Quantitative Validation of Domain-Attributed Cyber Resilience Trajectories for Safety-Critical Systems

Cyber resilience in safety-critical systems is widely discussed, yet the structural relationships between resilience attributes remain weakly defined and rarely measured in practice. Controls are often implemented as isolated improvements, despite the possibility that strengthening one aspect of performance may leave weakness elsewhere unresolved or introduce new fragilities across the wider system. This paper presents empirical quantitative evidence from two industrial case studies and controlled experimentation on a safety-critical industrial testbed to examine how distinct resilience domains and attributes influence system behaviour during disturbance. Results show that engineering resistance capacity (engineering resilience) primarily governs degradation magnitude, organisational recovery and adaptive capacity (ecological resilience) govern detection latency and recovery duration, and safety operates as a continuous constraint boundary throughout disturbance and recovery rather than as a threshold event triggered only at extremis. Quantitative measurements across adversarial and non-adversarial disruption scenarios demonstrate, within the limits of the experimental setting, that these domains are causally distinct in effect and non-substitutable in outcome: improvements in one phase do not compensate for weakness in another. The findings support a refined five-domain hierarchical taxonomy of resilience attributes and provide empirical grounding for assessing resilience as the measurable trajectory of system performance in safety-critical, cyber-physical environments. Getting resilience right is how we protect not only the systems we depend on today but the people who will depend on them tomorrow.