Resilience over Resistance: A configurational analysis (fsQCA) of cybersecurity capabilities and Return on Assets in critical infrastructure

The convergence of Information Technology (IT) and Operational Technology (OT) has created an economic paradox where traditional cybersecurity investments often conflict with the operational mandates of industrial environments. Despite the escalating threat landscape, the link between cybersecurity maturity and firm-level economic performance remains theoretically opaque. Drawing on the Resource-Based View (RBV), this study employs fuzzy-set Qualitative Comparative Analysis (fsQCA) to examine how configurations of dynamic capabilities - Anticipate, Resist, Recover, and Evolve - drive Return on Assets (ROA) in a sample of 130 Spanish critical infrastructure operators. We operationalize cybersecurity maturity through the Cyber Resilience Improvement Indicators (CII) framework, evaluating how specific configurations of its core goals, Anticipate, Resist, Recover, and Evolve , drive Return on Assets (ROA). Crucially, the findings reveal a major theoretical paradigm shift: resilience is empirically proven to be more economically valuable than preventative resistance. The results challenge the linear defense in depth orthodoxy, identifying two equifinal pathways to economic success. The first, termed the Agile Responder, demonstrates that firms can achieve high performance with low technical resistance if they possess superior recovery and adaptive capabilities, validating a safe to fail paradigm. The second, the Stable Planner, reveals that legacy operators can remain economically viable by substituting modernization with intense anticipation and continuity planning. Ultimately, this research empirically isolates Recovery as the keystone capability for asset heavy industries, providing a strategic roadmap for Chief Information Security Officers (CISOs) to optimize resource allocation in the face of the patching paradox.