News

Cyber resilience isn't measured in firewalls. It's measured in minutes.

Time has quietly become the biggest driver of cyber costs. For years, we've measured cyber security success by what organizations could stop. How many attacks were blocked? Which vulnerabilities were patched? How much was invested in the latest security tools?

They're no longer the questions that matter most.

It isn't a groundbreaking observation to say the threat landscape has changed. Attackers are moving faster, AI is accelerating both offensive and defensive capabilities, and businesses are becoming more digitally connected than ever before. If we accept that no organization can eliminate cyber risk entirely, then our definition of resilience has to evolve too.

The organizations that emerge strongest aren't necessarily the ones that avoid being breached. They're the ones that detect, respond and recover fastest.

Our latest Grant Thornton Finance Leaders Barometer found the average financial impact of cyber incidents now stands at £488,000 over a two-year period, with 82% of CFOs reporting they've experienced a cyber incident with direct financial consequences. Crucially, the cost of an incident is increasingly determined not by the breach itself, but by how quickly leadership teams understand what's happened, make decisions and restore operations.

Every hour spent identifying the issue, establishing ownership or waiting for decisions and ensuring notifications are made to meet regulations, compounds operational disruption, financial loss and reputational damage. Increasingly, organizations aren't judged on whether they experience a cyber-attack. They're judged on the quality and speed of the decisions made in the aftermath.

In the immediate aftermath of an incident, the conversation shifts away from compromised systems and malicious code towards operational disruption, financial impact and business continuity. Boards aren't asking which vulnerability was exploited or whether identity controls failed. They're asking how much it's going to cost, how long operations will be affected, whether customers, supply chain and regulators need to be informed, and what happens next.

This creates an uncomfortable tension for many organizations. Cybersecurity is fundamentally about risk management, spanning people, processes and technology. While many of the security controls used to mitigate cyber risks are technology-led, they are underpinned by organization-wide processes, policies and decision-making.

Accountability therefore extends well beyond technology teams, with finance leaders and boards increasingly expected to understand and make high-stakes decisions around cyber risk. Yet our research found that 79% of CFOs say ownership of key business risks remains unclear across their organization – a particularly significant gap when speed is critical and decisions can carry financial, operational and reputational consequences.

The organizations that respond best are those that have already decided who owns risk, who makes decisions, how issues escalate and what level of risk the business is prepared to accept. In other words, resilience isn't just about having the right controls in place – it's about ensuring the right conversations have happened long before an incident occurs.

If organizations are going to make better decisions about cyber resilience, they first need to change the conversation. One of the biggest barriers isn't a lack of investment, it's a lack of translation. Cyber teams naturally talk about identity management, endpoint detection or upgrading legacy infrastructure. All important priorities, but they're not the language boards and CFOs use to make investment decisions.

Finance leaders are asking different questions. How does this protect revenue? What operational disruption could it prevent? What's our potential financial exposure?

The organizations making the most progress are those that can bridge that gap. Rather than presenting cyber as a technology upgrade, they frame it as a resilience investment – protecting business continuity, customer trust and shareholder value. That shift in language changes the conversation from "How much does this cost?" to "What would it cost us if we didn't do it?"

Ultimately, cyber investment shouldn't be justified by the sophistication of the controls being deployed. It should be measured by the business outcomes it enables; reducing downtime, improving recovery, protecting critical operations and giving leadership teams confidence they can respond decisively when disruption occurs.

With the cyber landscape evolving rapidly, it can be difficult to predict exactly where investment will be needed one or two years ahead. Organizations therefore need enough flexibility within budget cycles to adapt investment and controls as new threats emerge, rather than being constrained by priorities set at the start of the budgeting period.

Artificial intelligence is changing cyber security in two directions at once. Attackers are already using AI to identify vulnerabilities, automate reconnaissance and increase the speed of attacks. At the same time, recent advances in frontier AI models have demonstrated just how quickly AI tools can uncover software vulnerabilities at a scale previously impossible for human teams alone.

The result isn't simply a more sophisticated threat landscape – it's a faster one.

