Cybersecurity has long been framed as an "IT problem." However, when an incident shuts down factories, disrupts supply chains, and threatens livelihoods, this perspective needs to change.
In early September 2025, Jaguar Land Rover (JLR) suffered a major cyber attack that halted operations at its UK plants.
As of today, the factories are still not fully operational, and it is unclear when they will resume normal activity. Meanwhile the company has reportedly lost between $67 and $94 million per day.
Compliance Is Not Enough
The downstream effects of the JLR attack have been severe, affecting not only the company. UK car manufacturing output fell by 27% in September, marking the worst figure since 1952.
Over 5,000 businesses, including suppliers, logistics firms, and service providers, were directly impacted, as were more than 30,000 JLR employees, transforming a single cyber incident into a national supply-chain crisis.
The estimated cost has climbed to £1.9 billion ($2.5 billion), prompting the UK government to intervene to stabilize the supply chain with a £1.5 billion ($2 billion) loan guarantee.
This episode illustrates how a digital event not only can halt the physical production, but may also trigger cascading economic consequences affecting a whole country.
Even more concerning, though, is what the prolonged shutdown although the exact technical cause of the outage is unknown, it is clear that JLR’s disaster recovery and business continuity plans failed.
For a corporation of this size, operating in a highly regulated industry and fully compliant with modern cybersecurity frameworks this underscores an important truth: a cyber disaster can still happen, even when you are prepared, certified, and compliant.
Compliance can ensure the existence of controls, but not their effectiveness under real-world pressure. A resilient enterprise must not only meet the requirements, but also quickly recover when things go wrong.
Cybersecurity As A Business Resilience Tool
Cybersecurity must evolve from IT perimeter defence to enterprise-wide resilience becoming a critical enabler of business continuity, supply-chain integrity, brand trust, and, in some industries, such as healthcare, even human safety.
To achieve this target, business leaders should:
- Map critical business processes, not just IT assets.
- Build cross-functional governance involving IT, operations, finance, legal and supply-chain.
- Integrate cyber scenarios into continuity and crisis simulations.
- Evaluate supplier resilience as a strategic priority.
- Measure cybersecurity by business impact metrics: downtime days, supply-chain losses, brand trust, regulatory exposure.
Conclusions
The ongoing JLR crisis highlights that, even with strong compliance, certifications, and investment, no company is immune from operational paralysis. While compliance and preparation are important, what matters most is the ability to recover, adapt, and continue delivering value under pressure.
If the boardroom still views cybersecurity as merely a technology issue, it’s missing the point: cybersecurity must now be considered and funded as a business-critical discipline, central to operational continuity and corporate survival.
The lesson is simple: cyber risk is business risk, and true resilience begins long before the next breach occurs.
Stay Cyber Safe!
