Your organisation is already under attack.
The only question is whether you know it.

Legal exposure

Under NIS2, the board is personally accountable

NIS2 Article 20 requires that management bodies approve cybersecurity measures and oversee their implementation. Non-compliance can result in personal liability and fines of up to €10M or 2% of global turnover.

For leadership: Your public revenue figures are used to assess whether you are worth attacking.

For leadership: Attackers build structured call-centre operations to deceive your employees. They know names, titles and phone numbers.

For leadership: Isolation is a tactic. Organisations without a pre-defined crisis protocol are most vulnerable.

For leadership: Negotiation happens on the attackers' terms. They have done it hundreds of times. Your leadership team has not.

For leadership: You may already be on a list. The question is your priority on it.

Which data or systems would cripple the business if encrypted or published? Those are the ones to protect first, not everything at once.

Organisations that handle attacks best have practised. Not necessarily technical drills, but the decision process: who decides what, when, and who is contacted?

An untested backup is not a backup. Attackers know this. They often wait to encrypt until they know the backup system is compromised.

The ransom decision involves legal, insurance and ethical dimensions. It belongs on the board agenda, not a helpdesk ticket.

What do you tell customers, media and authorities? And when? In many cases, poor communication causes more damage than the attack itself.

Many attacks happen via suppliers with lower security levels. NIS2 requires attention here, and it is simply good business to know the risk.