Cyberattacks: Business Continuity and the Risks We Underestimate

The psychology and its limits

Comparative optimism describes judging a negative outcome as less likely for oneself than for comparable others. Mary Sissons Joshi and Wakefield Carter’s 2013 research examined likelihood judgments across life events among middle-aged, middle-income participants in India and England. Patterns depended on the event and context. [3]

That study did not observe cybersecurity behaviour or diagnose business owners. A confident owner may have excellent protection, poor protection or simply incomplete information. Calling the person biased does not tell us which is true. [3]

The practical response is to replace a general feeling with a specific test. “Could we restore this file?” and “Who can regain control of the booking account?” are answerable questions. A recovery rehearsal gives the team something more useful than either reassurance or fear.

A practical six-step workflow

These are Maqtrix’s proposed applications to test, not outcomes established by the brand story or a promise of results.

1. Map one transaction

   Choose the journey with the greatest immediate customer impact: receiving an enquiry, booking a visit or collecting a payment. List the accounts, devices, people and outside providers needed for it. Keep the map short enough to use during an interruption.

2. Name the account owners

   Identify who has administrative access and who can contact each provider. Use individual access where possible, protect accounts with available multi-factor authentication, and review access when a team member leaves. Store recovery information securely and restrict it to the people who need it.

3. Check the recovery copy

   Identify what information must be backed up and how frequently it changes. Confirm that a backup exists independently of the affected system and that an authorized person can restore a sample. A backup dashboard showing success is not the same as a completed restore test.

4. Prepare a trusted verification route

   Document how unusual bank-detail changes or payment requests will be checked. Contact the supplier through a previously known route, rather than using a new number embedded in the suspicious message. Make the same process available to busy staff and the owner.

5. Rehearse a limited interruption

   Use a tabletop scenario rather than deliberately disabling production. Ask what the team would do if email or booking access were unavailable for a morning. Record missing contact details, unclear authority and any customer promise that could no longer be kept.

6. Repair the gaps and repeat

   Assign each gap to a named person with a completion date. Rehearse after a significant system or staffing change. Keep a simple customer-update template ready so the team can communicate accurately without improvising a technical explanation.

A small-business example

A hypothetical home-service company receives bookings through its website and sends confirmations by email. In a rehearsal, it discovers that the only copy of tomorrow’s schedule is inside the same account used for email. The useful outcome is the identified dependency—not a claim that an attack has been prevented.

The team can then establish an appropriately protected alternative schedule and decide who will communicate with customers during an outage. It should test access to that alternative without exposing customer information in an unsecured shared document.

What to measure

Track which critical accounts have a responsible owner, whether recovery tests succeed, time needed to locate emergency contacts, and unresolved gaps from rehearsals. Avoid using the absence of an incident as proof of security. For marketing, also check whether the backup contact route actually reaches a staffed inbox and whether the public information stays accurate.