Is being prepared for business risk a modern-day impossibility?
Business risk rarely arrives wearing a name badge.
It would be a wonderful world if every possible risk were clearly articulated and documented, giving us plenty of time to prepare. But business doesn't work like that.
A conflict thousands of kilometres away can disrupt a technology supply chain. A natural disaster can affect a cloud service hosted on the other side of the world. Even a badly dropped anchor can interfere with the connectivity businesses rely on every day.
You can't predict every event. But you can understand what your business depends on and what would happen if one of those dependencies suddenly disappeared.
When the chips are down
Take the helium shortage.
As conflicts in the Middle East continue to affect oil prices, we can see the impact at the petrol pump and in the cost of goods. What's less obvious is how the same geopolitical events can make their way into an IT budget.
Qatar's Ras Laffan Industrial City produces around a third of the global helium supply, making it the world's largest single helium production hub. It has been mostly out of operation since March 2026 following Iranian strikes and the effective closure of the Strait of Hormuz.
That matters to technology because helium plays a critical role in semiconductor manufacturing.
Semiconductors power almost everything businesses now depend on, from laptops and network equipment to vehicles, industrial systems and data centres. If helium becomes harder or more expensive to source, the effects can eventually show up in hardware prices, availability and lead times.
Helium probably isn't on many IT risk registers (nor should it necessarily be). But hardware availability should be.
For businesses already stretching the life of ageing devices or working with tight IT budgets, a sudden increase in hardware prices or replacement times can quickly become a problem.
A drop in the ocean can create connectivity chaos
The same principle applies to something most of us barely think about.
For all the talk about "the cloud", much of the world's international connectivity still relies on physical fibre-optic cables sitting on the ocean floor. Those cables can be damaged by earthquakes, undersea landslides, deliberate sabotage or something as ordinary as a fishing boat's anchor.
Usually, internet traffic simply takes another route. But simultaneous failures, or damage in a region with limited alternative routes, can affect international connectivity. The consequences can reach cloud applications, payment systems, communications and data transfers.
Putting "fishing boat drops anchor in the wrong place" on your risk register would be excessive.
Knowing what happens if your business loses connectivity isn't. And that's an important distinction.
You can't predict the event. You can prepare for the impact.
Trying to anticipate every possible disruption is futile. There will always be another geopolitical event, natural disaster, technology failure or cyberattack that nobody saw coming.
Resilience is less about predicting what will happen and more about understanding what your business cannot afford to lose.
For most businesses, that means looking closely at a handful of dependencies.
Access to your technology
What happens if the equipment you rely on suddenly becomes more expensive, difficult to source or unsupported?
The helium example is one possibility. Ageing technology presents another.
Old systems don't become less vulnerable simply because they've survived another year. If essential hardware is approaching end of life, operating systems can no longer be supported, or critical equipment cannot be replaced quickly, a relatively distant disruption can suddenly become a local business problem.
Resilience means knowing what's nearing the end of its useful life, what needs replacing first and how quickly critical equipment could realistically be sourced.
Access to your systems and data
Cloud computing has removed a lot of physical infrastructure from the office, but it hasn't removed dependency.
Businesses now rely on connectivity, cloud platforms, software providers and third parties to operate.
A damaged subsea cable is one way access can be interrupted. A cloud misconfiguration, compromised supplier, or service outage can create a similar business outcome.
The big question isn't whether you can prevent every possible failure. It's whether your business can continue operating when a system, supplier or connection you normally take for granted isn't available.
Access to your business
Then there’s identity. Stolen credentials remain one of the simplest ways to get past security controls because a valid login can make malicious activity look legitimate.
Phishing, social engineering and session-token theft all exploit this problem in different ways. Multi-factor authentication adds a crucial layer of protection, but no individual security control is infallible.
Your business needs to know who has access to what, ensure your people have only what they need for their role, remove access that’s no longer needed, and have a plan to quickly contain a compromised account.
The ability to recover from a cyberattack
Cyberattacks are also getting faster.
Ransomware is a good example. An incident can progress from initial access to attackers gaining control of core systems, stealing data, encrypting files, and disrupting operations before a business fully understands what’s happening.
AI adds another dimension by helping cybercriminals automate tasks, identify weaknesses and create more convincing social engineering. That makes prevention important, but recovery just as critical.
If an attacker gets through, can you isolate affected systems? Are your backups protected and tested? Does everyone know who makes decisions during an incident? Can critical operations continue while systems are being restored?
Those questions are far more useful than assuming you can stop every attack at the door.
New technology creates new dependencies
AI itself is a good example of how quickly business risk changes.
Employees already use AI tools to analyse information, write documents, summarise meetings, and assist with day-to-day work. Inevitably, some of the information going into those systems is sensitive.
That creates risks businesses didn't have to consider a few years ago.
What data can your employees enter into AI tools? Which tools are approved? What information can AI systems access? Who checks the permissions given to AI agents and integrations?
The answer isn't to avoid AI. It's to recognise that once a technology becomes useful enough for the business to depend on, it also needs management and protection.
The people problem is also a capability problem
None of this can be separated from people.
Employees can click convincing phishing emails, reuse passwords or configure systems incorrectly. But labelling your people as the weakest link misses part of the problem; They need appropriate tools, clear policies, and practical training.
Businesses also need enough cybersecurity capability to identify vulnerabilities, maintain systems, monitor threats and respond when something goes wrong.
For many smaller and mid-sized organisations, maintaining all that expertise internally won't be realistic. Knowing where your internal capability ends, and where an external technology or security partner needs to step in, is another part of resilience.
Resilience isn't futile
So, is being prepared for business risk becoming impossible? Predicting every risk probably is. Preparing your business for disruption isn't.
You don't need to know where the next geopolitical conflict will happen, which cable might break, what the next critical vulnerability will be or how cybercriminals will use AI six months from now.
You do need to know what your business depends on.
What happens if your internet connection disappears? If essential hardware takes six months to arrive? What if an employee's credentials are compromised? If a critical cloud service fails? If ransomware takes systems offline?
Those are scenarios you can prepare for.
We can't always predict what's coming. But we can make sure the business is in a better position when it arrives.
