It seems hardly a week goes by without another prominent business being targeted by cyber criminals, leaving it defenestrated, emasculated, and, in the most serious cases, on the brink of collapse. 

Microsoft, United Natural Foods, LKQ, M&S, Harrods, Aflac and Asahi – the roll call of victims is as long as it is terrifying.  In the case of Jaguar Land Rover, the threat caused by an unprecedented £1.9billion data breach earlier this year was considered existential, prompting a deep rethink of Britain’s cyber readiness. 

The most expensive attack in UK history, it forced a shutdown of JLR’s global manufacturing operations. The company is now in a slow process of recovery, prompting experts to question the nation’s defences against the growing wave of cyber threats. 

These are not obscure technical failures; they are front-page news events that disrupt supply chains, compromise customer data, and inflict severe reputational damage. The reaction from other businesses is concern for themselves: If it can happen to others, it can probably happen to us. 

It is estimated that there are 600 million cyber attacks every day, according to the Identity Theft Resource Center (ITRC) Annual Data Breach Report. By the end of this year, it is anticipated cyber cybercrime will cost the global economy $10 trillion a year, according to a report for the World Economic Forum. 

This has created a climate of urgency, moving cybersecurity from a technical checklist item to a core board-level concern with direct implications for legal compliance, ethical responsibility, and commercial survival. 

At a recent local business exhibition that I attended, no one talked to us about IT support; it was all about cybersecurity and AI. The “plumbing” of business technology – keeping computers running and networks connected – is now taken as a given. The premium service, the topic that generates anxiety and interest, is protection from digital threats and leveraging new tools for competitive advantage. 

A Global Professionalised Adversary 

The traditional image of the hoodie-wearing, politically motivated hacker, sitting alone in his bedroom, using his precocious skills to infiltrate professional data security infrastructures, is now a dated figment.  

Today’s cybercriminals operate as cogs in a highly organised, often state-sanctioned professional operation, with the efficiency and specialisation of multinational corporations. 

The motivation of around 95% of attacks is now financial, according to the 2025 Verizon Data Breach Investigation Report, marking a dramatic shift from a decade ago, when ideological and recreational attacks were more common. 

In web application attacks, for instance, “fun” attacks have plummeted from nearly two-thirds to just 1%.  

This change is fuelled by the dominance of organised crime groups, whose involvement in external breaches has soared from 19% in 2009, to more than 70% in recent years, as they recognise cybercrime as a high-profit, low-risk enterprise. 

To achieve this, criminals primarily monetise attacks through three direct methods: Business email compromise (BEC) scams for direct theft, data theft for resale (with stolen credentials used in nearly half of external breaches), and ransom.  

Ransomware alone is now involved in nearly a quarter of all breaches, often using “double extortion” tactics. Supporting this is a vast criminal economy offering specialised “as-a-service” products, from malware and phishing kits to stolen access, allowing for unprecedented specialisation and raising the threat level for all organisations. 

Just as a legitimate business might outsource its legal or marketing needs, cybercrime syndicates have experts dedicated to hacking specific platforms, like Microsoft 365, Zoom, or Apple Macs.  

Others specialise in the financial mechanics, such as processing Bitcoin ransom. This division of labour allows for a high degree of expertise and efficiency, making the entire criminal enterprise more potent and resilient. 

Aspiring cyber criminals no longer need advanced coding skills; they can simply purchase a ready-made attack kit on the dark web, complete with technical support and profit-sharing models. 

Victim Profiling and Psychological Manipulation  

The level of sophistication extends beyond technology, into the realms of marketing and psychology.  

Attackers actually profile their victims, researching target companies, assessing their size, industry, and geographic location to determine the optimal ransom demand.  

They know that the market rate for the ransom of a ten-person firm in Sunderland, for example, might be £5,000 – a sum deemed payable – whereas a London-based financial firm would be targeted for a much greater sum.  

This calculated approach maximises the likelihood of payment, treating extortion as a data-driven business decision, rather than a random act of vandalism. 

The threat is also state-sanctioned, with North Korea and Russia as the primary actors, using cybercrime as a mechanism for generating revenue, effectively making ransomware a tool of national fiscal policy. The collaboration between nation-states further blurs the lines between cybercrime and cyber warfare, creating adversaries with vast resources and a sense of impunity. 

Business Impact and the Cost of Complacency 

The consequences of failing to adapt to this new threat can be severe, even existential. Earlier this year Knights of Old, a 158-year-old haulage company based in Northampton, went bust as a result of a data breach originating from a weak password.  

A successful ransomware attack can encrypt critical data, halt operations, and destroy customer trust, creating a financial and reputational hole from which many small and medium-sized businesses cannot recover. 

The role of Artificial Intelligence (AI) in this landscape is double-edged. It can be a powerful weapon for attackers, but also the most promising shield for the defenders. 

AI can automate the creation of highly convincing and personalised phishing emails at an immense scale, making social engineering attacks far more effective.  

It can help criminals rapidly identify new software vulnerabilities and develop exploits faster than ever before.  

The Evolution of Defence 

In response to this escalating threat, strategies for defence have undergone a parallel revolution. The traditional approach was signature-based antivirus software, a reactive model that relied on a database of known malicious code signatures – akin to a list of known criminal fingerprints.  

While effective against established threats, this system was inherently vulnerable to new, unknown attacks – the so-called “zero-day” threats.  

Updating signatures was a constant game of catch-up, leaving a critical window of exposure between the discovery of a new threat and the deployment of its counter signature. 

The new paradigm, driven by necessity, is a shift to AI-driven behavioural analysis. This represents a fundamental shift, from looking for what is known to be bad, to identifying what is abnormal.  

These AI-powered systems build a sophisticated baseline of normal activity for every user and device on a network. They learn that a particular user typically logs in from the same location between 9 am and 5 pm, for example, and that they primarily access email and specific spreadsheets, using a particular device or laptop.  

If, suddenly, a login attempt occurs from another location at 2 am from an unknown device, and that user immediately starts trying to download the entire customer database, the system flags this as highly anomalous behaviour. It can then automatically trigger alerts, block the user, or isolate the affected systems. 

This proactive stance is the only effective counter to the professionalised criminal. It addresses the “zero-day” problem by focusing on the behaviour of an attack, rather than its specific, previously unseen code.  

Newer AI tools are better at looking at those because they are behavioural rather than signature-based. This evolution mirrors the business world’s own shift from reactive problem-solving to proactive, data-driven strategy. 

Keeping one step ahead of the bad guys is the name of the game because in a year, there may be a new paradigm of technology that creates new risks and demands more innovative protection. In the meantime, all we can do is to ensure we are as threat-ready as we can be.