Cairn: Business impact and costs
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 6
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
The business process at risk
Internet-facing applications and the staff, service identities and infrastructure an initial foothold could reach.
Automation can compress the time available to investigate a weak signal. The operational issue is whether the business can recognise and interrupt suspicious access before it spreads into systems that support trading.
Build an estimate from your own operation
Estimate interruption, investigation, recovery and continuing control costs separately. Use a range and state the assumptions. Avoid adding overlapping losses twice: an order delayed and later fulfilled is different from an order permanently lost. The report does not assign a universal dollar loss or a probability of breach.
- Interruption: affected transactions or staff hours × your measured contribution or cost, adjusted for work recovered later.
- Response: internal hours, specialist support, clean capacity and supplier coordination actually required.
- Recovery: rebuilding, validation, transaction reconciliation and customer support during the transition.
- Continuing operation: ownership, maintenance, access review and recovery testing after normal service returns.
Decisions for the operating team
- Map urgent customer commitments to the services likely to be isolated.
- Keep an after-hours contact and decision roster available outside the potentially affected application.
- Set the authority and spending limits for emergency containment.
A scenario to rehearse
Illustrative exercise, not an observed customer incident: An application alert occurs during an after-hours promotion. The exercise tests whether the on-call team can identify the credential owner and restrict the relevant integration before waiting for a full incident narrative.
Evidence before accepting the cost
An approved response-authority policy and a funded plan to close exercise gaps.
Compare immediate continuity work with longer-term architecture changes. Migration can reduce specific maintenance responsibilities, but it cannot replace investigation of an active compromise. Evaluate the controls and retained responsibilities of the proposed operating model, including recovery and exit.
Decision checkpoint
How long would a credible alert wait for someone with authority to act?