If one critical system stopped tomorrow, what would it cost your business?

Restored IT is not always restored trading.

Consider one ordinary customer order. Before you can invoice for it, you may need working access to the order system, stock records, label or picking process, network connection, supplier feed and a person authorised to release the goods.

A backup can be healthy while one of those other links is unavailable. An incident at a supplier can leave your own systems untouched and still stop a customer order.

The question is not simply, "Do we have backups?" It is, "Can we complete the process that makes the business money?"

These are evidence-backed cases, not predictions of what a cyberattack would cost your business. Different companies, different circumstances. Each illustrates a decision worth making before disruption.

JLR: reported cyber costs and disrupted manufacturing

£196m in JLR's disclosed cyber-related costs, in the quarter to 30 September 2025. JLR reported a production shutdown and a phased restart. The £196m is a specific company-reported cost line, not the complete economy-wide loss.

Why it matters: Production stoppages create costs beyond repairing a system. Goods, labour, suppliers, customer orders and recovery all become connected commercial issues.

Question to take away: Which business process generates the greatest financial exposure if unavailable for 24 to 72 hours?

Source: JLR corporate results, 14 November 2025

JLR's wider supply chain: losses far beyond the victim

£1.9bn in modelled UK-wide economic losses across more than 5,000 organisations, according to the Cyber Monitoring Centre. The £1.9bn includes JLR and affected businesses; it must not be added to JLR's £196m as if they were separate categories. The CMC figure is scenario-based and sensitive to its assumptions.

Why it matters: A manufacturer can lose orders, cash headroom or production time even when it wasn't the company attacked.

Question to take away: Which customer, logistics or supplier dependency could stop us fulfilling a valuable commitment?

Source: Cyber Monitoring Centre, 22 October 2025

Carpetright: disruption added to an already difficult year

PwC's administrators said an April 2024 cyberattack left Carpetright unable to trade for a period, alongside weaker consumer demand and difficult market conditions. The company entered administration in July 2024. The attack was a contributing factor, not a proven sole cause of insolvency.

Why it matters: Even a temporary interruption can be harder to absorb when working capital, demand and margins are already under pressure.

Question to take away: How many days can we tolerate without the process that turns orders into cash?

Source: PwC administrators' statement

KNP Logistics: ransomware and a long-established British business

The UK government recorded that KNP Logistics blamed a June 2023 ransomware attack for its insolvency in September 2023, with more than 700 jobs lost. Its group included the long-established Knights of Old haulage business. The case also involved difficult trading conditions and financing pressures, so avoid simplifying it to a single guessed password or claiming that every similarly sized business faces the same outcome.

Why it matters: The commercial consequences of lost access can extend to finance, employment and business continuity, not just data recovery.

Question to take away: Which records, systems and decisions would we need in order to keep trading and maintain lender or customer confidence?

Source: UK government ransomware consultation

Additional recent case for food/cold-chain: In October 2026 attackers interfered with connected refrigeration controls at hundreds of French supermarkets, spoiling stock valued in millions of euros. The technical incident involved particular refrigeration systems, and should not be presented as a generic vulnerability in all factories. BBC coverage | French CERT-FR alert

Sector evidence, not an incident: Make UK reported in August 2026 that 31% of manufacturers affected by supplier cyberattacks reported customer delivery delays. This is a conditional statistic, not 31% of all manufacturers.

Start with one real process. Don't attempt a whole-estate risk assessment.

Choose one:

• Receive and confirm customer orders
• Plan production and release jobs
• Manage materials, stock or quality records
• Pick, label and dispatch finished goods
• Receive customer/supplier information or approvals
• Access designs, recipes or specifications needed for production

Record: Process owner | Normal daily volume | Next important customer deadline | Acceptable interruption | The first person who must know it's unavailable.

What must work for this process to complete?

Add the systems and people the selected process relies on, including:

• Applications and data: order management, ERP, file storage, quality records, warehouse software.
• Access and connectivity: sign-in, identity, device access, site/network links, communications.
• External parties: customer/supplier platforms, logistics portals, outsourced support, hosted services.
• Operational steps: label creation, stock reconciliation, manual authorisation, quality sign-off.

For each, record: owner; internal or supplier; workable fallback; last time the fallback was tested; proof or unknown.

Immediate insight output: "You have mapped the path from an order to an outcome. The items without a verified fallback are the questions to resolve, not automatically vulnerabilities or failures."

Scenario: It is 09:00 on a working day. The selected process cannot be completed. Staff are available, but the necessary service or information is inaccessible. Treat this as a business continuity exercise, not a claim that you are under attack.

