Cyber risk has a financial side. The numbers deserve context.

The NCSC notes that some cyber policies do not cover money lost through business email compromise. A diverted payment can start in a real supplier’s compromised mailbox, with a plausible request in an established conversation.

UK Finance recorded £41.3m in 2025 invoice-and-mandate scam losses across personal and non-personal accounts; £28m was on non-personal accounts. That tells us about payment diversion losses, not how often insurers pay out.

The policy wording and circumstances determine cover. Protecting the mailbox, verifying a change independently and checking the policy address three different parts of the risk. A convincing email is not authorisation to change payment details.

Look for how the wording treats an authorised transfer made under deception. The answer may depend on the type of loss, the applicable cover and the conditions for notifying the insurer.

• NCSC · Cyber insurance guidance
• UK Finance · Annual Fraud Report 2026

Jaguar Land Rover’s results put cyber-related exceptional costs at £196 million for the quarter ending 30 September 2025. The Cyber Monitoring Centre separately estimated £1.9 billion of wider UK financial impact, with a modelled range of £1.6–£2.1 billion.

The wider estimate includes effects on JLR, suppliers and downstream businesses. It depends in part on how quickly output returns. The two figures measure different things and should not be added or used to forecast the cost of an incident elsewhere.

The NCSC describes suppliers facing disrupted schedules, orders and payments. That is the wider lesson: even when your own systems are working, a dependency can interrupt your ability to deliver or get paid.

Track reported incident costs, lost trade and cash timing separately. Each answers a different question about what the business needs to fund or protect.

• JLR · Quarterly results, 14 November 2025
• Cyber Monitoring Centre · JLR impact model, October 2025
• NCSC Annual Review 2026 · JLR case study

As services return in stages, a technically available system may still be unable to issue accurate invoices or support delivery. Finance needs to understand when receipts can resume, which costs will continue and which additional costs are specific to recovery.

The NCSC recommends tracking the incident’s costs and comparing recovery options. Update the cash-flow forecast as services come back and estimates of what can be billed, when payments will arrive and what recovery will cost become firmer.

A delayed receipt can put pressure on cash without becoming permanently lost revenue. Separating that timing effect from lost trade and extra spending makes it easier to assess what a recovery investment would protect.

Tie each cash forecast assumption to a recovery milestone. The receipt may depend on a customer accepting work and billing being reconciled, even after the accounting system returns.

• NCSC · Recovery and ongoing investigations

Account protection reduces the chance of compromise. Monitoring and response help shorten the time an attacker has to operate. Recovery capability reduces the disruption that follows when prevention fails.

Look at the gap between those outcomes and what current controls deliver. Better configuration or a tested recovery path may do more for the business than another line on the licence list.

Ask what changes if a proposed control is funded. A tested restoration may reduce interruption, while verified payment changes address an entirely different exposure.

• NCSC · Preparing for and recovering from disruptive cyber attacks