The Cyber Recovery Blind Spot: Why Irish Businesses Are Prepared to Be Hacked but Not to Bounce Back
Detection is not protection. Knowing your business has been hit is very different from knowing how to get it running again.
New research from Censuswide, commissioned by Version 1, found that while the majority of Irish organisations now have some form of threat detection in place, fewer than half have a documented and tested recovery plan. The investment has gone into the alarm system. Almost nothing has gone into the rebuild.
This is the cyber recovery blind spot, and it is costing Irish businesses money they cannot see on any invoice.
The Real Cost Is Not the Breach. It Is the Downtime.
The Ponemon Institute puts the average cost of a data breach for an Irish-scale organisation at over €4 million. That number gets quoted a lot. What gets quoted less is how that figure is built. The biggest single component is not the ransom, not the regulatory fine, not the forensic investigation. It is operational downtime. The hours and days when staff cannot take orders, process invoices, access customer records, or move stock.
Picture a 200-person Irish manufacturer. They run on an ERP system that touches every part of the business: procurement, production scheduling, dispatch, accounts. A ransomware attack locks them out on a Tuesday morning. By Wednesday afternoon they have lost two full production shifts. By Friday, a key customer has been told their delivery is delayed and has called a competitor. The breach cost is visible. The customer loss is not on any incident report.
The HSE attack in 2021 showed Ireland exactly what this looks like at scale. The National Cyber Security Centre estimated the recovery cost at over €100 million. That is roughly equivalent to building two new secondary schools, completely, every month for a year. And the HSE had more resources to throw at recovery than any SME in Limerick or Galway ever could.
Why Businesses Invest in Detection and Ignore Recovery
The answer is psychological as much as financial. Detection feels active. Firewalls, intrusion detection systems, endpoint monitoring: these are things you can point to in a board meeting. Recovery planning feels defeatist. It is an admission that something will go wrong.
The entrepreneur versus employee distinction matters here. An employee thinks about their job. An entrepreneur thinks about the business surviving without them. The same logic applies to cyber strategy. Detection protects today. Recovery planning protects the business's future.
There is also a procurement bias at play. Security vendors sell detection tools. They are well-funded, well-marketed, and in every inbox. Recovery planning requires a different kind of work: process mapping, dependency analysis, staff training, and honest conversations about what actually breaks first when systems go down. It is slower, less exciting, and harder to quantify. So it gets pushed to next quarter, and next quarter, until the incident happens.
The €760M scam problem facing Irish businesses shows this pattern clearly. Irish firms are spending on visibility into threats while leaving the response architecture incomplete.
The Recovery Readiness Framework Irish Businesses Are Ignoring
Here is the framework that matters. There are five steps, and the order is not negotiable because each one depends on the previous.
Step 1: Identify your critical systems. Not all systems are equal. Rank them by how long the business can survive without each one. Email going down is annoying. Your order management system going down stops revenue. Know the difference before an incident forces you to find out.
Step 2: Define your recovery time objective (RTO) and recovery point objective (RPO). RTO is how long you can be down before the business suffers permanent damage. RPO is how much data you can afford to lose. A payroll system with an RPO of 24 hours means your backups need to run at least daily. If you have not set these numbers, you are guessing under pressure during the worst moment.
Step 3: Test your backups. Actually test them. This is the step most businesses skip. Having a backup is not the same as having a working backup. Run a full restore drill on a non-critical system every quarter. Find out your restore takes six hours, not the two hours your IT provider estimated, before you need it to take two hours.
Step 4: Write a communication plan. Who calls customers? What do you tell staff? Who talks to regulators? Under Ireland's GDPR obligations, a personal data breach must be reported to the Data Protection Commission within 72 hours of becoming aware of it. Breaching that deadline because nobody knew whose job it was to make the call adds a regulatory fine on top of an operational disaster.
Step 5: Run a tabletop exercise. Sit your senior team around a table, present a realistic attack scenario, and walk through every decision. Who has the authority to take systems offline? Where are the manual backup processes? Does your operations manager know how to process orders without the CRM? You will find gaps in 45 minutes that years of planning documents missed.
The Turn
The businesses that recover fastest from cyber incidents are not necessarily the ones with the best security. They are the ones who treated recovery as a business continuity problem, not just a technology problem. Demand for your product does not pause because your systems are down. Your competitors will quote your customers while you are restoring servers.
Inside Tines' €1bn bet on Dublin security infrastructure is a reminder that the smartest operators in Irish tech treat incident response as a workflow problem first and a technology problem second. The rest are still arguing about firewalls.
Build the alarm. Then build the exit route. One without the other is not a security strategy. It is optimism.