Leadership teams have less time to understand what's happened, assess the commercial impact and make informed decisions. The organizations that respond well won't necessarily be those with the most advanced AI capabilities. They'll be the ones that have already agreed who makes decisions, how incidents escalate and what business priorities take precedence before an attack occurs.

Organizations need to rethink what good looks like. The goal is no longer to create the illusion that cyber risk can be eliminated; it's to build confidence that the business can make good risk based decisions when disruption inevitably occurs.

That requires more than better technology. It requires clearer ownership, stronger governance and a shared understanding of risk across the organization. In many ways, cyber has become the clearest test of organizational resilience, not because attacks are inevitable, but because they reveal how well leadership teams perform when certainty disappears.

Ultimately, the organizations that come through incidents strongest won't necessarily be those with the best security tools. They'll be the ones whose leaders have already had the difficult conversations, made the key decisions and built the confidence to act when it matters most.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

The Anycubic Photon P1 Max 3D printer has a massive 18.3L build volume, giving you room for large resin creations models, and it's on sale at Amazon right now.

• Best for: Experienced makers, designers, engineering teams, and small businesses that need a large-format resin 3D printer for bigger models or batch production.

• The deal: The Anycubic Photon P1 Max is now $850 (was $900) at Amazon, saving you $50.

• Why it matters: Its combination of automated calibration, resin heating, and intelligent monitoring is designed to reduce the need for manual intervention during demanding printing projects.

Photon P1 Max Large Resin 3D Printer: was $899.99 now $849.99
This large-format resin 3D printer features an 18.3L build volume, 14-inch 12K LCD, LighTurbo 3.0 light engine, automatic leveling, AI inspection, 1.9L heated resin tank, and ±0.01mm repeatable accuracy.View Deal

The Photon P1 Max has an enormous 11.24 x 8.43 x 11.81-inch build area, providing 18.3L of printing capacity. A 14-inch 12K LCD works with Anycubic's LighTurbo 3.0 light engine to reproduce fine details, and the printer also offers a claimed repeatable accuracy of ±0.01mm.

Its Auto-Leveling 3.0 system automatically calibrates before printing and checks all four corners. The 1.9L heated resin tank can maintain temperatures up to 35°C, helping keep resin at a suitable working temperature.

In his 4.5-star review of the Photon P1, a smaller resin printer, our expert Alastair said it had "been designed for makers and engineers looking for the next step-up." He added that "Focused around a 14K LCD, the machine features a ball screw Z-axis, heated resin vat, and Wave Release Technology, all in a relatively compact machine. But it’s the option for the dual-material printing with the optional kit that many will find of the most interest."

He explained that "Through the test, I managed a near unheard of 100% success rate on 20+ prints, and the quality from the 14K screen was exceptional, even with a low workshop temperature; the heated vat kept everything running at optimum temperatures."

While the P1 Max has a lower-resolution 12K screen, it offers almost three times the build volume of the P1, so is better suited to larger models and batch printing.

Amazon has reduced the Anycubic Photon P1 Max from $899.99 to $849.99, knocking $50 off its listed price. While that's not a massive saving, this is the cheapest price we've seen this printer model selling for on Amazon.

✅ Buy the Anycubic Photon P1 Max if...

You regularly work on large resin prints or need to produce multiple components in a single batch. Its generous printing area and automated features make it particularly attractive for more demanding projects.

❌ Skip the Anycubic Photon P1 Max if...

You're new to resin printing or mainly create small miniatures and occasional decorative models. A smaller resin printer, like the P1, will cost less and take up less desk space.

Photon P1: was $789.99 now $521.99
If the P1 Max is too large for your needs, the standard P1 is a smaller resin 3D printer well-suited to accurate models and prototypes. It scored 4.5 stars in our tests, and we found it ideal for engineers and makers. View Deal

• Shop all 3D printers at Amazon

• Dyson Total Restore is a door-to-door cleaning and restoration service
• It's available for Dyson's cordless and wet floor cleaners
• It costs £99.99 and is now available in mainland Britain

If your vacuum cleaner or floor cleaner needs some love, Dyson has just launched a new refresh and restoration service that will get it working like new (or as close as possible). Dyson Total Restore, now available in the mainland Britain, is a door-to-door service that aims to improve your cleaner's performance and extend its lifespan

For £99.99 (plus the cost of any repairs not covered by your warranty), the cleaner will be collected from your home and delivered to Dyson's service and repair centre in Chippenham, where engineers will carry out an engineering assessment, which covers areas such as airflow, battery health, and motor performance.

