Are Enterprises Prepared to Defend Their Data Amid Rising Cyber Threats?

Organisations today are generating, processing, and storing data at volumes that have never been seen before. As data becomes the lifeblood of operations, analytics, and strategic decision-making, it also becomes an increasingly vulnerable target for attack.  

According to a 2024 report by IBM, the global average cost of a data breach reached US$4.88 million. For companies operating in critical sectors such as finance or industrial operations, costs tend to be significantly higher. For example, in the industrial sector, the average breach cost was US$5.56 million in 2024.  

These rising costs reflect much more than remediation. They include lost business, regulatory penalties, customer attrition, reputational damage, and recovery overhead. For enterprise boards and leadership, this trend is a clear signal. Cybersecurity can no longer be viewed as merely a technical matter or a compliance checkbox. It must now be treated as a core pillar of business risk management and resilience strategy. 

In this environment, cybersecurity consulting must evolve to meet the changing needs of organisations. Advisory services must shift focus from reactive hygiene and compliance to proactive, business-aligned risk governance. For decision-makers, this means investing in robust, measurable, and outcome-oriented cyber programs that provide resilience and strategic advantage. 

Changing threat landscape: What consulting must address 

Cyber risk profiles are shifting quickly as attack surfaces expand and adversaries adopt automated, targeted techniques. Traditional defensive models are no longer sufficient. Consulting engagements must anticipate emerging threat vectors and translate them into proactive security strategy, operational readiness and measurable resilience outcomes.

Supply chain compromise and software integrity risks 

One of the most glaring wake-up calls in recent years is the supply chain attack on SolarWinds. In 2020, attackers successfully inserted a backdoor known as SUNBURST into updates for the SolarWinds Orion network management platform.  

Through those malicious updates, organisations that trusted regular vendor-provided updates downloaded compromised code. That gave attackers stealthy privileged access to customer networks across both public and private sectors.  

This incident demonstrated that even trusted software vendors can become a weak link. Enterprises relying on third-party software must now assume that vendor risk, code integrity, and software supply-chain security are as critical as their own internal controls. 

Operational disruption through ransomware, extortion, and data theft 

Beyond data theft, attackers increasingly target operational disruption. Environments that combine IT, operational technology (OT), or critical infrastructure are especially vulnerable. When systems that drive business operations are compromised, the financial repercussions escalate rapidly. 

According to the 2024 IBM report, business disruption, downtime, and lost customers were among the primary drivers of breach costs. Thus, cybersecurity consulting must encompass not only traditional data protection but also continuity planning, operational resilience, and recovery preparedness in the event of ransomware or extortion scenarios. 

Increased complexity from cloud, integration, microservices, and AI 

Organisations are adopting cloud services, microservices architectures, third-party integrations, and increasingly AI-driven workflows. These create sprawling attack surfaces. Shadow data, unmanaged endpoints, and legacy integrations introduce vulnerabilities that often go unmonitored. 

The 2024 breach cost increase was attributed in part to greater business disruption and complexity, rather than just larger breaches. For consulting practices, this means that defensive approaches must evolve from perimeter security to comprehensive governance. This includes data flows, identity and access governance, software supply chains, and resilient architecture. 

Strategic consulting priorities: From compliance to resilience 

Given the evolving threat landscape and growing financial stakes, cybersecurity consulting for large enterprises should focus on the following priority areas: 

Supply-chain assurance and vendor governance 

 

• Move beyond static questionnaires. Classify vendors by criticality and require stronger controls for high-impact suppliers, including code-signing provenance and reproducible builds.

  
  

• Require contractual obligations for transparency, rapid incident disclosure, and cooperation. 
  

• Maintain an independent Software Bill of Materials (SBOM) for critical suppliers and conduct periodic validation, particularly for vendors deeply integrated into the infrastructure. 
  

• Conduct scenario-based tabletop exercises simulating vendor compromise to test real-world resilience. 

  
  

Identity first architecture and access governance 

• Enforce least-privilege access by default with just-in-time elevation for critical tasks. 
  

• Integrate identity and entitlement management with HR lifecycle events to ensure access changes automatically when roles are updated. 
  

• Establish periodic entitlement reviews. Monitor privileged accounts and revoke access promptly upon role exit or transition. 

  
  

Detection, containment, and recovery engineering 

• Build telemetry maturity across endpoints, cloud, network, and vendor-supplied software. 
  

• Automate containment workflows to isolate compromised hosts, revoke credentials, and suspend anomalous sessions. 
  

• Develop and test robust ransomware and disruption recovery plans. Define and measure key metrics, such as mean time to recovery (MTTR), time to business resumption, and data integrity restoration. 

