Companies and public administrations need to be prepared for the worst. Faced with an event that will happen with absolute certainty, decisions and the right investments need to be made… but in what?

More mature companies have traditionally invested more in protection and have started shifting that investment toward the response phase. Responding to an incident undoubtedly requires outside help, given the legal, reputational and financial implications it can have for the company, its suppliers and its clients.

This need for outside help is what began fueling the cyber insurance business in the United States years ago, a business where insurers spotted a growth niche that’s now spreading fairly quickly in Spain, well beyond the large IBEX-listed companies that have carried cyber risk policies for some years already.

It’s true that cyber insurance isn’t the sole, sufficient answer to an incident, and companies still need to build (or contract specialized providers for) the specific incident response procedures and capabilities that complement the leadership team and the technical cybersecurity team in resolving it.

Given the sophistication and complexity of attacks, this business resilience capability in crisis situations can last weeks or months, as we’ve recently seen in attacks on Spanish companies, and it shouldn’t be underestimated in the slightest.

Given the extraordinary complexity surrounding cybersecurity, it’s essential that organizations understand the problem, “simplify” their analysis, and make the right organizational and financial decisions to be better prepared. It can be a matter of business survival, and unfortunately we’ll see more and more frequent examples of organizations that aren’t cyber-resilient and whose operations are seriously affected. It’s only a matter of time.