The cyber headlines are loud. Here’s what the evidence says.

The NCSC describes AI helping attackers find weaknesses and scale familiar techniques. For leaders, the question is whether the organisation can recognise and contain a problem as quickly as it needs to.

The government survey measures breaches or attacks businesses identified in the previous 12 months, including phishing attempts. It is not a measure of severe disruption. Larger businesses may have both more exposure and more ways to notice an attempt.

Use the survey to understand what organisations notice. For investment decisions, ask which services the business depends on and how quickly you would learn that one had been compromised.

• NCSC Annual Review 2026 · Continuity and change
• NCSC Annual Review 2026 · AI and the cyber threat
• DSIT · Cyber Security Breaches Survey 2025/26

Jaguar Land Rover’s results put cyber-related exceptional costs at £196 million for the quarter ending 30 September 2025. The Cyber Monitoring Centre separately estimated £1.9 billion of wider UK financial impact, with a modelled range of £1.6–£2.1 billion.

The wider estimate includes effects on JLR, suppliers and downstream businesses. It depends in part on how quickly output returns. The two figures measure different things and should not be added or used to forecast the cost of an incident elsewhere.

The NCSC describes suppliers facing disrupted schedules, orders and payments. That is the wider lesson: even when your own systems are working, a dependency can interrupt your ability to deliver or get paid.

The supplier lesson runs in both directions. A partner’s outage can stop your fulfilment, and a customer’s outage can suspend demand or delay payment even when your own systems work.

• JLR · Quarterly results, 14 November 2025
• Cyber Monitoring Centre · JLR impact model, October 2025
• NCSC Annual Review 2026 · JLR case study

The NCSC describes a return to minimum viable operations: enough essential activity restored safely while the wider rebuild continues. Leadership has to decide which obligations come first and who can approve temporary ways of working.

Consider the effect on customer commitments, suppliers, staffing and cash. A technical restore can be successful while billing, delivery or customer support is still disrupted.

Agree who can open a limited service, what they need to see first and what exceptions must wait. That decision belongs with the people accountable for service, safety and customers.

• NCSC · Recovery and ongoing investigations

A control that makes intrusion less likely does a different job from a capability that spots an incident or gets a service back. Asking for evidence against each outcome can reveal a gap that a licence list does not show.

The next improvement may be to configure or manage existing tools better, agree who acts on alerts or prove that a priority service can be restored. Insurance can transfer some financial exposure; it cannot restore a service.

A renewal is an opportunity to ask for a recent example of a control working. Evidence from a rehearsed isolation or restoration can reveal whether the issue is coverage, ownership or execution.

• NCSC · Preparing for and recovering from disruptive cyber attacks