The Cost of a Cyber Incident
The panel “Cyber Risk Evolution: Who Really Pays the Price?” focuses on consequences beyond the IT department. Participants plan to discuss the effects on operations, customers, reputation and finances, as well as the role of insurance. The programme also asks whether cyber risk can be transferred to another party or whether a company must still manage it itself.
A small business manager can assess risk by looking at day-to-day processes. If email, accounting software or shared documents are unavailable for a day, which customer enquiries would go unanswered, which invoices would not be issued on time, and which commitments would be at risk? Restoring access would account for only part of the losses. A downtime assessment should consider lost revenue, the impact on customers and responsibility for restoring operations.
What Happens When a Supplier Has an Outage?
The “Supply Chain Under Pressure” panel focuses on how organisations depend on one another. According to the programme, participants will examine how a cyber incident affecting a supplier or partner can disrupt other companies. Business continuity and crisis management are among the announced topics.
For small businesses, these dependencies are part of everyday operations. Orders may arrive through an external platform, payments may be processed by a separate provider, and working files may be stored in the cloud. The company does not control these suppliers’ infrastructure, but it remains responsible for serving its customers. When examining examples, key questions are how quickly a company learns about an incident, who contacts the supplier, and which operations can continue until service is restored. Approaches used by large organisations would need to be adapted to the resources of a smaller team.
Who Makes Decisions During an Incident?
The panel “The Future of SOC, CERT Operations: AI, Network Intelligence and Cyber Resilience Beyond Compliance” focuses on security monitoring, incident response, automation and business resilience. The panel on critical infrastructure will address the first 60 minutes of a serious incident. The methods used by specialist teams may be complex for a small company, but clear responsibilities matter regardless of company size.
While an IT specialist investigates the cause of an outage, a manager must decide which operations to pause, how to contact employees and what to tell customers. If responsibilities have not been defined in advance, reaching those decisions can take longer. Pay attention to how speakers distinguish technical tasks from business decisions: who assesses the threat, sets priorities and handles communication. It is important to identify who can take on these roles in a small team.
The Cyber Security Summit programme is preliminary and may change. After the conference, we will separately review the conclusions and examples to assess their relevance to small businesses in Serbia. Current topics and speakers are listed in the organiser’s programme.
