example question
What are our highest-risk areas?
Three areas sit above the escalation threshold in this example: recovery capability for two tier-one services, third-party concentration in identity verification, and access review coverage in one domain.
3 citations · confidence High · answered within the asking user’s permissions
Defined dimensions and explicit weights
Each dimension carries a weight and a threshold that are configured rather than implied, so two people reading the same score reach the same conclusion about what produced it.
Evidence under every figure
Every dimension decomposes into the signals that moved it, each with its source and its time. A score whose inputs you cannot see is an opinion with a number attached.
Versioned and reproducible
Runs are versioned, and a weighting change between runs is reported separately from a risk change — otherwise a methodology change looks exactly like an improvement.
The scoring model shown is illustrative. A formal methodology will be published when it has been through the review that a methodology has to go through; until then, describing one would be describing something that does not exist yet.
Risk intelligence
From a signal to a prioritized risk
A signal is an observation. A risk is what that observation means for something the business depends on — which requires knowing the dependency, the impact weighting and what else is already moving.
Bands, not probabilities. A percentage here would imply a calibrated model; calibration is a later step in the plan, and stating a figure before it exists is how risk tooling loses the trust of the people who have to act on it.
Why there are no percentages here
Quantified likelihood requires a calibrated model, and calibration is a later step in the development plan. Publishing a figure before the model that produces it exists is the fastest way for risk tooling to lose the trust of the people who have to act on it, so likelihood and impact are bands until they are genuinely measurements.
When predictive models do ship, their version, confidence, accuracy, calibration and drift are first-class attributes shown beside every prediction — not a footnote in a datasheet.
| Risk | Signals | Likelihood | Impact | Priority | Recommended action |
|---|---|---|---|---|---|
| Recovery capability unproven for two tier-one servicesRSK-104 · Operational continuity | Recovery testing, Change management | Medium | High | P1 | Schedule and witness a restore test for both services |
| Single-supplier concentration in identity verificationRSK-118 · Third-party exposure | Dependency map | Medium | High | P1 | Qualify a secondary provider and define a failover path |
| Access review coverage below policy in one domainRSK-122 · Data and access controls | Access review | High | Medium | P2 | Close the outstanding reviews and re-baseline the schedule |
| Capacity headroom narrowing in one cloud regionRSK-131 · Infrastructure | Cloud platform | Low | Medium | P3 | Review the scaling policy ahead of the next demand cycle |
AI
Governed, cited, and inside the user’s permissions
Executives and operators ask questions in natural language. What matters is not that the system answers, but that the answer cites its evidence, states its confidence, admits what it does not know, and cannot reach anything the person asking could not open themselves.
Resilience9 assistant
Illustrative example · synthetic data
What are our highest-risk areas?
Three areas sit above the escalation threshold in this example dataset: recovery capability for two tier-one services whose restore has not been exercised this cycle, third-party concentration in identity verification following a provider decommission, and access review coverage in the finance domain.
Evidence cited
- Recovery register — two tier-one services with no recorded restore this cycle
- Supplier register — single-source dependency on a tier-one path
- Access review register — completion below threshold in one domain
Confidence
High
Stated uncertainty
Confidence is high on the first two because they derive from recorded facts. The third depends on the review register being current, which the platform cannot itself verify.
Answered within the asking user’s permissions. Retrieval evaluates entitlement before content reaches the model — never after.
Example questions
Five prepared questions. There is no model behind this demonstration and no text input, because an input would imply one.
Permission-aware retrieval
This is the single most important thing to say to an enterprise security reviewer, and most AI platform marketing does not say it. A user must never be able to obtain through AI something they could not access directly.
01
User permission
The requesting user’s entitlements are resolved first, from the same identity source that governs direct access.
02
Data access
The set of records and documents that user may see is established before any query runs.
03
Retrieval
Search and vector retrieval run INSIDE that set. Content the user cannot access is never a candidate.
04
AI
The model receives only retrieved content the user was already entitled to read.
05
Response
The answer cites the documents it used, each of which the user can open directly.
The principle
A user must never be able to obtain through the assistant something they could not access directly. Entitlement is evaluated during retrieval, so restricted content is never a candidate for the answer.
What it is not
Filtering the model’s output afterwards is not equivalent and should not be accepted as such. By that point the content has already entered the context, and the control you are relying on is the model’s cooperation.
AI Gateway
A model abstraction across providers with routing, fallback, prompt versioning, cost tracking, safety controls and evaluation — so the platform is not coupled to one model provider and AI behavior can be versioned and tested like any other dependency.
Enterprise knowledge
Document ingestion, parsing, chunking and embedding, with access metadata attached at index time and freshness tracked, so a citation points at something a reader can open and date.
