If your cyber risk management efforts remove key human elements from the “machine,” you might accomplish compliance but not resilience.