A minimum viable company is the smallest practical combination of people, processes, and technology needed to keep critical operations running during disruption. It is a resilience concept, not a business plan: the goal is to identify the core functions that must survive even if major systems, sites, or vendors are unavailable.
In cyber security, this matters because attackers often disrupt more than one layer at once. Ransomware, identity compromise, data tampering, or AI workflow abuse can force an organisation to operate with reduced tools and higher uncertainty. Planning for a minimum viable company helps defenders decide what must be restored first, which manual workarounds are acceptable, and where strict trust checks are required. It is especially useful in recovery exercises, where teams test whether critical services can continue with clean data, verified models, fallback access, and limited staff. The concept turns resilience into a concrete target: keep the business safe enough to operate, then rebuild the rest.