Before a cyber incident: four questions every business should ask

For Cybersecurity Awareness Month, Hamza Seedat, Cybersecurity Manager at ServiQual, shares what business leaders should consider before an incident puts their organisation’s readiness to the test.

Cybersecurity involves technology, but its impact reaches across the business. An incident can interrupt operations, affect cash flow, and put customer trust under pressure.

Preparing for that requires clear responsibilities, tested recovery arrangements and people who know what to do. We asked Hamza four questions about where businesses should start.

What do you wish business leaders understood about cybersecurity?

Cybersecurity is a business risk that happens to involve technology, not the other way round.

Attackers don’t always break in. They can log in using stolen credentials. When an incident hits, it rarely stays an IT problem for long. It can quickly become a cash-flow problem, a legal problem, and a trust problem.

The real question for leadership isn’t “Are we secure?” It’s “How quickly would we know something was wrong, and how quickly could we recover?”

What should businesses have in place before a cyber incident?

The worst time to exchange phone numbers is during a breach.

Businesses should have:

• An accessible response plan: clear names, roles and phone numbers, with an offline copy in case email and systems are down.
• Protected, tested backups: kept isolated from systems that could be compromised, with recovery tested by actually restoring data.
• Multi-factor authentication: particularly on email, remote access and administrator accounts.
• 24/7 Monitoring and a response process: arrangements to detect and act on suspicious activity, including outside office hours.
• Clear decision-making responsibilities: who can authorise shutting systems down, who communicates with clients and who contacts the insurer.

Preparation turns a crisis into a procedure.

Who needs to be involved beyond IT, and why?

If IT is the only team in the room during a cyber incident, you are already behind. Effective response takes the whole organisation.

• Leadership makes decisions about operational disruption, business priorities and recovery.
• Finance is the last line of defence against payment fraud, including fake invoices and requests to change bank details.
• Legal and compliance help assess reporting obligations and applicable deadlines.
• HR coordinates with IT and managers so access reflects people’s responsibilities and is removed when they leave.
• Communications keep employees, clients and other stakeholders informed, so they hear the story from you first.

And every employee has a role in reporting concerns promptly. Someone flagging a suspicious email can give the team an opportunity to investigate before the situation escalates.

People should know their responsibilities before an incident, rather than discovering them during one.

What is one practical step businesses can take this month?

Run a 30-minute “what if” session with your leadership team.

Put one scenario on the table:

“It’s Monday, 8 am. Our team cannot access critical files, and there is a ransom note on screen. What do we do?”

Then work through the questions. Who decides what happens next? Who do we call? Where are the backups? Which operations need to be restored first?

Pay attention to where the room goes quiet. Those gaps give you a starting point for improvement. Assign someone to each action and agree when it will be addressed.

A short discussion will not replace a full incident exercise, but it can reveal assumptions that need testing.

“Awareness lasts a month. Readiness has to last all year.”
- Hamza Seedat, Cybersecurity Manager, ServiQual

Need help reviewing your business’s cyber preparedness? Talk to the ServiQual team.