The value of
staying operational.

Insurance can transfer some financial consequences under the terms of a policy. It cannot decide which customer commitments take priority, isolate a compromised supplier connection, reconcile damaged records, or give a recovery team authority to act. Those capabilities have to exist inside the operating model and its dependencies.

The same distinction applies to prevention. Reducing the chance of compromise is valuable, but no sensible enterprise plan assumes that controls will always work. A business can also be disrupted by a supplier failure, an unsafe defensive change, or the loss of an essential platform.

Boards already make comparable judgements about liquidity, safety, and supply continuity. Cyber resilience needs the same discipline: identify what must remain possible, decide where interruption becomes unacceptable, and test whether the organisation can cope. Technology, operations, finance, legal, and communications each own part of that answer.

The investment question: if this incident happens anyway, what will the proposed improvement enable us to keep doing?

An average can make an investment case look modest while concealing outcomes the business could not comfortably absorb. KPMG’s annualised ransomware model, reproduced by Treasury, shows how far the severe end can sit above the average.

A firm should not lift £466m into its own business case without examining the assumptions. Revenue group, sector, controls, service dependencies, and recovery capability all matter. Equally, the zero midpoint is a poor reason to dismiss the risk: a distribution with many quiet years can still contain losses that alter the future of a business.

For a useful board discussion, connect a severe but plausible interruption to missed transactions, manual work, lost income, response costs, customer harm, and liquidity needs. Compare the scenario before and after the proposed improvement, show a range, and identify the assumptions that most change the answer. Modelled risk reduction and a benefit already demonstrated in an exercise are different forms of evidence.

Two organisations can suffer a similar initial compromise and experience very different disruption. One can isolate affected access, continue a minimum service, and rebuild with confidence. The other may spend crucial time locating owners, negotiating priorities, or discovering that a backup cannot restore the service customers need.

This is where resilience becomes an operating capability rather than a collection of documents. A recovery plan must work when information is incomplete and the normal collaboration platform is unavailable. Backups need an evidenced route to a clean, usable service; technical restoration alone does not prove that records are accurate or customer obligations can be met.

Investment can therefore create value by limiting spread, shortening damaging interruption, or protecting a critical commitment. The relevant evidence is what changed in the service outcome—not how many plans were written or alerts processed.

Accenture’s wider resilience study adds a growth perspective. Its severe-shock comparison comes from simulations, rather than a record of businesses making money after actual cyberattacks.

The comparison supports a strategic discussion, but it does not prove that a particular security purchase causes profit growth. Financial strength and management quality can influence both resilience scores and performance. The study also spans broader organisational capabilities, so its result cannot be assigned entirely to cyber controls.

CyberSolace’s practical reading is that investment should support the conditions for dependable growth. A modernisation programme that understands its dependencies, validates recovery, and involves security in important supplier decisions has fewer unexamined operating assumptions. That is a reason to make resilience part of transformation approval, while still requiring a specific, testable business case for each proposed improvement.

The Bank’s July 2026 Financial Stability Report identifies a potential gap between faster exploitation and the more demanding task of safe remediation. It also warns that shared suppliers can transmit disruption across firms. Its scenarios are indicative, not forecasts. Read section 3 of the report.

For leadership, the constraint may be the organisation’s capacity to act on findings. A new discovery tool does not automatically create a test environment, a maintenance window, a service owner who can accept the risk, or a supplier ready to support every customer at once. Rushed changes can themselves interrupt service.

Cloud, identity, telecommunications, and payment dependencies deserve particular scrutiny in service planning. Separate contracts do not necessarily mean independent recovery paths. Examine common infrastructure, scarce specialist support, and whether fallback arrangements rely on the same unavailable platform.

A reassuring status colour is not an explanation of what the business can withstand. Ask for named services, approved limits, exercises that tested those limits, and the action required where an assumption failed. The following scorecard is a CyberSolace working framework to adapt to your organisation, not a universal regulatory checklist.

Five moves for the next review.

• Start with one important service. Agree what must remain possible for customers and when interruption becomes unacceptable.
• Test a severe, changing scenario. Include faster exploitation, supplier failure, and an unavailable collaboration platform where relevant.
• Prove containment and clean recovery. Exercise the authority to isolate, the integrity of restored data, and the return of the whole service.
• Rehearse decisions across the business. Bring operations, finance, technology, legal, communications, and critical suppliers into the same exercise.
• Fund the next evidenced improvement. Name the failed assumption, the accountable owner, and the service outcome the work should change.

Use the CQUEST self-assessment above to structure the conversation, then challenge the evidence behind the answers. It is a starting point for review; completing it is not certification or proof that every applicable requirement has been met.