By Michael Woodbridge
Most businesses know they could suffer a cyber attack. Far fewer know what they would do at 9 am the next morning.
Once an incident is under way, the questions become very practical, very quickly. How long will we be unable to operate? What is this costing us? Which customers and suppliers are affected? What does our insurance actually cover? Do we need to notify regulators? And how much worse could this get?
These are not hypothetical questions for many businesses. Grant Thornton’s latest research among UK finance leaders found that 82% have experienced a cyber incident with a financial impact in the past two years, with an average loss of £488,000.
But the number I would be more interested in as a CFO is the one that is much harder to calculate: what would a serious breach cost my business?
That is because the true cost rarely arrives as one neat bill. It accumulates through lost trading, operational downtime, contractual penalties, legal and regulatory costs, recovery work, and disruption elsewhere in the supply chain. Some of those consequences become clear immediately. Others only emerge weeks or months later.
Understanding that exposure before an incident happens is one of the most important – and still too often overlooked – parts of cyber resilience.
Look beyond the immediate cost
The most visible costs of an incident are usually those associated with investigating the breach and restoring affected systems. Some of the largest consequences, however, can emerge elsewhere.
Operational disruption can quickly become a significant financial exposure. If critical systems are unavailable, a retailer may be unable to take payments, a manufacturer may have to halt production, or a business may be unable to meet commitments to customers.
Then there are contractual penalties, legal and regulatory costs, specialist incident response support, and losses that fall outside the organization’s insurance coverage.
Recovery can uncover further expense. A breach may expose ageing infrastructure, weaknesses in identity management, or poorly segmented networks that cannot simply be patched. What begins as an incident response exercise can become a much larger transformation programme.
There are people costs too. Major incidents can put technology, cyber, and leadership teams under intense pressure for prolonged periods, requiring additional contractors and potentially contributing to burnout and the loss of key employees.
Rather than asking simply, “How much would a cyber attack cost us?”, businesses need to understand what would stop working, for how long, and what else would be affected as a result.
Answering that question requires knowledge from across the organization.
A cyber team can identify vulnerabilities and recommend controls, but it cannot independently determine the business value of everything it protects. HR understands the sensitivity of employee information. Operations knows which processes cannot tolerate prolonged downtime. Procurement understands critical supplier dependencies. Finance can assess where disruption begins to affect cash and financial performance.
That shared ownership is particularly important given that 78% of CFOs believe ownership of key business risks is unclear across their organization.
This does not mean the CFO should become responsible for cyber security. But finance can play an important role in translating technical risks into commercial consequences and ensuring investment decisions reflect the exposure the business is actually carrying.
A request to upgrade a piece of technology can be difficult to weigh against competing demands for capital. Understanding that the investment could reduce the likelihood of a week of operational disruption creates a very different conversation.
Time matters
No organization has an unlimited cyber budget, and no combination of controls can remove risk entirely. Businesses therefore have to decide which risks to mitigate, transfer, or accept.
That makes recovery just as important as prevention.
One of the most significant variables in the cost of an incident is time: how quickly an organization detects an attacker, contains the incident, and restores critical operations.
AI makes this particularly interesting. It is giving attackers new capabilities and increasing the speed at which vulnerabilities can be identified. But organizations are also using AI to detect suspicious activity and attack patterns more quickly, helping to reduce detection and response times.
The financial case for resilience is therefore not simply about stopping an attack. It is also about limiting the damage and maintaining critical operations when something gets through.
Test the assumptions before an attacker does
The middle of an incident is a bad time to discover that the organization does not understand its dependencies.
Finance and cyber leaders should already know which systems and processes are most critical, the financial consequences of prolonged disruption, important contractual obligations, and what their cyber insurance does – and does not – cover.
Those assumptions should then be tested through realistic exercises involving the board and senior leadership.
Who can authorise critical decisions, and are we prepared to make big decisions that could impact our business? Which services need to be restored first? When do regulators, customers, or the market need to be informed? How does the leadership team communicate if normal systems are unavailable? How will we enable, and look after, our teams during an event, which puts enormous business and personal pressure on people?
Exercises often uncover surprisingly basic gaps, from unclear responsibilities to critical information being inaccessible during an outage. Finding them in a simulation is considerably cheaper than discovering them during a live incident.
Put a value on the risk, not just the technology
The answer is not to make cyber another problem that automatically lands with the CFO.
Instead, finance and cyber teams need a common language. Cyber leaders need to explain investment in terms of the business exposure it reduces. Finance leaders, meanwhile, need to understand the impacts when the organization decides a particular risk is not mitigated sufficiently.
Businesses have finite budgets and must make risk-based decisions. What matters is that those choices are conscious, evidence-based, and documented.
Three questions provide a useful starting point for finance leaders: what are our most significant cyber risks? What would their business impact be? And what are we doing to reduce that exposure?
Then comes the question that really tests resilience: if those measures failed tomorrow, how quickly could we recover, and are our teams prepared?
The organizations best prepared for a cyber incident will not be those that believe they can prevent everything. They will be those that understand the consequences when prevention fails and have prepared accordingly.
The author
Michael Woodbridge is Cyber Partner at Grant Thornton UK
