Bouncing back from cyber disruption: how a strategic investment in operational resilience pays dividends

Key Insights:

• The UK's government has published 'The Value of Resilience: Cyber Resilience in Financial Services'
• Analysis shows that cyber resilience should be viewed as a strategic investment, not just a regulatory or compliance requirement
• Cyber disruption through ransomware attacks and other security incidents is inevitable, not exceptional
• Organisations that invest in resilience reduce losses from cyber incidents and improve business performance, innovation and long-term growth
• Risk based prioritisation is key to improve security and resilience, not just a blanket approach all controls

A new report from the UK's HM Treasury has assessed the benefits of financial services firms going beyond minimum mandated security requirements and investing in operational and cyber resilience as a means to survive our increasingly volatile times.

With analysis by leading Big 4 consultancies and data from economists and insurers, this latest publication champions the core theme that resilience delivers value well beyond risk reduction alone.

Not if, but when

Against the backdrop of 2025's cyber annus horriblis for many well known UK brands, data in the UK shows the number of highly significant cyber incidents increasing year on year with a 50% increase in reports to NCSC-UK, the third consecutive year of upward trending activity.

Cyber risk is no longer simply an IT issue, it is an enterprise risk affecting revenue, customers, operations and shareholder value.

As such, the question for executives is no longer "Can we prevent every attack?" but rather "Can we continue to operate when an attack succeeds?"‍

Operational resilience thus becomes a competitive capability that enables organisations to recover quickly, maintain customer confidence and continue growing despite disruption.

Finding the security investment sweet spot

The largest costs associated with an incident often arise from:

• Operational downtime
• Lost revenue
• Customer compensation
• Regulatory action
• Recovery activities
• Reputational damage
• Decline in market value

In many cases, incidents have a modest and manageable impact, typically between 0.2% and 4.6% of annual turnover in the UK. But there are also those black swan, edge case events that can be far more severe in scale and potentially threaten overall business continuity.

Where companies proactively invest in organisational resilience - both technical and cultural changes - the magnitude of loss caused can be reduced in two principal ways:

1. It reduces the likelihood that disruptive events escalate into severe outcomes
2. It reduces the impact of losses when disruption does occur

The benefits of investing in resilience

The UK analysis shows four key benefits of moving beyond the simplistic world view that cybersecurity spend is a cost that prevents bad things from happening.

Organisations that treat investment beyond the prescribed minimal regulatory obligations see:

• Reduced operational losses by detecting incidents faster, containing attacks sooner and restoring services more quickly. This means lower direct financial losses.
• Faster recovery than similarly affected competitors by communicating effectively, restoring services rapidly and minimising business disruption to staff and customers
• Better financial performance where readiness to respond means greater confidence for investors through stable earnings, fewer severe disruptions and less uncertainty
• Increased organisational confidence - knowing what is critical to protect makes it easier to launch new products, adopt AI and modernise legacy technology without increasing operational risk

How to move the resilience needle

Whilst the outcomes and benefits seem clear, the analysis suggests that getting to this position can be complex for many organisations.

"Rather than treating prevention, response, recovery and continuity as separate conversations, firms with the strongest outcomes are those that balance investment across these domains, informed by where capabilities have the greatest impact on likelihood and loss"

The most common recommendation in the report is that prevention efforts alone are insufficient.

Data from KPMG identifies how different defensive security capabilities reduce the likelihood of a major ransomware incident with security training, email filtering and web traffic controls contributing 10 to 15% reductions in incident likelihood.

Alongside technical controls, investment should balance prevention, detection, response and recovery procedures through a process of understanding the most critical business assets and services - including supply chain and technology dependencies - to quantify the potential impacts on customers.

The ability to recover quickly is as valuable as reducing the likelihood of compromise.

And here is where crisis management and incident communications, business continuity efforts and supply chain management are also key areas to focus on as organisational culture is matured.

Owning the resilience uplift

Alongside monitoring the effectiveness of foundational controls, such as patching and vulnerability management, Boards should move resilience beyond just compliance reporting and vanilla risk management updates.

Cyber resilience must be seen as a strategic business capability embedded into corporate strategy with investment decisions supporting continuous improvement. On this basis, security investment evolves from simple risk mitigation to supporting overall business transformation, innovation and growth.

Read the full report on the Treasury website.