Building organisational resilience against threats