Data governance and AI / ML model governance 

• Maintain strong data classification, lineage tracking, and data-access audit trails before permitting data use in AI models. 
  

• Enforce privacy-preserving practices during training and inference. 
  

• Establish model-use policies, periodic review cycles, and access controls for model inputs and outputs to prevent leaks, unintended exfiltration, or data drift. 
  

Cyber-economics: Risk quantification, scenario modelling, board-level reporting 

• Map plausible risks, such as vendor compromise, ransomware, and regulatory action, to probability-weighted financial impact scenarios. 
  

• Build a residual risk ledger that shows what remains after existing controls are in place. 
  

• Provide leadership with decision-ready analyses quantifying how much financial loss could be avoided with different levels of investment. 
  

• Tie cybersecurity budget allocation to measured business outcomes rather than regulatory checklists. 

Case study: Supply-chain breach, SolarWinds attack 

What happened: SolarWinds, a widely used IT infrastructure monitoring vendor headquartered in Austin, Texas, experienced a supply-chain breach in 2020. Malicious actors inserted the SUNBURST backdoor into their Orion platform updates distributed between March and June 2020.  

Organisations that accepted the updates unknowingly downloaded compromised binaries. According to SolarWinds' own investigation, many of these compromised versions were distributed to up to 18,000 customers, potentially including both private and public sector entities.  

Because Orion often ran with privileged network access, the backdoor provided attackers with stealthy and persistent access to some of the world's most complex and sensitive infrastructures.  

Why this matters strategically: This incident demonstrated the systemic risk inherent in third-party software dependencies. Even when organisations had strong internal policies, trust in vendor software updates proved dangerous. The breach highlighted the fallacy of assuming vendor software is inherently benign. 

For enterprises relying on vendor software, this exposure is a critical strategic risk. For consulting practices, it underlines why vendor risk management and supply-chain assurance must be core capabilities offered to enterprise clients. 

What advisory programs should include 

• Verification of vendor build environments and code-signing integrity 

• Requirement for software bill of materials and reproducible builds for critical vendors 

• Contractual clauses ensuring mandatory breach disclosure and incident support 

• Supplier-compromise simulation exercises to validate readiness for vendor-related incidents 

Translating strategy into deliverables: What boards and executives should ask for  

When engaging with a cybersecurity advisory practice, executive clients should demand deliverables that directly align with business resilience and regulatory accountability. Recommended deliverables include: 

• A prioritised remediation roadmap that catalogues residual risk, quantifies potential impact, and maps controls to financial scenarios. 
  

• Vendor assurance playbook and contract templates for high-criticality suppliers whose software touches core infrastructure.
  

• Tabletop and red-team simulations along with evidence packages, recovery SLAs, containment timelines, and business-resumption metrics.
  

• An AI and data governance framework covering data classification standards, model-access inventory, model-use policies, and periodic reviews.
  

• A board-ready scenario analysis package that includes probability-weighted breach simulations, estimated residual losses, and recommended cyber capital allocation.
  

These deliverables ensure that cyber investment is not abstract but directly tied to measurable business value, resilience, and regulatory readiness. 

Why this matters now: The business and risk imperative 

Organisations face rising costs when breaches occur. With the global average breach cost at US$4.88 million in 2024, even a single incident may seriously harm financial performance. Supply-chain attacks, such as the SolarWinds breach, demonstrate that vendor software cannot be assumed to be safe. The expansion of digital ecosystems through cloud platforms, third-party integrations, and AI means that risk is ever more diffuse and more complex to manage. 

Governance structures must evolve. Boards and executives must now view cybersecurity not simply as a cost centre but as an integral component of operational risk, compliance, and strategic resilience. 

In this context, advisory services play a critical role. Cybersecurity consultants must help organisations shift from box-ticking compliance to risk management, from reactive remediation to proactive resilience, and from compliance to strategic governance. 

Conclusion 

Cybersecurity is no longer a matter of IT hygiene or compliance alone. It has become a strategic enterprise-wide concern with real financial, operational, and reputational consequences. With rising breach costs and increasingly sophisticated threat actors, the stakes are too high for businesses to ignore. 

For advisory practices, the mandate is clear. Deliver programs that measurably reduce dwell time, shorten recovery windows, and lower probability-weighted financial exposure. Embed supply-chain assurance, identity-first access governance, detection and recovery engineering, AI data governance, and cyber-economic modelling into every engagement. 

For boards and executives, the message is also clear. Cyber risk is business risk. Investment in cybersecurity must align with resilience, trust, and long-term continuity. When consultants deliver measurable, auditable results tied to business outcomes, cybersecurity transforms from a cost centre into a strategic enabler.