The COO's Guide to Cyber er Resilience: Part Four: Risks, Rewards & AI
The COO 180 Day Plan
The money is best spent where it narrows the gap between how long a critical service would really take to recover and how long the business can live without it. AI is now pushing on both ends of that gap.
Risks versus Rewards
Start with the cost. IBM's 2026 study puts the global average breach cost at $4.99m, up 12% on the year. For businesses that depend on physical operations, though, the average matters less than the worst case. Marks & Spencer lost hundreds of millions, and its insurance covered around £100m. Insurance will pay back some of the money. It will not refill the shelves, win back the customers who went elsewhere, or return the management time that went into recovery.
I would treat those averages with some care. The IBM figures are global, drawn from surveys and skewed towards large organisations, so they show which way things are moving rather than what will happen to any one business. A more useful number is your own. Work out what each critical service costs you for every day it is down, then multiply that by a realistic recovery time.
Investment | Reward | Risk if Under Done | Risk if Over Done |
Fundamentals (MFA, patching, backups, end of life kit) | Closes the most common entry routes at modest cost | Breach through a known, fixable weakness | Low. It is rarely over funded |
Segmentation and privileged access | Small incidents stay small | One compromise halts the whole operation | Friction that staff work around |
Third Party Assurance | Fewer inherited breaches and better leverage in contracts | Disruption imported from a supplier | Questionnaires that measure paperwork rather than control |
Detection and Response Service | Faster containment, lower cost per incident | Attackers present for months unseen | Alert volume nobody acts on |
Exercising and Manual Workarounds | Proven ability to keep trading | Plans that fail on first use | Exercise fatigue if scenarios are not varied |
New Security Tools | Specific capability gaps closed | Gaps left open | Tool sprawl, overlapping licences, weaker visibility |
Some of the rewards rarely make it into the business case at all. Insurers offer better terms, client due diligence goes through faster, and when a regulator or a major customer asks how you would keep operating, you have an answer you can stand behind.
Where AI fits: Advantage and Exposure
AI has sped up both attack and defence, but it has not really changed the nature of the fight. What the evidence now shows is that governance, far more than the technology, decides who comes out ahead.
The Advantage
Organisations that make heavy use of security AI and automation cut average breach costs by $1.93m and shortened the breach lifecycle by 65 days, according to IBM's 2026 study.
Most of that comes from triaging alerts faster, containing incidents sooner and freeing scarce analysts from routine work.
AI also earns its place in resilience work itself. It can read contracts to find notification clauses, map dependencies from system data and produce first drafts of plans and exercise injects, provided someone checks them.
The Exposure from Attackers
The same study found AI driven attacks rose 56% and added roughly $1m to the average breach. Verizon's 2026 analysis came to a more measured view, and it is the one I would plan around.
Its finding is that AI is mainly accelerating and scaling known attack methods rather than inventing new ones.
So the defence is the same set of fundamentals, done faster.
The Exposure from Inside
Staff using AI tools the business has not sanctioned is now one of the main ways data leaks out. Verizon found 67% of users accessing AI services on corporate devices did so with non corporate accounts, and Shadow AI is now the third most common way insiders lose data without meaning to. IBM reports shadow AI incidents rising from 20% to 43%, averaging $5.39m, while 68% of breached organisations had no AI governance policy.
The secondary sources do not agree on what the 43% is a share of (all breaches, or only AI related incidents), so I would read it as a clear trend rather than an exact figure.
Governing AI within the same Framework
• Publish a short list of approved tools and make it quick to ask for new ones. Ban tools without offering an alternative and people will simply use them out of sight.
• Set out in plain terms which data must never go into an AI tool, tied to the data classification you already have.
• Treat AI providers as you would any other critical supplier. Tier them, assess them and plan for the day they fail. At Lords committee stage the government declined to bring AI vendors into the Cyber Security and Resilience Bill, so that assurance is left to the buyer.
• Treat AI agents as identities. Give them least privilege, log what they do and require a person to approve anything that cannot be undone.
• Build AI scenarios into the exercise programme, such as data leaking through a tool, an agent being manipulated, or a key AI supplier going offline.
So for the COO the payback from AI is real, but it comes with a condition. Inside a governance framework it pays for itself. Adopted faster than it can be controlled, it becomes a liability.
Next steps: Using Armstrong's first 180 COO Days
We have kept the sequence below deliberately modest, because each stage produces the evidence the next one needs. Treat the timings as a suggested pace rather than a benchmark.
First 30 days Establish the facts | By 90 days Connect the disciplines | By 180 days Prove and fund |
☐ Agree the five to ten services that matter most and a provisional tolerance for each ☐ Ask the twelve questions from Part 2 and note which answers are backed by evidence ☐ Confirm who can isolate systems and cut supplier connections, in and out of hours ☐ Commission an inventory of AI tools in use, approved and otherwise | ☐ Stand up one resilience committee covering cyber, third party risk, continuity and crisis ☐ Map each critical service to its systems, data and top tier suppliers in one record ☐ Replace activity reporting with outcome measures ☐ Run an executive cyber exercise including a supplier failure and a 24 hour notification ☐ Publish an approved AI tools list and data rules | ☐ Restore one critical service end to end from backup and compare with its tolerance ☐ Rehearse a manual workaround for the most important service ☐ Renegotiate notification and evidence terms with top tier suppliers at renewal ☐ Take a funding case to the board, built on gaps you have tested ☐ Check readiness against the Cyber Governance Code and, where in scope, the Bill |
At six months, the real test is whether the COO can tell the board, with evidence, how long each critical service would take to recover from a serious cyber attack and what it would cost to close the gap.
Chris Oliver FBCI is Principal Director of Armstrong Resilience, the Channel Island's only qualified and experineced consulting and software house specialising in resilience, business continuity, AI, cyber security and third party risk management. hello@armus2.com
Comments