Cyber-attacks are still hitting businesses, despite increasing awareness following high-profile incidents such as the Jaguar Land Rover (JLR) and Marks and Spencer (M&S) breaches. According to the UK government’s Cyber Security Breaches Survey, four in 10 businesses (43%) and three in ten charities (28%) fell victim to attacks in 2025.
The problem has not improved over the last year, with cybersecurity minister Liz Lloyd issuing a warning that business leaders must take action now to ensure robust security.
Regulations such as the incoming UK Cyber Security and Resilience Bill mandate that resilience is baked into organizations and their supply chains. How can firms boost cyber resilience as the risk of attack surges?
Resilience gaps
The price of failing to be resilient is already clear. The JLR attack cost the business and its partners up to £1.9 billion, while it’s estimated the M&S breach cost the company over £100 million.
These headlines are difficult to ignore. Yet despite growing awareness of cyber risk following the incidents, many organizations are still struggling to translate awareness into “meaningful resilience improvements”, says Chris Brown, SVP UK market leader at NCC Group.
This is partly due to over-confidence in cybersecurity, which is leading businesses into “an under-preparation trap”, according to Brown.
“The growing interconnectedness of digital systems and third-party suppliers means leaders face an increasingly complex landscape of vulnerabilities and cyber risks, often without clear visibility of where their greatest exposures lie – or how to begin addressing them.”
The Cyber Security Breaches Survey also identified persistent resilience gaps linked to the rapid adoption of AI without adequate governance or security controls.
“While board-level engagement with cyber risk is increasing, stronger operational action remains essential,” says Brown.
Pace of change
Technology such as AI does have the potential to help boost productivity and improve security, but the pressure to adopt it quickly can lead firms to take unnecessary risks. The pace of change is one of the biggest challenges facing businesses, according to Rob O’Connor, chief information security Officer, EMEA at Insight.
“Organizations are under pressure to adopt technologies such as AI to improve efficiency, reduce costs and create new ways of working, but every new capability introduces new risks too,” he says.
The challenge, O’Connor adds, is implementing change securely, and doing so at a pace that keeps up with the wider business.
Company culture is another problem. One of the biggest barriers is that many firms still treat cybersecurity as a “specialist technical function” rather than a “core business resilience issue”, says Scott Beange, head of cyber strategy at Projective Group.
“Boards often receive large volumes of cyber reporting and compliance metrics, but relatively little clarity around operational survivability, recovery capability or dependency risk.”
The issue is made worse by a growing disconnect between modern digital ecosystems and traditional governance approaches, according to Beange. “Organizations are now heavily reliant on cloud providers, Software as a Service (SaaS) platforms, managed services and interconnected supply chains. In many cases, firms no longer fully understand where their operational dependencies sit until disruption occurs.”
At the same time, attackers are increasingly targeting the areas organizations struggle to rehearse properly: Recovery processes and operational coordination under stress, says Beange. “Too many businesses still test intrusion prevention far more rigorously than degraded operations or prolonged recovery conditions.”
Regulation resilience
It comes at a time when regulations such as the European Union’s Digital Operational Resilience Act (DORA) and the UK’s Cyber Security and Resilience legislation are mandating resilience across the board.
At the EU level, a proposed update to the EU Cybersecurity Act seeks to address fragmentation in requirements under the Network and Information Systems 2 Directive (NIS2) and EU-wide certification schemes.
“But even with a more coherent framework including outcome-focused minimum standards and technical criteria, global organizations must still navigate evolving regulatory expectations across multiple jurisdictions,” Brown warns.
AI adoption is also mandating resilience, Brown points out. However, rather than introducing entirely new legislation to ensure secure and responsible AI adoption, states are weaving it into existing sector regulation, he says. He cites the example of the UK’s Online Safety Act, which is being amended to close loopholes for chatbot providers.
Steps to boost resilience
With so many factors at play, it might seem complex, but there are a number of steps businesses can take to boost resilience now.
A “small set of controls taken together” will “eliminate the majority of preventable incidents”, according to Kevin Curran, senior IEEE member and professor of cybersecurity at Ulster University.
The starting point is Cyber Essentials Plus, he says. “It is not glamorous, but it forces patching discipline, multi-factor authentication (MFA), access control and boundary firewalling, and it is already a precondition for many public sector contracts, so the cost is recoverable.”
From there, the “single highest-value technical investment” is phishing-resistant MFA such as hardware security keys or platform passkeys on every privileged account, he says.
Beyond identity, firms should segment their networks, particularly between IT and operational technology environments, says Curran. “A compromised office laptop should never be able to reach a production line controller, and yet in many manufacturing firms it still can.”
Alongside segmentation sits the discipline of tested backups, Curran adds. He advocates the 3-2-1 rule, “with at least one copy offline or immutable, and a restore rehearsed at least quarterly”.
Beange recommends making an effort to understand critical business services and the dependencies that underpin them. “Firms should be regularly testing how they would operate under degraded conditions as rigorously as whether their security controls detect attacks.”
Boards should also demand clearer reporting focused on operational impact and decision-making rather than excessive technical detail, says Beange. Questions such as, “how long could we operate without this supplier?”, or “what happens if identity systems fail for 48 hours?” are often more valuable than “another dashboard full of vulnerability statistics”, he advises.
O’Connor concurs that cyber resilience starts with understanding what matters most to your business, saying “Organizations should think like an attacker and ask: What are the assets or operations we simply cannot afford to lose?”
For some organizations, that may be customer data, for others intellectual property, or production systems, explains O’Connor. “Once you understand what would have the biggest operational and financial impact, security priorities become much clearer.”
