Halden Logistics: prioritising a £3m cyber programme after a ransomware outage

Evaluate each component on risk reduction per pound and dependency

• Identity and access management with MFA (£900,000). Highest leverage. Credential compromise and privileged access are the most common route to ransomware. MFA, least privilege and removal of standing administrative accounts block initial access and limit what an attacker can do once inside. Low dependency on other work.
• Network segmentation (£1.2m). High value, because it contains blast radius and lateral movement. The 2024 incident came through a managed service provider, which is exactly the path segmentation is designed to interrupt. However, it depends on knowing the asset estate and identity model, so it should follow or run alongside IAM rather than precede it.
• Managed security operations centre (£600,000). Valuable for detection and response, but its value depends on telemetry quality and on there being something to detect against. Start with a managed detection and response service at lower cost until logging and segmentation are in place.
• Incident exercises (£100,000). Best value in the programme. Four days of downtime implies decision-rights, manual fallback and customer communication were improvised. Exercises expose this cheaply and improve recovery time, which directly reduces business interruption loss.
• Insurance limit increase (£200,000). Transfers residual loss but does not reduce the probability or severity of an attack. A £5m limit is thin against a £2.8m four-day event when 55% of revenue sits with one customer whose contract includes service credits. Check the wording for ransom, systemic and aggregation exclusions before buying more limit.

Recommended sequence

• Months 0-6: IAM and MFA; immediate compensating controls for the 2,000 end-of-life scanners (dedicated VLAN, restrictive access control lists, enhanced monitoring, a funded replacement plan); two incident exercises including a manual picking fallback.
• Months 6-18: segmentation, phased, starting with the highest-value paths between corporate and warehouse environments. Begin before peak, not after: peak is precisely when an outage costs most.
• Months 6-24: managed detection and response, scaling to a full SOC if the telemetry justifies it.
• Ongoing: insurance renewal review, third-party assurance, and an unfunded risk item flagged to the board for the scanner estate.

On deferring segmentation The CIO's proposal inverts the risk logic. Deferring until after peak leaves the largest revenue period protected by the controls that already failed once. Phased segmentation with an interim 'no new attack surface' rule is the defensible compromise.

Why quantification matters here The board is being asked to choose between a £3m programme and accepting risk, and it also faces a concentration risk that could remove 55% of revenue. Without a common unit, cyber competes with other risks on fear rather than on evidence. The unit should be financial loss and probability, consistent with how the board evaluates supplier, customer and treasury risk.

Method

• Scenario-based loss modelling. Define a small number of realistic scenarios: ransomware on the warehouse estate, compromise via the MSP, data breach of customer data, and extended outage at peak. For each, estimate frequency and a loss range covering business interruption, recovery, service credits, regulatory cost, redress and customer churn.
• Calibrate with the 2024 event. £2.8m lost revenue plus £450,000 recovery is a data point, not the worst case. Adjust for the fact that the event was contained in four days; model a 10-day peak-season outage separately.
• Express results as loss exceedance. Report the 1-in-10 and 1-in-100 annual loss, and the maximum single event the insurance limit would not cover. Compare that with EBITDA and with the appetite statement.
• Make assumptions visible. Ranges and confidence, not single-point estimates. The board should see which assumptions drive the answer.
• Include the concentration effect. A cyber event that breaches the retailer's service credits or audit rights could trigger contract loss. Quantify that separately, because it may dominate the direct loss.

Reporting

• A one-page board dashboard: quantified loss exceedance against appetite, insurance cover versus modelled severe loss, and the top three residual exposures with owners.
• KRIs with trends: percentage of assets with MFA, number of end-of-life assets, patch latency for critical vulnerabilities, phishing simulation failure rate, mean time to detect and contain, third-party assessment coverage, and backup restore test results.
• A narrative of what changed since the last report, and what decision is being requested.

Testing Tabletop exercises, a purple-team test of the segmentation assumption, restore tests from immutable backups, and independent assurance over the MSP. The board should ask for the results of these tests, not only for the policies that describe them.

Judgement Quantification does not need to be perfect to be useful. A transparent range that supports a decision is worth more than a precise number the board cannot interrogate.

Third-party risk: the MSP is a systemic dependency The 2024 incident did not originate inside Halden; it arrived through a supplier with privileged access. That makes third-party risk a first-order control issue, not a procurement formality.

• Access: no standing administrative accounts for the MSP. Use privileged access management, dedicated accounts, just-in-time elevation, session recording and approval for changes. The MSP should not be able to reach the warehouse environment directly.
• Contract: security schedules with defined incident notification times, a right to audit, cooperation obligations, subcontractor flow-down, data segregation, evidence of independent assurance (for example SOC 2 Type II) and termination assistance.
• Assurance: annual review of the assurance report, with a named owner who reads the exceptions rather than the opinion page. Test the MSP's incident response with Halden's own exercises.
• Concentration mapping: identify fourth parties and single points of failure across the 14 sites and customer integrations. Two suppliers with the same underlying cloud provider are one dependency, not two.
• This customer relationship: the retailer has a right to audit. Halden should treat that as a driver to produce evidence proactively, not as a threat to manage.

Residual risk and insurance

• Insurance transfers financial loss within limits and subject to wording. It does not restore customer trust, prevent service credits accruing, satisfy the retailer's audit or stop a regulatory finding. A £5m limit with a £250,000 excess may be exhausted by one peak-season event plus contractual credits.
• Insurance does not cover the strategic consequence of losing 55% of revenue. That exposure is managed by resilience and by customer assurance, not by a policy.
• Check the policy for what it will not do: ransomware and cyber-war exclusions, aggregation clauses, waiting periods, and whether business interruption is measured on gross profit or revenue.

Board position State the residual risk explicitly after the programme: which scenarios remain above appetite, which are accepted and by whom, and what would trigger a further review. Fund the scanner replacement rather than leaving it as an unfunded item. Approve the programme with segmentation brought forward and incident exercises first, and require quarterly reporting of the quantified position against appetite.

Judgement The board should not treat the £3m as a purchase that removes the risk. It buys time, detection and containment. The remaining exposure is a deliberate choice that must be minuted, priced and owned.