If you step back and look at 2025, it’s reaffirmed a truth that every organisation now has to face: cyber risk is a business continuity, safety and leadership challenge. 

From headline-grabbing attacks on major brands to the rising expectations set out by the UK’s National Cyber Security Centre (NCSC), cyber moved firmly into the space that directors and senior leaders need to have top of their agenda: operational stability, trust and business continuity. 

The data is unambiguous. The UK Government’s Cyber Security Breaches Survey 2025 found that 43% of businesses and 30% of charities experienced a cyber breach or attack in the past year. For medium and large organisations, that figure rises to 67% and 74%. 

At the same time, the NCSC reported a sharp escalation in serious incidents. In its Annual Review 2025, it confirmed it handled 429 cyber incidents, with 204 classed as nationally significant, up from just 89 the year before. It also reported a 50% increase in highly significant incidents. 

And beyond the statistics, business leaders and the public felt the effects. Cyber incidents resulted in empty shelves, stalled production lines, delayed payments, frustrated customers, and leadership teams running on fumes. 

This is the backdrop directors and senior leaders are now operating in. Not if something happens, but when it does, how quickly you can stabilise, recover and maintain trust. 

It wasn’t just about data. 

The penny dropped this year that cyber isn’t “an IT thing”. Cyber incidents are almost never just about data or systems. 

When systems go down, the impact is messy and immediate. Trading days disappear. Teams revert to manual workarounds, slowing everything down and increasing the risk of error at exactly the wrong moment. Supply chains jam up. Payments are delayed. Customer patience wears thin. Regulators start asking questions. 

Meanwhile, senior leaders are pulled into crisis meetings and decisions that can’t be parked. This isn’t a short, sharp shock. It becomes a sustained leadership drain. 

For large organisations, that’s disruptive and expensive. For smaller suppliers caught in the blast radius, it can be existential. Not because they’re bad at what they do, but because they have less cash buffer, fewer people and no spare capacity to absorb prolonged disruption. 

That’s what incidents like Jaguar Land Rover really exposed. The damage didn’t stop at the organisation itself. It rippled straight down the supply chain. The Cyber Monitoring Centre categorised the JLR incident as a Category 3 systemic event, estimating a £1.9 billion UK financial impact and effects across more than 5,000 organisations. 

This is the reality cyber incidents exposed in 2025. They are not isolated technical failures. They are supply-chain shocks, where preparedness varies widely and the weakest links often carry the greatest risk. 

Prevention helps. It just isn’t enough. 

Of course, prevention still matters. But 2025 made something very clear: even organisations doing “the right things” still got hit. 

They had security teams. They’d invested. They took cyber seriously. And still, attackers got in. 

That’s uncomfortable, but it’s also important. 

Because it forces a more honest conversation. Not “how do we stop every attack?”, (which no one can guarantee) but “what happens when one gets through?” 

The Co-op story is a good example. The incident was disruptive. No one’s pretending it wasn’t. But because they’d invested in layered defences, segregated systems and actually tested their plans, they stopped ransomware deploying and kept payment systems running.  As they put it themselves: 

“At Co-op, our routine investment in security, the deliberate segregation of systems and frequent testing laid a strong foundation for our response to this cyber attack.” 

That’s the difference preparation makes. It doesn’t make incidents painless. It makes them survivable. 

The financial impact elsewhere was stark. Co-op later reported £206 million in lost revenue and an £80 million hit to operating profit in the first half of the year.  Whilst M&S warned its cyber incident would reduce operating profit by around £300 million.

Resilience, in practice, sits as much in response, continuity and recovery as it does in defence and prevention. 

Where things really get hard: leadership decisions

Here’s the bit people don’t always say out loud. 

When a cyber incident is live, the hardest decisions aren’t technical. They’re governance decisions. 

Who actually has the authority to shut systems down? When does something go to the board? What do you tell customers, suppliers, staff and regulators, and when? How long can you limp along in a degraded mode before it becomes riskier than stopping altogether? 

Most organisations have answers written down somewhere. What 2025 showed is that those answers often don’t survive first contact with reality. 

• Plans assume clarity. Incidents create ambiguity. 
• Plans assume time. Incidents compress it. 
• Plans assume perfect information. Incidents never give you that. 

As Co-op reflected after the incident: 

“Nothing truly prepares you for the intensity, urgency and unpredictability of a live cyber event. But those drills matter. They build muscle memory. They sharpen instincts. And they expose vulnerabilities before attackers do.” 

They’d run scenarios. They’d debated decision-making before it mattered. They’d tested who needed to be in the room and what information actually helped. So when something real happened, they didn’t freeze. 

If you take one thing from this: Boards don’t need to understand cyber threats in detail, they need to practise making decisions when information is incomplete, time is compressed, and the consequences are real. 

That’s why we saw such a shift this year towards exercising and simulations, not as box-ticking, but as leadership training. You can’t read your way to confidence in a crisis. You have to experience the pressure, even in a safe environment. 

This thinking shaped much of our work at Cyber Innovation Hub this year, supporting boards and senior teams to move from awareness to decision-making under pressure, through leadership training, incident response exercising and realistic testbeds that allow teams to experience disruption safely and build shared understanding and calm confidence when it matters. 

The physical world got dragged into it too 

Another thing that became impossible to ignore this year is that cyber incidents don’t stop at laptops anymore. 

In critical national infrastructure, like energy, transport, manufacturing and food, digital systems are tied directly to physical operations. When something goes wrong, it’s not just inconvenient, it can affect safety, services and real-world outcomes. 

M&S highlighted how legacy systems made containment and recovery more complex, acknowledging that even with good preparation, rebuilding securely takes time. As they noted, once systems come back online, the recovery phase is slow, careful and not something you can rush if you want to do it properly. 

Co-op echoed this, pointing out “one of the biggest vulnerabilities is around legacy systems that may no longer be patched.” 

For boards, this raises an uncomfortable but necessary question: 

Do you actually know where your most critical systems are, what condition they’re in, and how you’d cope if they were compromised tomorrow? 

That’s why operational technology and cyber-physical systems become such a major focus. You can’t secure what you don’t understand, and you can’t understand it properly from a PowerPoint. 

Hands-on environments matter. Real equipment. Real scenarios. That’s why we expanded testbeds this year, including live electrical infrastructure and portable setups that let teams train in context, not theory. 

A practical next step 

If you’re reading this and thinking, we haven’t actually practised this properly, you’re not alone. 

 That’s why we run our NCSC-assured Cyber Resilience for Directors and Senior Leaders course. It’s designed for people who carry the weight of these decisions. Not to scare, but to give you space to work through realistic scenarios, pressure-test assumptions and leave with a clearer sense of what “ready” actually looks like. 

The next session taking place on 21st January 2026 at Sbarc|Spark Building, Maindy Road, Cardiff, CF24 4HQ, 09:00 – 12:30 

Because after 2025, waiting to find out how you’ll respond in a live incident feels like a risk most leadership teams would rather not take. 

Our wider NCSC-assured cyber training courses are designed to build capability across the whole organisation, covering topics including risk and governance, operational technology, cloud security, cyber hygiene and awareness, cyber resilience for leaders, and incident response. Courses can be taken individually or combined to support longer-term resilience and leadership readiness, depending on where your organisation faces the most pressure. 

P.S If you’d like to see how these lessons shaped our work across training, testbeds and sector programmes this year, you can explore our 2025 Annual Report here.