Game of Thrones, NIS2 and the illusion of absolute security.
Spoilers for season 7 of the television series. The illustrations are original, not frames from the show.
The wall at the end of the world
The North. The cold. A stretch of snow where even sound seems frozen. At the edge of the landscape stands the Wall: so enormous that its defenders appear insignificant.
On its towers, the Night's Watch studies the horizon. Farther south, the powerful mostly study one another. Alliances must be broken, land conquered and a crown protected. The end of the world is distant. Distant problems can wait.
The Wall is still standing. It divides the known world from what nobody wants to know. Looking at it is enough to feel on the safe side of danger. But reassurance is not a property of ice. It is something people attribute to it.
The structure becomes a silent promise: whatever moves beyond the border, someone else will handle it. That promise makes it comfortable to govern without asking what that comfort costs.
Then comes the question every fortification should keep alive: what happens when the defence on which you built your security stops existing?
Act I — The Wall is not a strategy
The Wall is not useless. It is extraordinary: a boundary, an observation point and a defensive advantage. The mistake is treating it as a sufficient answer to every question.
Visible defences are easy to love. You can point to them on a map and measure their height. Asking whether the sentries have enough people, information and support is less spectacular.
A fortress also depends on supplies, communication, maintenance and people who can interpret an alarm. Those dependencies can weaken while its stones still look perfect. Fragility does not always leave a photogenic crack.
In the season 7 finale, the Night King attacks near Eastwatch with the resurrected Viserion. Blue fire brings down a section of the Wall. The army of the dead crosses the breach. Not every metre disappears; the assumption that it is impassable does.
The threat has not respected the form its defenders expected. A control designed around one threat can lose effectiveness when an adversary's capabilities change. Continuing to stare at the wall does not update the world in front of it.
In cybersecurity, risk assessment challenges assumptions: which services do we protect, what do they depend on, what vulnerabilities remain, and what happens when a control fails? Layered defences can limit propagation, but do not guarantee invulnerability.
For entities within its scope, NIS2 Article 21 requires appropriate and proportionate technical, operational and organisational measures. Its coverage includes risk analysis, vulnerability handling and supply-chain security. It does not prescribe one universal perimeter architecture.
An impressive measure does not replace a risk-management process.
Act II — No one listens to the North
The next problem is not on the Wall. It is in the rooms where people decide whether events on the Wall deserve attention.
Imagine a warning travelling through snow, past tired horses, into a warm hall. Before becoming a decision, it must cross a terrain more difficult than the forest: the recipients' pride.
Who sent it? Who benefits? Would admitting the threat mean cooperating with yesterday's enemy? Who would exploit a weakened southern defence? A shared danger enters the room; private interests ask it to wait outside.
Jon seeks support against the dead. Cersei sees evidence at King's Landing, promises help and later reveals that she does not intend to honour the commitment. Knowing about the danger does not erase political calculation.
This is not simply a lack of information. It is a decision to interpret information through immediate convenience. The rival beside the throne has a face and an ambition. The distant threat can wait until the next meeting.
The Watch can observe and warn. It cannot force every court to mobilise resources. Detection does not automatically provide the authority to act.
An organisational alert follows a similar route: detection, communication, escalation and decision. Without clear responsibilities, a message can circulate without becoming action. Risk governance connects those steps to people, priorities and resources.
NIS2 Article 20 addresses approval and oversight of cybersecurity risk-management measures by the management bodies of essential and important entities, alongside accountability and training within the applicable framework. Westerosi rulers are a metaphor for decision-making, not legal equivalents of management bodies.
A known risk is not automatically a managed risk. The raven has arrived. What happens after someone opens the message?
Act III — After the Wall falls
When the ice gives way, the map changes before anyone can redraw it. A boundary becomes a route. The distance that appeared to protect the continent begins to disappear.
Pause there, before the next battle. “The Wall holds” used to be a reassuring answer. It is no longer useful. Forces must be positioned, warnings delivered and usable roads identified. Surprise does not grant a pause to organise.
The useful plan B is not necessarily another identical wall. It is a network capable of moving: messengers with clear destinations, supplies with more than one route, assembly points and instructions that still work when the expected commander cannot be reached.
These are questions raised by the breach, not events I am attributing to the screenplay. A kingdom may survive losing a fortification. It is harder to survive without knowing who should do what.
Containing an attack and maintaining priority activities are related but distinct tasks. Disaster recovery concerns technological recovery. Business continuity also covers people, processes, communication and dependencies. An alternative is real when it can be used, not merely when it appears in a document.
NIS2 Article 21(2)(b) and (c) includes incident handling, business continuity, backup management, disaster recovery and crisis management. The principle is to prepare the response as well as the defence. A fantasy collapse is not a cyber incident; it makes the cost of relying on one defence visible.
Exercises can expose unreachable contacts, forgotten dependencies and incompatible priorities before a crisis. Less cinematic than a dragon, certainly. But knowing where to go can separate an organised retreat from a crowd running without direction.
When the North is no longer distant
Westeros becomes fragile before the ice falls: whenever the border becomes a reason not to listen, rivalry outranks a shared threat, or the future is entrusted to one defence remaining in place.
The Wall could buy time. It could not decide how that time should be used. That is the distance between cybersecurity made of objects and cybersecurity made of responsibilities: protect, understand, decide and prepare.
If your strongest control failed tomorrow, who would make the first three decisions? Have you tested that handover?
English adaptation of my original article on manfredimarrocco.blog. The blog remains my primary editorial source. Illustrations are reused from the original. Translation and adaptation assisted by AI.
Sources: Directive (EU) 2022/2555, Articles 20–21; Game of Thrones, season 7, episode 7, “The Dragon and the Wolf” (narrative reference: ABC News).
Top comments (0)