03/04/2026
Recent reporting from ITPro and The Register notes that 78% of UK manufacturers experienced a cyber incident in the past year. That is not because IT teams are failing. It is because the risk is being owned in the wrong place. Cyber security is not an IT problem; it is a business risk and framing it as an IT issue is why so many organisations are exposed. And the impact makes that clear.
According to recent coverage*:
👉 More than half lost revenue
👉 Some lost over £250k
👉 Operations and supply chains were disrupted
Cyber-attacks do not target IT. They impact:
• Revenue
• Production
• Supply chains
• Customer commitments
• Commercial performance
IT cannot own those outcomes. The business does. So, when cyber security sits only with IT, you get a gap:
• Technical controls without business context
• Security decisions disconnected from operational risk
• Incident response plans that do not reflect real world impact
Organisations that are getting ahead of this are doing one thing differently. They treat cyber risk like any other business risk. That means:
• Board level ownership
• Cross functional involvement
• Clear understanding of financial and operational impact
Stop asking “is IT secure?”
Start asking “how resilient is the business if something goes wrong?”
*Based on a survey of 500 senior decision-makers responsible for IT, OT, operations, risk or security
