_Perception
_{vs Reality}

Perception vs Reality

Confidence without testing isn’t resilience.

Risk Area	What many boards think	What actually happens	Why it matters	What you should do
Revenue – Downtime	Cyber outages are over in a few days	Median outage is 24 days with average losses of $2.7 million	Three weeks out of action can cripple cash flow and reputation. Every extra week offline costs revenue and increases regulatory scrutiny. Most policies aren’t built for a 24-day outage, gaps show fast.	Run a Cyber Quantified session to see how your BI cover would perform in a real event
Reputation – Vendor Risk	Supplier risk is secondary	50% of breaches now start with suppliers or contractors	A weak supplier can shut down operations. It’s easier to enhance vendor due diligence now than pay for a breach later.	Review supplier contracts and insurance; consider a Boardroom Briefing on vendor risk

Perception vs Reality

Confidence without testing isn’t resilience.

Risk Area	What many boards think	What actually happens	Why it matters	What you should do
Resilience – Tested Plans	Having an incident plan means you’re ready	Only two-thirds of boards have ever tested theirs; regulators want proof	Untested controls risk penalties, lawsuits and loss of insurance cover. Rehearsing controls now is far cheaper than failing under inspection.	Book a Cyber Crisis Workshop to stress-test your plan and document results
Regulation – Controls & Governance	Meeting disclosure rules is enough	Regulators are fining firms for not proving controls work	Regulators now want proof your defences work, not just disclosure.	Arrange a Multi-Jurisdiction Regulatory Coverage Review to check controls and cover align with latest rules
Fraud & Social Engineering	Only the CFO and finance teams are targets	Attacks now hit HR, payroll and tax teams too	Deepfakes and synthetic IDs are bypassing traditional controls. Payroll, HR and finance teams are being targeted, not just CFOs.	Update social-engineering controls and train non-finance teams

Perception vs Reality

Confidence without testing isn’t resilience.

Risk Area	What many boards think	What actually happens	Why it matters	What you should do
AI-Driven Risks	AI fraud is a future issue	AI-enabled scams and deepfakes are already causing multimillion-dollar losses	Boards are optimistic but unprepared. AI fraud can drain funds or expose data before you even spot it.	Assess AI-related exposures now and build controls into fraud-prevention programmes