Max Rogers, assistant investment manager at Rathbones Investment Management International, highlights the importance of cyber resilience
THANKS to artificial intelligence, criminals can launch sophisticated cyber attacks with little money, limited technical expertise and a convincing email. Risks are not just operational; they can stop sales, increase costs and damage trust in companies we invest in.
Cyber attacks on major companies such as Marks & Spencer and Jaguar Land Rover highlighted how a single breach can disrupt operations, damage reputations and cause significant financial losses. In Jaguar Land Rover’s case, production was halted and knock-on effects spread through suppliers and customers, even affecting headline UK GDP growth in the third quarter of 2025. In 2024, UnitedHealth in the US experienced a ransomware attack that disrupted healthcare payments and cost around $3bn.
The cyber-security landscape is rapidly reshaping. Criminals use AI to write highly realistic phishing emails, identify weaknesses in company systems, impersonate executives through deepfake technology and target suppliers with access to sensitive data. As attacks become cheaper and easier to launch, we believe small and medium enterprises are particularly vulnerable due to constrained budgets and limited resources.
For investors, cyber resilience has become an important indicator of corporate quality. The key question is whether management knows where the weakest links are, and whether the board is asking the right questions before attackers do. A company that cannot protect its systems, suppliers and customers may also struggle to protect shareholder value. Boards need to understand where vulnerabilities exist, whether defences are being tested, and how the organisation would respond if an attack succeeded. Cyber security can often be treated as an IT problem rather than a core business risk.
The good news is that AI can also strengthen defences. It can help companies spot unusual behaviour, identify weaknesses before criminals do and respond more quickly when incidents occur.
The challenge for businesses is clear: use AI to strengthen security faster than criminals can exploit it. Companies that invest in cyber resilience, robust testing and informed board oversight are likely to be better placed to protect long-term value. That matters for investors because the gap between cyber leaders and laggards may widen. Companies with resilient cyber defences may be better placed to protect long-term value.
Only a small number of the companies with which we have engaged have assigned cyber oversight to a specific board member. This is a concern for us, as we seek to protect the value of companies in our clients’ portfolios, and we intend to keep this under review, engaging with companies where appropriate.
The risks of failing to adapt as cyber criminals change their tactics are growing rapidly. We believe companies that adopt the highest standards of cyber security protection can represent a more attractive and robust investment. Companies that take cyber resilience seriously, through regular testing, AI-enabled defences and informed board oversight, may be better placed to protect long-term value.
