A cyberattack forces you to pull the plug. Can your business keep running?

A recent cyberattack on European supermarkets caused freezers in Sweden to reach a scorching 131°F (55°C). Dutch grocery chain Ahold Delhaize warned that a similar hack could cost up to €250 million ($277 million) in sales and shave €100 million off operating profit in the fourth quarter. These cyberattacks demonstrate a weakness in many boardrooms, where directors often focus on whether attackers can breach their systems but should also consider if the business can survive the fallout and continue operations.

Companies must assume attackers will eventually penetrate their defenses; the question is when, not if.

A recent audit revealed that some defenses are lacking. The audit found holes in the firm's security but stopped short of testing whether the business could continue operations after a breach. This is where the gap lies in many companies.

Protecting critical operations is crucial. For instance, Ahold Delhaize temporarily shut down certain websites and apps to contain the breach, but restored online shopping within two weeks. Marks & Spencer, on the other hand, halted online clothing orders for 46 days after a breach, affecting only part of its range upon resuming orders.

The rise of AI presents an additional challenge, as newer AI models are discovering security flaws that previous models missed. Companies need to adapt by testing their systems with AI and devising contingency plans for when systems go dark. Training staff on how to handle day-to-day operations manually can mitigate the impact of an attack. By simulating a breach and testing staff's ability to function without typical systems, companies can better prepare for potential cyber incidents.