After 4 hours: Which orders, production jobs or deliveries are already affected? Who declares the issue? Can a safe, documented manual process be used? What information must be preserved?

After 24 hours: Which customer commitments are now at risk? Who speaks to customers and suppliers? Which temporary costs or workarounds have been approved? Is stock safe and traceable?

After 72 hours: Which production and cash decisions cannot wait? What would recovery and backlog clearance involve? Who needs to approve further spending or customer concessions?

After service returns: Can manual transactions be reconciled? Which orders must be checked for duplication? Who confirms that the process works from beginning to end?

Replace a frightening headline with a figure your finance team can defend.

Use your own numbers, then review the assumptions together. The tool should never assume that every delayed sale is a permanently lost sale.

Input A: Revenue or output affected per day. Record the value of orders that depend on the process, not total company turnover if only one line is affected.

Input B: Contribution margin. The amount remaining after the variable costs associated with those orders.

Input C: Portion not recoverable later. The share of affected output/orders genuinely lost rather than fulfilled once the process resumes.

Input D: Days disrupted. Use 0.5, 1, 3 or your own duration.

Input E: Additional evidenced costs. Scrap or spoiled materials (at an appropriate accounting value), extraordinary shipping, overtime, incident specialists or other incremental costs. Exclude costs already captured elsewhere.

Illustrative formula:

Unrecoverable contribution = affected daily order value × contribution margin × unrecoverable share × days disrupted.

Illustrative business interruption cost = unrecoverable contribution + incremental evidenced costs, adjusted for savings and double-counting.

Separate, unpriced exposure register: potential contract penalties; delayed receipts/financing costs; reputation; future orders; lost bids; stolen IP; ransom demands; uninsured losses. Price these only when there is evidence and appropriate expertise. Do not convert them into a made-up total or risk probability.

Worked example, entirely hypothetical: If a line has £240,000 of affected order value per day, a 32% contribution margin, 50% unrecoverable orders and a two-day interruption, the illustrative lost contribution is £76,800. Add £36,000 of separately verified incremental costs and the preliminary impact would be £112,800, before adjusting for overlap, mitigation, insurance or delayed cash. This is not an average loss or a forecast. Teams should substitute their real figures.

Evidence beats reassurance.

For the selected process, mark each item as Tested and evidenced / Documented but untested / Unclear:

1. The process has an owner and acceptable downtime agreed.
2. The critical systems and external dependencies are known.
3. The last recovery test covered the complete business outcome, not only a file restore.
4. Supplier responsibilities and escalation contacts are current.
5. There is a safe manual workaround, and reconciliation has been tested.
6. Somebody owns customer, finance and operational decisions during the first 24 hours.

Output: "Your next actions" should prioritise up to three checks based on the user's chosen process and missing evidence. No numerical cyber risk score from self-reported answers.

Headline: A decision your team can make this week.

• Critical process and business owner
• Customer or revenue commitment at risk
• Internal and external dependencies
• Evidence currently available, with last-tested date
• 4-hour, 24-hour and 72-hour consequences
• Illustrative financial impact with assumptions and unresolved exposure
• Three priority checks, each with an owner and due date
• Proposed decision: Test what exists / Improve a process / Check the supplier / Investigate a defined technical control / Accept and monitor a documented exposure

You may not need another security project. You do need to know what's covered.

Some findings belong with your production team or existing provider. Others may need a specialist conversation about Microsoft identity and information controls, business IT, connectivity, backup, infrastructure protection or recovery arrangements.

Assured Digital can help explore a defined issue within its service capability and agree a proportionate next step. We won't infer that an entire estate needs replacing from a self-assessment, and we won't claim to operate or remediate industrial control equipment without a separately agreed scope.

Is this a cybersecurity assessment? No. It is an operational disruption and decision-making exercise, not a vulnerability scan, assurance certificate or prediction of an attack.

Does it calculate our risk of being hacked? No. It models a selected interruption scenario using your own assumptions. Likelihood requires different evidence.

Can we use it with our existing IT partner? Yes. The most valuable outcome may be validating a fallback you already have.

What about production machinery and OT? Map relevant operational dependencies when appropriate. PLCs, industrial safety systems and specialised control equipment require the appropriate engineering expertise. This kit is not an offer to manage those systems.

Will Assured Digital see our numbers? The interactive worksheet does not submit your entries. They clear when you leave or refresh, so print or copy your brief to keep it. The optional enquiry form is separate and only sends the details you choose to submit.

Can we share the results internally? Yes. The downloadable template is designed for IT, operations and finance to use together.

---