Engineers will then complete an industrial-standard deep clean to improve the performance of your machine, fix repairable faults, and replace damaged or worn components with genuine Dyson parts..

Once the service is finished, your floor cleaner will be returned along with a label showing the last service date, and any replacement filters or wet rollers required. You will also received digital photos, a digital health check report, and a digital certificate of service.

"It's offering to consumers a better service and allowing our machines to be looked after and giving them a second wind," Dyson's Chief Engineer, Jake Dyson, told my colleague Ruth Hamilton in a recent interview. "So, if they come in for a spa day, they go back in the same condition they were when they were new. So, you always start again on the reliability curve and the abuse curve."

Dyson Total Restore is available for cordless vacuums (from the Dyson V7 through to the V16 Piston Animal), as well as wet cleaners like the Dyson WashG1 and PencilWash. To find out whether your cleaner is supported, log in to your account on Dyson's website and select the ‘My Products’ page. Eligible machines will be clearly labelled.

If yours isn't included, or you're thinking of buying your first Dyson cleaner, take a look at our complete list of the best Dyson vacuums.

Dyson Total Restore is currently only available in Great Britain, but is expected to roll out internationally in the future.

• AI has replaced entry-level work, so graduates are being hired to manage AI
• Goldman worries about its impacts on existing middle managers
• "We don’t quite know what’s going to happen to that group"

Goldman Sachs exec Kevin Sneader has shared (via Bloomberg) how he believes AI could change jobs in banking, and it doesn't necessarily mean that junior workers will be at a loss for jobs.

Instead, Sneader believes that new employees will take on management responsibility immediately, rather than waiting years for promotions.

Previously, young workers would have spent the first few years performing administrative work before progressing into management positions, but rather than progressing into managing humans, junior workers will now start off managing AI.

With agentic AI now capable of carrying out the routine, administrative tasks that junior workers used to do, entry-level roles will no longer be available. But that doesn't mean there's no room for new graduates – it just means that they'll need to oversee the AI doing those jobs.

"When our young folks now start work, they’re managing agents," he said. "They have to make the most of this virtual army that they’ve now got."

However, there is potentially one group of workers at risk from AI's impacts, and it could be middle management. In short, graduates being employed to manage AI could threaten the job security of middle managers, who would previously have looked after those graduates.

"We don’t quite know what’s going to happen to that group," Sneader added.

More broadly, it could mean that AI challenges the pyramid-like ladder that sectors like banking have previously worked to. If businesses no longer need large numbers of entry-level workers thanks to AI, it means they need fewer middle managers and fewer leaders, which could indeed have adverse impacts on jobs – just not for graduates.

The takeaway from this particular message isn't one of graduate unemployment, but rather a broader shift away from traditional working patterns and how it could impact the more experienced workers.

• License costs are a worry for 90% of VMware customers
• Multi-vendor and security complexities are limiting migration for many
• Some customers are staying with VMware but sourcing their own support

A new study has claimed a staggering 90% of decision-makers are considering VMware alternatives purely based on licensing costs.

But following other changes made to the virtualization stack under its not-so-new Broadcom ownership, two in three (66%) of those surveyed by Rimini Street are also considering third-party support.

That said, there's a big step between considering leaving VMware and actually migrating away, and many face the reality of not being able to without incurring high costs or encountering technical difficulties.

Broadcom's licensing changes are the biggest offender, the study shows, with 90% of those considering an alternative impacted by higher licensing costs and 54% unhappy with the end of support for perpetual licenses.

Despite very clear dissatisfaction, half (48%) of existing perpetual licence customers don't actually have any plans to move away from VMware Cloud Foundation.