Evaluation before release
Each AI capability ships with an evaluation dataset and safety monitoring. An assistant that has not been evaluated against known-good answers is a demonstration, not a feature.
AI recommendations
Every recommendation carries its own justification
A recommendation you cannot trace is one you cannot defend in an audit. Each one shows what it is, why it was made, the evidence behind it, how confident the system is, what it expects to change, and who has to approve it.
Example recommendations
Schedule a witnessed restore test for the payments platform
- Why
- The service is past its recovery test-by date and carries the highest impact weighting in the configured model. It is fully within your control and can be closed within weeks, which is why it sequences first.
- Evidence
- Recovery register: no recorded restore for this service in the current cycle
- Scoring model: recovery readiness weighted at 20 of 100
- Change register: no dependency freeze scheduled in the proposed window
- Confidence
- High
- Approval required
- Platform owner, Change advisory
- Expected outcome
- Recovery readiness returns inside policy, and the dimension stops suppressing the composite.Stated directionally. No quantified benefit is claimed anywhere in this product, because none has been measured.
- Addresses
- RSK-104 — Recovery capability unproven for two tier-one services
Workflow automation
An approved recommendation becomes work
Triggers, conditions, approvals, tasks, notifications, retries and a complete execution history. The approval gate is the part that makes this adoptable: nothing executes until the authorization is recorded.
Workflow WF-0871
Illustrative example · synthetic data
Trigger: Recovery test-by date exceeded — two tier-one services
- Risk detected
Signal received from the recovery register and matched to an open scoring dimension.
Owner: Intelligence engine · +00:00
Complete
- Analyze
Impact weighting applied, affected dependencies resolved, prior comparable actions retrieved.
Owner: Intelligence engine · +00:04
Complete
- Recommend
Recommendation REC-2041 produced with rationale, evidence, confidence and required approvals.
Owner: Recommendation engine · +00:11
Complete
- Approve
Routed to the platform owner and change advisory. No action executes before both approvals are recorded.
Owner: Platform owner · +02:38
Awaiting approval
- Execute
Tasks raised in the owning team’s system of record, with retries and a complete execution history.
Owner: Service operations · pending approval
Not started
- Monitor
The result is measured and returned as a new signal, which is what closes the loop.
Owner: Intelligence engine · pending execution
Not started
Technical evaluation
How it is built, and where it is
The architecture, the connector categories, the security and observability design, and an honest roadmap with build states — set out in full on their own page.
Plainly
What on this page is a demonstration
This interface is a demonstration built from synthetic figures. It is not connected to any system, no customer data appears in it, and no measurement shown here has been taken.
What is real is everything structural: the architecture, the capability areas and their build states, the security and governance design, the technical foundation and the roadmap. What is illustrative is every figure — each score, signal, risk, recommendation, workflow trace and telemetry line — and each of those sits inside a frame that says so.
No customer is named anywhere on this site, no outcome is quantified, and no certification is claimed. Those come after they have been earned and verified, not before.
Questions
Frequently asked
- Is Resilience9 generally available?
- No. Resilience9 is in active development and moving towards a design partner pilot. It has not reached general availability, and no claims are made about customer adoption, measured outcomes or certification. The development stage is stated on the product page and updated as it changes.
- What does permission-aware AI mean in practice?
- It means the retrieval layer evaluates the requesting user's entitlements against document-level metadata before any content is passed to a model. Filtering a model's output afterwards is not equivalent, because the content has already entered the context. The governing principle is that a user must never be able to obtain through AI something they could not access directly.
- How is a Resilience Score calculated?
- From defined dimensions with explicit weights and thresholds, each supported by evidence drawn from platform data and connected systems. Scores carry a version, a trend history and an explanation of what drove the result. A score that cannot be reproduced or explained is not a measurement, so reproducibility is a design requirement rather than a feature.
- What is a design partner program?
- An arrangement where a small number of organizations use the product at an early stage and shape its direction, in exchange for close access to the team and influence over the roadmap. It is appropriate where the product is genuinely useful but not yet complete, and it depends on both sides being explicit about that.
Services that implement and operate it
Data, Analytics & AI
Turn fragmented data into trusted decisions and intelligent action.
Intelligent Automation
Redesign work across people, systems, robots and AI agents.
Cloud & Infrastructure
Create a secure, scalable cloud foundation for continuous change.
Cybersecurity & Resilience
Protect the platforms, data and operations your business depends on.
Managed Services & Support
Keep digital operations reliable, secure and continuously improving.
See Resilience9 in action.
Explore how resilience intelligence can connect signals, decisions and action across the enterprise. We are talking to organizations that would use the platform at an early stage and influence where it goes.