The Man Who Owns the Storm Cellar Just Told Us to Take Cover

Summary

AI has made cyberattacks faster than most companies can patch, and the next 18 months will decide which businesses stay insurable, financeable, and sellable.

The next 18 months will be terrible. Here is what it could cost you and what to do before it does.

I wasn’t planning to write this article, but the last few days have convinced me I should. It’s for every CEO, CFO, and business owner out there, and for anyone buying or selling a middle market company.

“as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)”

I read that post 3 times the night it went up, and I’ll be honest, it stuck with me.

Jason helps run security at one of the companies building the world’s most powerful AI. He gets to see what these models can do long before the rest of us do. So when somebody in his seat says it’s going to get a lot worse, I listen.

Where I grew up in Texas, when the man who owns the storm cellar tells you to get in the storm cellar, you don’t stand on the porch and argue with him.

If you only read one paragraph, make it this one.

Cyber was already the #1 business risk in the world, and it just got faster than most companies can respond. The next 18 months could cost unprepared companies their insurance, their revenue, and a big piece of their value. And the answer isn’t another piece of technology. It’s getting brilliant at the ordinary, and being able to prove it.

The rest of this is the why, and what I’d do about it.

What just happened

On Saturday, October 17, attackers started poking at web servers looking for a hole in PHP. If you’ve never heard of PHP, that’s fine. It’s the software running behind almost 70% of the websites out there. The fix for that hole wouldn’t exist for another 4 days.

Once the flaw was made public, Cloudflare watched what happened next. Tens of thousands of attack attempts in the first 45 minutes. Hundreds of thousands within 2 hours. By the next day, millions. Some governments decided it was safer to take their own websites offline than leave them up.

Now, most of those early attempts failed, and I’ve already heard people take comfort in that. I wouldn’t. Millions of tries doesn’t mean the door held. It tells you how many people are standing on your porch, and they only have to get in once.

Here’s what really got my attention. That hole had been sitting in the code for more than 10 years, and AI is what helped find it. PHP isn’t the story. It’s the first of many.

It was already the #1 risk

Every January, Allianz asks thousands of risk professionals worldwide what worries them most. This year, before any of this happened, cyber came in first for the 5th year running, with its highest score ever. It was #1 for companies of every size, including the ones under $100 million in revenue. AI came in second, business interruption third, and regulatory changes fourth.

When I look at that list after the last few weeks, I don’t see 4 separate risks. I see one chain. AI finds the flaw, the flaw takes the business down, and then the regulators and the lawyers show up.

And remember, those rankings were set back in January. I’d love to know where they’d land today.

Hours versus weeks

I’ve been doing cyber risk assessments for 25 years, and I’ve never once walked into a clean environment. There’s always something. But the last 6 years have been different, and not in a good way. I’ve watched patching fall apart in the companies we assess. I’m not talking about a survey. I’m talking about real companies, with the owner sitting across the table from me.

Some of it started with the pandemic. IT teams scattered to kitchen tables, and the same tired people got asked to do more with less. Somewhere in there, security turned into a shopping trip. A tool for this, a tool for that, while the unglamorous work of keeping systems up to date kept sliding. Now we find servers nobody has touched in years, running software the vendor gave up on long ago, and the answer is always the same: “it still works.” So does a truck with the check engine light on, right up until it doesn’t.

The 2026 Verizon Data Breach Investigations Report backs up what I’ve been seeing. Only 26% of the most dangerous known flaws were fully fixed last year, down from 38% the year before. The median fix took 43 days. And the number of flaws companies had to deal with grew by almost 50% in a single year.

Put that next to what we just watched with PHP. The attackers moved in hours. Most companies fix in weeks. That gap is the whole problem.

I wish I could tell you it closes on its own, but I don’t think it does. Jason hopes that in about 18 months, cheap AI will help developers catch bugs before new software ships. That’s good news for new software. It does nothing for the old server sitting in your back room. When this storm passes, the companies still running old, unpatched systems will be the easiest targets left standing.

What it could cost you

Nobody can hand you your exact number, and I won’t pretend to. But I can show you where the money goes. What follows are my projections, built on the data we have today.

Start with your operations. According to Coveware, the average ransomware victim is down for about 21 days. PHP2Shell added a second kind of outage, the one you choose because unplugging is safer than staying exposed. If you’re not prepared, I’d plan on at least one outage of several weeks sometime in the next 18 months.

Then there’s revenue. CEOs surveyed by Cohesity estimate a serious attack takes about 15% off a year’s revenue, and 42% of companies that got hit lost customers. On a $50 million company, that’s $7.5 million. Customers are loyal right up until you can’t ship their order.

Insurance is where I think a lot of owners are going to get surprised. Back in 2021, after a string of big attacks, US cyber insurance prices jumped 130% in a single quarter, according to Advisen. Today rates are down about 43% from late 2023, even though claims keep growing, and brokers expect the market to tighten by the first half of 2027. My bet is 2027 looks a lot like 2021, maybe worse, because one flaw can now hit thousands of policyholders at once. And when you file a claim, I’d expect the first question to be a simple one: did you patch what the whole world was warned about?

