A cyber attack rarely stays inside IT. The financial damage starts with downtime, then spreads into revenue, payroll, suppliers, customers, insurance, legal spend and reputation.

For finance leaders, the main question is how much disruption can the business absorb before cash flow, contracts and confidence start to break?

The numbers in 2026 are clear. The Cyber Monitoring Centre estimated that the 2025 Jaguar Land Rover cyber incident created a £1.9 billion financial impact for the UK and affected more than 5,000 organisations. Most of that loss came from reduced manufacturing output at JLR and its suppliers.

This is the real cost of a cyber attack. The technical breach is only the starting point. The larger cost often appears in operations, supply chains, workforce pressure and customer trust.

Cyber attacks are now a finance problem

Cyber security used to be treated as a technical control. That view is outdated.

When systems go down, finance teams feel the impact quickly. Orders can stop. Manufacturing can pause. Customer support can slow. Invoices may be delayed. Suppliers still need payment. Payroll still has to run.

The UK government’s Cyber Security Breaches Survey 2025/2026 found that businesses reporting revenue or share value loss after a breach rose from 2% to 5%. Businesses reporting reputational damage also rose from 1% to 3%.

Those percentages may look small on paper. In practice, the cost is concentrated among the companies hit hardest. The same government survey warned that a small number of incidents create very large costs, with financial impact concentrated among a minority of victims.

That is why finance leaders need to treat cyber resilience as part of financial resilience.

Download Meterian’s Free eBook to Understand the Open Source Security Threats of 2026

The direct costs arrive first

The first financial shock is usually operational disruption.

If systems are unavailable, a business may lose the ability to process orders, ship products, deliver services or communicate properly with customers and suppliers.

The immediate costs can include:

• Lost revenue from interrupted operations
• Emergency IT recovery and remediation
• Incident response and forensic investigation
• Legal, regulatory and compliance support
• Customer notification and communications
• Overtime, temporary staffing and consultancy costs
• Contractual penalties or compensation claims
• Higher cyber insurance premiums after the incident

IBM’s 2025 Cost of a Data Breach Report put the global average cost of a data breach at $4.4 million. The figure was lower than the previous year, partly due to faster identification and containment, but it still shows how expensive a serious incident can become.

The important point for finance teams is timing. Costs begin before the business fully understands what happened. Cash starts leaving the company while revenue may already be under pressure.

Downtime creates the larger cost

Technical recovery is only one part of the problem.

A business may restore systems within days or weeks, while the financial impact continues for months. Delayed orders, missed sales, damaged supplier relationships and customer churn can continue after the technical incident is closed.

This is where the JLR incident matters. The Cyber Monitoring Centre classified it as a Category 3 systemic event because of its impact on one of the UK’s largest manufacturers and the wider effects on supply chains, logistics providers and local economies.

For a large enterprise, this kind of disruption can damage quarterly performance. For an SMB, the same pattern can threaten survival.

Why SMBs have less room for error

Smaller businesses are often more exposed because they have fewer financial buffers.

A large company may have specialist recovery teams, legal advisers, cyber insurance, cash reserves and crisis management support. Many SMBs operate with tighter margins and smaller teams.

If systems are unavailable for several days, the pressure can become immediate. Payroll still needs to be met. Suppliers still expect payment. Customers may move to another provider. New business can disappear while the company is still trying to recover.

The UK government’s latest survey shows why this matters. Among small businesses, cyber security risk assessments fell from 48% in 2024/2025 to 41% in 2025/2026. Business continuity plans covering cyber security also fell from 53% to 44%.

That creates a dangerous gap. Smaller businesses often have less capacity to absorb an incident, while some are reducing the planning needed to survive one.

Supply chain disruption turns one breach into a wider cost

Modern businesses depend on connected suppliers, software providers, logistics partners, payment systems, cloud platforms and third-party tools.

A cyber attack on one organisation can quickly create financial pressure for many others. The JLR incident made this visible. The estimated £1.9 billion impact was driven largely by lost output at JLR and its suppliers, rather than a narrow internal IT cost.

