Your Cyber Response Can Fail While Everyone Meets Their Goals

A data company’s entire database had turned up on the dark web. But one of the expenses threatening the company’s survival was surprisingly analog: postage.

In the account shared with me, the volume of exposed data was so large that the company could not even afford the stamps for notifying the affected individuals. While IT and the general counsel worked to understand the breach and protect the company, the CEO continued attending to revenue growth and day-to-day operations. He was monitoring the crisis. He had not yet reorganized his priorities around it.

Eventually, the head of IT had to make the distinction explicit: The immediate objective was no longer growing the business. It was saving it. The company the CEO thought he was running no longer existed in the form his priorities assumed. It was on life support, and his leadership needed to reflect that.

Being Informed Is Not the Same as Taking Ownership

“Cybersecurity is a leadership issue” sounds like something every executive could agree with before returning to whatever they were already doing. That is precisely the problem. Executives are very good at agreeing that something is a leadership issue. But what happens when the crisis knocks on your door?

A CEO can receive updates, approve spending and express concern while continuing to lead toward an objective the crisis has displaced. The technical team is responding to an emergency. The rest of the organization may still be responding to last quarter’s priorities.

Consider what that could look like. Salespeople are expected to protect customer commitments that operations can no longer safely fulfill. Finance is holding spending to a budget that never anticipated the recovery. Managers are protecting output targets while IT needs systems offline. Each team can make a defensible decision against its existing goals while making the company’s response harder.

Announcing that recovery is the priority does not resolve those conflicts. Leaders have to decide which commitments must change, which activities must stop, and how employees will be engaged while the usual definition of success no longer fits. Otherwise, the organization has a new message and the same old instructions.

When I interviewed Palo Alto Networks CEO Nikesh Arora, he described working from the assumption that attackers could and would gain access to your systems. Rather than wondering if it will happen, turn your attention (now) to how quickly a team can detect an intrusion, stop the attacker, and limit the damage. For executives, it raises a further question: What business decisions will that response require, and have we prepared to make them?

Protecting the Network Can Stop the Business

Jaguar Land Rover’s (JLR) experience makes those decisions concrete. A cyber incident in late August 2025 led to a systems shutdown and a halt in manufacturing. According to its 2026 annual report, production restarted on Oct. 8 and returned to normal levels in mid-November. Lost production and the time needed to restore distribution affected financial performance across two fiscal quarters.

Protecting the network and maintaining production had become competing requirements. Technical experts must guide what is safe. Executives must confront what the resulting interruption means for cash, customers, employees, and suppliers.

The consequences extended beyond JLR’s factories. Suppliers faced canceled or delayed orders and financial pressure. JLR introduced a supplier financing scheme, and the British government announced a guarantee expected to unlock up to £1.5 billion in lending to support JLR and its supply chain. Restoring computers was only part of restoring the business. Recovery also depended on suppliers being able to keep operating. 

Those decisions reach well beyond IT’s authority. They also expose a risk that an internal security assessment cannot fully capture: Other companies did not need to be hacked to experience a crisis. They only needed to depend on a company that was.

Tanium CEO Dan Streetman raised a related concern when we discussed the CrowdStrike outage: dependence on a single technology provider can create exposure beyond an organization’s direct control. CrowdStrike’s July 2024 disruption resulted from a faulty update, not a cyberattack. The cause was different, but it raises a related leadership question: What must keep working elsewhere for our organization to keep operating?

Decide When the Priorities Must Change

Before a crisis, put one scenario in front of the leadership team: a critical system, supplier or customer is unavailable for several weeks. Then work through three decisions.

1. What would trigger a change in our priorities? Finance should identify when the interruption threatens cash or essential commitments. Operations should establish what can continue safely. Agree on the conditions that would require the business to shift its focus, including which existing goals to suspend.
2. Who has authority to make the consequential calls? Establish who can stop an operation, revise a customer commitment, or redirect resources. “We would get everyone together” is a meeting invitation, not a contingency plan. It leaves the decision unresolved until the moment when time is most expensive.
3. How would employees know that success now means something different? People leaders and managers need to translate the response into changed expectations. Managers cannot expect employees to prioritize recovery while they still judge them against business-as-usual goals. Decide what managers will ask of people, and which measures will change — not just what the CEO will announce.

The point is to uncover disagreements while there is time to resolve them. A recovery plan is incomplete if the executives responsible for carrying it out have different ideas about when it takes precedence over the operating plan.

The data-company CEO knew the breach was serious. Where he needed help was in recognizing that the business required a different kind of leadership from him.

Would you recognize when the company you are trying to grow has become the company you need to save? The last thing a company in crisis needs is everyone successfully doing what used to matter.