Audshule/Stocksy
Most companies operate with one of two assumptions about cyber disruption: that strong enough defenses will prevent it, or that a well-written business continuity plan will manage it when it happens. Our research, drawn from a global survey of 1,000 senior executives across 20 industries in 13 countries, suggests both assumptions are dangerously wrong.
Francesco Carta fotografo/Getty Images
The traditional way companies think about regulatory penalties is almost entirely financial. Analysts model the balance-sheet impact. Legal teams assess appeal options. Communications drafts a statement. The penalty gets absorbed, the stock recovers, and the organization moves on. The implicit assumption is that the workforce will do the same.