Finance leaders should review supply chain exposure by asking:

• Which suppliers are critical to daily operations?
• Which third-party platforms hold sensitive business or customer data?
• Which software tools could disrupt revenue if they went offline?
• How quickly can critical suppliers recover from a cyber incident?
• Are supplier cyber security standards reviewed before contracts are signed?
• Is there concentration risk around a small number of key providers?

This is one of the clearest gaps in cyber resilience today. The UK government survey found that only 15% of businesses reviewed cyber risks from their immediate suppliers.

A supplier’s cyber weakness can become your operational disruption. A software provider’s vulnerability can become your customer service problem. A third-party failure can become your cash-flow issue.

Open-source software risk belongs in the same conversation

Most businesses now depend on open-source software, even when finance leaders never see it directly.

Open-source components sit inside applications, platforms, internal tools and third-party software. If those components are outdated, vulnerable or poorly tracked, they can create real financial exposure.

Black Duck’s 2026 Open Source Security and Risk Analysis report found that 98% of audited codebases contained open-source components. It also found that 87% contained at least one vulnerability, while 78% contained high-risk vulnerabilities.

Sonatype’s 2026 State of the Software Supply Chain report found that open-source consumption reached 9.8 trillion downloads across major registries in 2025. It also reported more than 1.233 million malicious open-source packages and noted that Log4Shell still reached 42 million downloads in 2025, years after fixed versions were available.

This is where software supply chain security becomes a finance issue. If a business does not know what software components it uses, which ones are vulnerable, and how quickly they can be fixed, it cannot properly measure cyber risk.

SBOMs, vulnerability scanning, continuous monitoring and DevSecOps controls help turn hidden software risk into something finance and security teams can understand, prioritise and budget for.

Insurance reduces some losses. It cannot rebuild trust

Cyber insurance can be useful. It should never be treated as the full answer.

A policy may help cover parts of the recovery cost, depending on the wording, exclusions and conditions. It cannot restore missed revenue, rebuild damaged supplier relationships, recover lost opportunities or guarantee customer trust.

Insurance also does not remove the operational burden. During a serious incident, the business still needs to investigate, communicate, restore systems, manage stakeholders and keep trading where possible.

Finance leaders should review cyber insurance as part of a wider resilience plan. The policy should sit alongside prevention, monitoring, incident response, supplier risk management and recovery planning.

What finance leaders should ask in 2026

Finance teams do not need to become security engineers. They do need better visibility into cyber risk.

The most useful questions are practical:

• How much revenue would be exposed if core systems were unavailable for one day, one week or one month?
• Which suppliers, platforms and software tools are critical to operations?
• Does the business know which open-source components are used inside its applications?
• Are vulnerabilities being prioritised by business risk, rather than volume alone?
• Is there a current SBOM for critical software?
• Has the business tested its incident response plan?
• Does cyber insurance match the real financial exposure?
• Can the organisation keep paying staff, suppliers and recovery costs during a serious outage?

These questions make cyber risk measurable. Once the risk is measurable, finance leaders can help decide where investment matters most.

Prevention is easier to budget than recovery

The cost of prevention is usually visible. The cost of recovery is uncertain, fast-moving and harder to control.

That is the core financial argument for cyber resilience in 2026.

A successful cyber attack can affect revenue, productivity, customers, suppliers, employees, insurance costs and reputation. For smaller businesses, the financial shock can become severe before the technical recovery is complete.

The JLR incident showed how one cyber event can create losses across an entire business ecosystem. The same pattern can happen at a smaller scale in any sector.

Finance leaders should treat cyber resilience as a core business investment. That means knowing where the organisation is exposed, where software risk sits, how quickly vulnerabilities can be found, and how confidently the business can respond when something goes wrong.

Meterian helps enterprises and SMBs improve open-source security, vulnerability visibility, and software supply chain resilience, so teams can find and fix risk before it becomes a business crisis.