Still, the wheels are in motion with three in five surveyed businesses considering multi-hypervisor strategies, potentially as the first stage in a multi-step process to move away from VMware. The journey ahead isn't so simple, though, with operational complexity (40%), managing multiple vendors (38%), handling security with an expanded attack surface (37%) and ups killing workers (37%) all cited as challenges.

"The shift for current VMware users is not simply about replacing one vendor with another. It reflects a broader effort by enterprises to reduce dependency on a single provider," Unisphere lead analyst Joe McKendrick explained.

What we're seeing more of, though, is the adoption of third-party support for existing VMware packages instead of total migrations away from the company. One in five (18%) are already using third-party support.

"For many organizations, that means balancing support for existing environments with new investments designed to improve resilience, security and scalability over time," McKendrick added.

• Attackers hijacked three country-code domains to obtain fraudulent HTTPS certificates for major websites
• Fake certificates could enable convincing traffic interception and phishing against affected domains
• Google revoked the certificates, protected Chrome users, and warned impacted organizations

Cybercriminals recently managed to hijack three country-code top-level domains (ccTLDs) and used the access to generate HTTPS certificates covering several Google domains, as well as those belonging to other organizations. Google said the attack placed thousands of websites at risk, but stressed that the certificates have since been revoked.

According to Google, the domains that were hijacked are .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). During the attacks, the threat actors modified authoritative DNS records, obtaining HTTPS certificates covering not just Google, but other organizations, too.

In other words, any website operating on these domains was at risk, as well as all of the visitors. By manipulating authoritative DNS records, threat actors could redirect traffic away from legitimate websites and towards malicious ones under their control, all the while telling users they were visiting the legitimate one by showing the padlock icon. Visitors entering login credentials, payment information, or other data, would easily lose them to the attackers, and depending on the circumstances, they could also end up installing malware.

“Due to the nature of the attacks, we have no reason to believe the Certification Authorities (CAs) that issued the impacted certificates did anything wrong,” Google said.

Although Google blocked the unauthorized certificates in Chrome and worked to have them revoked, it warned that its interventions might not have identified every affected domain or protected users of other browsers.

“As part of our usual incident response process, we immediately acted to protect users by blocking the use of unauthorized certificates for Google properties in Chrome via CRLSets,” Google added. “We also worked with the issuing CAs to ensure the certificates were revoked to protect users in clients other than Chrome.”

The risk for websites wasn’t theoretical. Google said “several leading global brands and widely used online services” were impacted by these attacks, and stressed that all of the certificates used in these attacks were blocked.

“Where possible, we reached out to impacted organizations to alert them to our findings and actions,” Google concluded. The company did not say which of its own domains were affected, and did not want to name the victim companies. We also don’t know how many organizations were impacted.

Chrome users don’t need to take any action to be protected, it was said, but domain owners do have a thing or two to do. That includes performing ongoing monitoring of Certificate Transparency for all of the domains, and publishing restrictive CAA records with ACME account bindings.

Attacks like this have happened before - in 2011, cybercriminals compromised Dutch Certificate Authority DigiNotar, generating 531 fraudulent certificates for domains belonging to Google, Microsoft, Mozilla, Skype, and more. Some of these certificates were allegedly used to intercept encrypted communications of Iranian internet users, and the incident ultimately forced major browser vendors to withdraw their trust in DigiNotar, putting the company out of business.

Earlier that year, threat actors stole an account belonging to a registration authority partnered with Comodo, obtaining nine fraudulent certificates for domains operated by Google, Yahoo, Microsoft, and others. Something similar happened in 2015, when Google discovered that Symantec's Thawte-branded Certificate Authority had improperly issued an unauthorized certificate during internal testing, covering Google's domains.

This incident, however, was more of an internal failure and less of an attack. Subsequent investigations uncovered numerous additional misissued certificates.

“In parallel with domain-owner defenses, we will continue to work alongside the broader community to limit the impact of transient routing and DNS compromises on the safety of the web,” Google concluded. “To keep our users safe, we are committed to long-term HTTPS ecosystem improvements, such as reducing certificate validity and DCV reuse, through the Chrome Root Program and the new Chrome Quantum-resistant Root Program.”

Via Ars Technica