How do you prepare a company for a cyberattack?

The first dimension — and the most commonly overlooked — is organisational rather than technical: who decides what, within what timeframe, with what authority, during a major incident? Without a clearly defined crisis unit, an organisation loses precious time exactly when every minute counts.

The second dimension is communication. A poorly communicated incident causes confusion internally; poorly communicated externally, it erodes customer and partner trust far more durably than the technical incident itself. Pre-drafted message templates save critical time when it matters most.

The third dimension is business continuity: which critical business processes must keep running, even in degraded mode, and through which fallback procedures? This thinking has to happen before the incident, with the business units involved — not improvised mid-crisis.

The fourth dimension, often the most revealing, is rehearsal. An incident response plan that has never been tested remains a theoretical hypothesis. Even a simple tabletop exercise exposes, within a few hours, organisational gaps that a document review would never catch.

Finally, preparation should include a systematic lessons-learned mechanism after every exercise or real incident. It is that continuous loop — prepare, test, adjust — that turns a vulnerable company into a genuinely resilient organisation.