For 46 days, one of Britain's best-known retailers couldn't take a single online order for clothes.

It started on April 25, 2025. Marks & Spencer stopped taking clothing and home orders on its website and app after a cyberattack.3

Inside the company, people did what good people do in a crisis. They kept the business alive by hand. M&S switched to manual processes to keep stock moving. It worked, but it was slow and expensive. The company reported extra waste and logistics costs, and food shelves in some stores ran thin.4

Then came the bill. M&S expected the attack to cut about £300 million from its operating profit that year.4

Think about where that money went. Some of it went to investigators, lawyers, and consultants. But much of it was simply the work that couldn't happen. Orders nobody could place. Stock that sat in the wrong place. Food that spoiled before it reached a shelf. Hours of people doing by hand what machines used to do in seconds.

Running a business by hand is heroic. It's also a slow leak. It buys you days, not months, and every day costs more than the last.

A few months later, the same lesson hit a factory floor.

In late August 2025, Jaguar Land Rover was hit by a cyberattack. It shut down its systems and stopped building cars around the world. Its big UK plants went quiet. A company that normally builds about 1,000 cars a day built none. The shutdown lasted about five weeks.5

And the damage didn't stay inside the company. The smaller firms that make JLR's parts had nowhere to send them. The pain spread down the supply chain. An independent group, the Cyber Monitoring Centre, estimated the total hit to the UK economy at about £1.9 billion, affecting more than 5,000 UK organizations.5 That is an outside estimate, not a JLR number. JLR's own numbers were bad enough: a £485 million loss before tax and one-off items for July to September, plus £196 million in one-off costs from the attack.5

Five weeks. A thousand cars a day. More than five thousand organizations. That is what a stopped supply chain looks like. One company goes dark, and the suppliers, the workers, and the paychecks down the line go dark with it.

Most leaders are worried enough already. I share these stories for a different reason. They change the question your company should be asking.

The old question was: how do we keep attackers out of our servers?

The new question is: if something on our network is taken over tonight, can we stop it without stopping the operation?

The rest of this book answers it.

Questions for your team

If you had to run one building by hand tomorrow, which tasks would stop first? What would a day of that cost you? Do you know which connected devices those tasks depend on?