Who decides how the systems we all depend on are built, and who needs to be in that room? A panel at VERGE: Comprehensive Security on why resilience has to be designed in from the start.

Who actually decides how the systems we all depend on are built? And what kind of people, skills and perspectives need to be in that room?

That was the question behind Resilience by Design, moderated by Elin Eriksson, co-founder of Women in Tech Sweden. On stage she had three very different vantage points: Caroline Forssblad, with more than 20 years of advising CEOs and CISOs on security leadership; Marcus Hultkvist, who builds on-premise AI infrastructure; and Pamela Morris Williams, who runs security and compliance in one of the most regulated and targeted industries there is.

They didn’t agree on every detail. They agreed on the thing Elin used to close the session: resilience isn’t something you bolt on afterwards. You design it in from the start.

Security teams are stuck putting out fires

What breaks first under pressure, the systems or the people? Often both, according to Caroline. And the reason is how security work is organised.

Too many security teams are firefighters rather than fire architects. They are brought in late, bypassed in early decisions and then asked to put out fires that could have been designed away. Trying to catch up while the fire spreads is exhausting.

The human cost is real. Security leaders are often stressed, drained and unseen, because when the work is done perfectly, nothing happens and nobody notices.

Caroline’s advice to security people is to do the inner work. Many people in security like to be in control. But you can’t control everything, and you can’t carry the world on your shoulders. Sometimes the right move is to hand over the risk.

Security and business should dance, not fight

Caroline’s image for the relationship between security and the rest of the organisation was a tango, not a battle.

The business wants to move forward and grow. Security wants to stay safe. If the security function has no passion for the strategy, it turns into a fight. If it understands the vision, the strategy and where the money comes from, the two can move together.

That takes security people who can talk business, not just speak security.

Regulation can’t keep pace with the threat

Pamela works with security and compliance in gaming and betting, an environment that is both heavily regulated and constantly targeted. Her lesson for other industries: regulators increasingly try to micromanage something that changes faster than any law can.

Changing a regulation can take three years. The threat won’t wait that long.

Her answer isn’t to complain but to find allies. Silos make everyone more vulnerable. Some of her most useful insights on compliance and information security have come from conversations with people in completely different industries.

She also described the complexity of operating across many markets at once, where each market may need its own solution.

Simplicity is resilience

Marcus advocates owning your own AI infrastructure. His two principles for resilience were simple:

• Know your dependencies. If you don’t control where your data goes, you’re not in control. Avoid external dependencies you can’t see into.
• Keep it simple. Processes should never depend on special know-how. Everything should be documented and easy enough for anyone to follow. If the power goes out, you need a backup supply. If one component fails, another should take over.

He also raised a point many in the room hadn’t considered. Under new EU regulation, CEOs and board members can be held personally liable for security failures. Awareness of this, he said, is still low.

The team you need

All three panellists described the same need: a mix.

• Technical depth. People who can go all the way down into the code.
• Translators. People who can walk into the boardroom and explain why something needs investment, or why something can’t be done.
• Diversity. Different perspectives, including someone who looks ahead at innovation and business development, not only at the next regulation.
• Honesty. Pamela’s addition: look at what the company actually needs and build from there. Expertise has lost some of its magic, and it needs to come back.

There is good news too. Security has become something people want to talk about. Ten years ago, saying you worked in information security ended conversations. Today it starts them.

The talent gap starts at the door

The panel was frank about who gets into the room. Marcus, who teaches junior security talent every year, said the industry still isn’t welcoming enough to women, even though many of his strongest students are women. He also pointed out that few Swedish security companies run academy or trainee programmes, so juniors rarely get their first chance.

Caroline added that role models need to tell the true story. Not just the title, but the journey, including the hard parts. Mentorship and networks work like a sisterhood that makes the first step easier.

What to do on Monday

• Map who in your security team can go deep technically and who can speak to the board. Fill the gap.
• Bring security in at the design stage of your next project, not at launch.
• List your external dependencies and where your data actually goes.
• Check that your critical processes can be run by someone without special know-how.
• Make sure your board understands its own liability.
• Open at least one junior or trainee role in security.

About the panel

• Elin Eriksson (moderator) is co-founder of Women in Tech Sweden.
• Caroline Forssblad has more than 20 years of experience in security leadership and works as an author and advisor to CEOs, CIOs and CISOs.
• Marcus Hultkvist builds on-premise AI infrastructure and teaches junior security talent.
• Pamela Morris Williams works with security and compliance in the gaming and betting industry.

This article is part of VERGE Pulse, a series of insights from VERGE: Comprehensive Security at Epicenter Stockholm on 19 October 2026. VERGE is Epicenter’s flagship event series, bringing founders, leaders, investors and experts into one room to explore the questions that will shape the next decade.

Want to talk about resilience in your own organisation, or shape the next VERGE with us? Get in touch with the Epicenter team.