Why cyber incidents at one organisation have an impact throughout the entire chain

PwC’s research paper 'When one firm falls, many pay: The economic ripple effect of cyber incidents' highlights some of this hidden impact. The analysis focuses on the loss of productivity within the organisation directly affected and the resulting economic effects in other sectors. The report arrives at an average multiplier of at least one and a half: for every euro of direct productivity loss, on average, a further half-euro is lost by organisations in dependent sectors. 

The key findings of our research

• For every euro of direct productivity loss caused by a cyber incident, organisations in dependent sectors incur an average additional loss of half a euro. The negative economic impact on productivity is therefore, on average, at least one and a half times greater than the direct productivity loss.
• The multiplier is an average. The exact impact depends in part on the position of an organisation or sector within the economic network. The more parties that depend on it, the greater the potential ripple effect.  
• Only sixteen per cent of organisations quantify cyber risks to any significant extent. This means that 84 per cent do not measure rigorously enough, making it difficult to factor in the potential financial impact of cyber incidents when making decisions. 
• AI may further increase the risk. AI attackers can help identify vulnerabilities and structurally critical points in supply chains, enabling attacks to be targeted specifically at organisations for which the economic impact may be greatest. 

Anyone who focuses solely on the direct damage caused by a cyber incident is therefore seeing only part of the economic risk. This calls for a different perspective on cyber resilience: looking not only at the organisation’s own systems, but also at its position and dependencies within the wider economic ecosystem.

Read the full report

From an individual cyber incident to economic disruption

A cyber incident can slow down production processes, disrupt service provision or block access to essential information. The damage is therefore not limited to the organisation affected. If a supplier is unable to deliver, customers may also suffer losses in production and turnover. Because processes, systems and contracts are often closely interlinked, it is not always possible to switch to another partner at short notice.

The cyberattack on Maersk in 2017 made this painfully clear. Whilst this is an incident from some time ago, it has been thoroughly investigated and documented. Port terminals and logistics processes were disrupted worldwide, and Maersk itself reported a loss of more than three hundred million US dollars. But the most striking fact of all is that Maersk was not the original target of the attack. The attack spread via interconnected systems and subsequently affected Maersk. 

The lesson goes beyond Maersk itself: an organisation does not need to be the target of a cyberattack to suffer significant economic damage. The relevant question is therefore not only whether your own organisation will be attacked directly, but also through which external channels a disruption might affect you.

Cyber incidents cause greater productivity losses than is immediately apparent

Our research focuses on the loss of productive capacity and its knock-on effects in other sectors. As previously mentioned, the average multiplier is one and a half. The total macroeconomic damage to productive capacity is therefore, on average, fifty per cent greater than the direct loss incurred by the affected organisation. 

AI can further accelerate the threat

Added to this is a new development: artificial intelligence (AI). Our research shows that AI can accelerate a cyber threat. AI can not only help attackers find vulnerabilities, but also identify structurally important links within a chain. This creates the risk that attacks will increasingly target those organisations to which a disruption could cause a relatively large economic ripple effect. 

This makes it even more important to understand supply chain dependencies. It is not simply a matter of ensuring the security of one’s own organisation, but also identifying vulnerabilities and dependencies that could exacerbate an incident.

From reactive recovery to proactive resilience

According to another PwC research about cybersecurity the inability to respond to AI incidents is the biggest shortcoming in digital preparedness. This lends added urgency to the economic multiplier. If the impact of an incident is not confined to one’s own organisation, it is not enough to focus primarily on being prepared for recovery once something has gone wrong.

This leads to four specific priorities:

1. Identify critical processes. Determine which activities must continue to operate at all costs if systems, suppliers or other essential links experience failures.
2. Make chain dependencies explicit. Do not focus solely on direct suppliers, but also on the external parties on which the continuity of crucial processes depends. After all, the multiplier analysis shows that productivity losses can spread through production networks. 
3. Test recovery processes in collaboration with key partners. This is particularly relevant given that, in the Netherlands, only eight per cent of organisations invest significantly more in proactive cybersecurity than in reactive cybersecurity. 
4. Integrate cybersecurity systematically with business continuity and financial decision-making. Given that 84 per cent of organisations do not quantify cyber risks to any significant extent, there is a clear opportunity here to better link cyber risk to business value and continuity. 

It is also up to the authorities to act 

Because the damage caused by cyber incidents is partly borne by other organisations, individual companies may invest less in cyber resilience than is socially desirable. Public authorities should therefore prioritise supervision, resilience programmes and public-private partnerships for those organisations and sectors whose failure would have the greatest impact on the rest of the economy. In addition, a consistent national database is required, which records not only incidents and direct financial losses but also the duration of downtime, the loss of productive capacity and the impact on suppliers and customers. This will enable us to determine sector-specific multipliers more accurately and implement policy in a more targeted manner.

From multiplier to minimum viable company

Our research ties in directly with the concept of the minimum viable company (MVC): what processes, people, systems and external partners are the absolute minimum required to continue carrying out the most essential activities during a serious disruption?

It is therefore not only a question of identifying which systems need to remain operational, but also on which external parties those processes depend. The multiplier highlights the economic risk posed by that interdependence. MVC then helps organisations determine which dependencies are crucial to their survival during a serious disruption.

By identifying critical dependencies and jointly testing recovery processes, your organisation can invest more effectively in resilience. In doing so, you not only safeguard your own business continuity, but also reduce the risk of a disruption spreading via your supply chain.

How great is the actual economic damage?

The multiplier of one and a half should be interpreted as a minimum estimate of the economic impact. In our study, we measured the impact of lost productivity. Due to limitations in the available data, we are unable to determine the full economic impact of all cyber incidents in the Netherlands. 

The actual damage may therefore be greater than the multiplier alone suggests. This means that the model’s limitations are, in fact, part of the message: even when considering only the measurable effects of the loss of productivity, a substantial economic impact already exists.

Frequently asked questions about the economic impact of cyber incidents