A factory manager in Namanve told me of a story that stayed with me. Every Friday evening, his team shut down one production line for two hours. Not because it was broken, but because they wanted to test failure.
They simulated a power outage, ran backup generators, switched systems manually, and documented every delay. For months, it looked like waste, lost output, overtime costs, and trustrated supervisors.
Then one Tuesday morning in 2024, the grid failed. While neighbouring plants went silent, his factory kept running. Not perfectly, but predictably. Orders were delivered, contracts were protected, competitors lost revenue. He did not celebrate but simply said, “We had already paid for this day.”
That is preparedness. Quiet, expensive, and invisible until the moment it becomes decisive. Most organizations do not underinvest in cybersecurity because they lack money. They underinvest because the financial system rewards visible performance and ignores avoided losses. Preparedness does not show up in EBITDA. Until the day it saves it.
The financial illusion of resilience
Across the region, in 2024, many companies reported strong financial performance. Telecoms showed EBITDA margins above 40 percent. Manufacturing firms reported cost efficiencies and margin expansion. FMCG players highlighted volume growth despite inflation pressures. Start with the fact. Telecom EBITDA margins are high.
Now interrogate it. Those margins are not purely operational, they are structural. Spectrum allocation, regulatory positioning, and control of mobile money ecosystems create embedded advantages. A dominant player can price services with limited competitive pressure, cross-subsidize segments, and extract value from transaction flows.
What does this mean for cybersecurity preparedness? It creates complacency. When margins are strong, the urgency to invest in invisible capabilities like cyber resilience is low. Leaders assume the system is working and until it is not.
Manufacturing tells a similar story. A firm reports a 15 percent reduction in production costs in 2024 compared to 2022. On paper, this looks like operational excellence. In reality, it may reflect subsidized inputs, tax incentives, or preferential access to foreign exchange.
The margin is real and the resilience is not. Cyber preparedness in such environments is often treated as a compliance checkbox. Firewalls installed. Policies written. Training conducted once a year.
But resilience is not compliance and it is capability. And capability is expensive.
The hidden balance sheet of cyber risk
Cyber risk behaves like an unrecognized liability. It sits off the balance sheet, unmeasured, unmanaged, and misunderstood. When a breach occurs, the impact is not just technical. It is financial, operational, and strategic. Revenue loss from downtime, regulatory penalties, customer attrition and brand erosion. Increased cost of capital due to perceived risk yet in most boardrooms, cyber investment is still debated as a cost center.
This is where the numbers mislead. A company may spend USD 500,000 on cybersecurity in 2024 and see no immediate return. CFOs question the value. “What did we gain?” The correct question is different. “What did we avoid?” If a breach could have cost USD 10 million in lost revenue and penalties, the investment is not an expense. It is insurance. But unlike insurance, it does not produce a visible payout and it produces silence. And silence is difficult to value.
The scale trap
Large organizations often assume they are safer because they are bigger. This is dangerous. Scale increases complexity. More systems. More users. More entry points. More third-party integrations. In telecom, for example, the integration of mobile money platforms with external partners creates multiple vectors for attack. APIs, agent networks, and customer interfaces expand the attack surface.
The financial performance may look strong in 2024, but the underlying risk exposure is growing. In energy and utilities, digitization of grid management systems improves efficiency but introduces vulnerabilities.
A single breach can disrupt operations at national scale. In agribusiness, the shift to digital supply chains and traceability systems creates new dependencies. A cyber incident can halt exports, disrupt payments, and damage relationships with international buyers.
Scale does not protect you. It amplifies your exposure.
The boardroom moment
I was in the EXCO meeting with a large regional company in 2024. The CFO was presenting strong results. Revenue up 18 percent from 2023. Profit up 22 percent. Cost to income improving.
The mood was confident. Then one member asked a question. “If your core system goes down for 72 hours, what is the financial impact?” It was total silence, you could hear a pin drop.
The CIO estimated. “Perhaps USD 2 million.” We pushed further. Lost transactions. Customer churn. Penalties. Recovery costs. The number moved to USD 8 million. Then I asked, “What is your current cyber preparedness investment?” USD 300,000.
I paused and said, “You are insuring an USD 8 million risk with USD 300,000 and hoping nothing happens.”
The room shifted. The CEO leaned forward. “What are we missing?” We mapped their exposure. Single points of failure. Weak incident response. Limited backup testing. The insight was simple. Their profitability was masking fragility.
They were not resilient, and not lucky. That conversation triggered a shift. Investment increased. Processes were redesigned and testing became routine. Six months later, they faced an attempted breach. It was contained. Operations continued. Preparedness had done its quiet work.
Why preparedness is undervalued
The core issue is incentive misalignment. Executives are rewarded for growth, profitability, and efficiency. Cyber preparedness does not directly improve any of these in the short term.
It increases costs. It slows processes. It introduces friction. So it is deprioritized. This is rational behavior within a flawed system. Until a breach occurs.
Then the same leaders are held accountable for failures they never invested to prevent. This cycle repeats across sectors. Telecom invests heavily in customer acquisition but underinvests in securing the ecosystem.
Manufacturing optimizes production costs but neglects system resilience. FMCG focuses on distribution efficiency but ignores data protection in supply chains.
Energy prioritizes infrastructure expansion but overlooks cyber risks in control systems. The pattern is consistent. Preparedness is deferred because its benefits are invisible.
Reframing preparedness as strategy
Preparedness must move from IT to strategy. It is not about preventing attacks. It is about ensuring continuity. A company that can operate under attack has a competitive advantage.
In a crisis, customers shift to providers who remain available. Contracts are retained. Market share can even increase. Preparedness becomes a moat. But only if it is treated as such. This requires a shift in thinking.
- From cost to investment
- From compliance to capability
- From reaction to anticipation
It also requires leadership. Boards must ask different questions. Not “Are we compliant?” but “Can we survive a breach?” Not “How much did we spend?” but “What is our exposure?” Not “Do we have systems?” but “Have we tested failure?”
What leaders must do
First, quantify the risk. Put a number on potential losses from cyber incidents. Make it real. Make it uncomfortable.
Second, align investment with exposure. If the downside risk is USD 10 million, your preparedness investment cannot be USD 300,000.
Third, institutionalize testing. Simulate failures. Run drills. Break your own systems before someone else does. Fourth, integrate cyber into strategy. Treat it as a core capability, not a support function.
Fifth, change incentives. Reward resilience, not just performance. Most organizations will read this and agree. Then they will return to business as usual.
Budgets will prioritize visible growth. Preparedness will remain underfunded. The illusion of resilience will persist. Until the day it does not.
Preparedness is quiet work. It does not impress investors. It does not make headlines. But it decides who survives. The question is simple.
Are you building a business that performs well in good times, or one that endures when everything goes wrong? One choice creates comfort. The other creates advantage. Choose carefully.
Copyright Summit Consulting Ltd 2026. All rights reserved.