Your cost of money is on the line too. Moody’s said this month that weak cyber defenses will push borrowing costs up, and that “those with weak patching practices are likely to fall further behind.” Think about that for a second. A rating agency just tied your patch backlog to your interest rate.

And then there are your vendors. Verizon found third-party breaches jumped 60% in a year and now make up 48% of all breaches. Ponemon found the average company already deals with 12 third-party breaches a year. Your vendors are carrying the same backlog you are, and their problem has a way of becoming yours.

What it could do to your multiple

If you’re planning to sell someday, this is the part I’d slow down for.

GF Data tracks private equity deals between $10 million and $500 million. In the first half of 2026, the average deal closed at 7.1x EBITDA, about where it’s been for 2 years. On the surface, not much changed. But the extra buyers used to pay for strong companies has shrunk from about 15% to 5%. What I take from that is buyers have stopped paying up for good numbers alone. They pay up for numbers they can trust.

GF Data has actually measured that. Sellers who backed up their quality of earnings with a data quality assessment sold at 7.4x. Sellers who didn’t sold at 7.0x. I call that the proof premium, and I think cyber is about to become part of it.

Let me walk you through what that could look like. The multiples come from GF Data. The size of the hit and the discount are my own assumptions, and I’ve kept them on the gentle side.

Say your company has $5 million in EBITDA. At 7.1x, it’s worth about $35.5 million. Now say you go into the next 18 months not really knowing your exposure, and you get hit. Downtime, lost customers and cleanup take 20% out of your EBITDA, so you’re at $4 million. The buyer looks at a company that can’t prove its condition and knocks half a turn off. At 6.6x, you’re worth about $26.4 million. That’s $9 million gone, before the buyer adds an escrow or an earnout to protect himself.

Now take that same company, but this time the owner gets the house in order and can prove it. It goes to market with evidence in hand and earns the proof premium. At 7.4x, it’s worth about $37 million.

Same company, same market, and an $11 million difference. And that gets decided this quarter, not in 2028.

It has already happened to others

I know it’s easy to read stories like these and think they happen to somebody else. They do happen to somebody else, right up until it’s you.

In June 2024, CDK Global, the company that runs the systems behind about 15,000 car dealerships, got hit and shut everything down. Dealers across North America went back to pen and paper for close to 3 weeks, and Anderson Economic Group put the cost at about $1 billion. Here’s the part I want you to notice. Those dealers didn’t do anything wrong. Their vendor got hit.

In 2025, Marks & Spencer couldn’t take online orders for 46 days. Jaguar Land Rover stopped building cars for about 5 weeks, and the UK’s Cyber Monitoring Centre estimated the damage at £1.9 billion, spread across more than 5,000 suppliers and dealers who were never hacked themselves.

None of those losses came from a missing tool. They came from one vendor sitting in the middle of everything, no plan for running the business without it, and contracts and cash flow that all ran through someone else.

Think beyond the tech

That’s why I keep saying proof matters more than purchases.

Every time something like PHP2Shell hits, the first instinct is to go buy something. A new scanner, a new platform, a new dashboard. I get it. Buying a tool feels like doing something.

But cyber risk was never just a technology problem. It’s people, process, contracts, vendors, compliance and regulation, and then, last, technology.

So before you sign the next purchase order, sit down with the questions no software can answer for you. Who actually owns this, and do they have the time and the authority to act? What do our vendor contracts say when the vendor is the one who gets hit? What do our regulators expect us to prove? And how do we take orders, ship product and make payroll if the systems go dark for 3 weeks?

That’s strategic planning. It used to be how we did cyber. Over the last 6 years, a lot of companies swapped it for a shopping list, and it’s time to bring it back.

Be brilliant at the ordinary

At NCX Group, we have a saying: be brilliant at the ordinary. When you strip it down, that’s what Jason was saying too. Not AI. The basics. For me, it comes down to 3 things.

1. Know what you have. Every system that touches the internet, what it runs, and when it was last patched. Every vendor that can get into your environment, and what your contract with them actually says. And who owns each piece. Not a best guess. A real list.
2. Do the ordinary things, every single day. None of these are new ideas. Every one of them matters more today than it did a month ago.

• Patch. Patch or unplug the systems that would hurt the most if they went down, and give your team written permission to pull something offline the next time a critical flaw shows up. After a breach, your insurer, your lender and your buyer will all ask about patching first.
• Train your people monthly, not once a year. Phishing emails are well written now, and attackers will call your help desk pretending to be you. One convincing phone call can walk right past everything you’ve bought.
• Lock down identity with MFA. Put multifactor authentication on email, remote access, cloud accounts and every admin login, and make your vendors do the same. In my view, missing MFA is about the easiest reason a carrier will ever have to push back on a claim.
• Have someone watching around the clock. You want a security operations center watching 24 hours a day, 7 days a week, 365 days a year, not just during business hours. Every hour nobody’s watching is an hour an attacker can be inside, and that’s how a bad night turns into a 3 week outage.
• Put AI governance in place. Your people are already using AI, whether you approved it or not. You need a written policy on what data can go into it, a way to see who’s using what, and controls to back it up. Customer data pasted into somebody’s personal AI account can put you in breach of your contracts and your privacy obligations, and buyers are starting to ask about it.

You’ll notice only 2 of those 5 are things you can buy. The rest are people and process.

3. Plan for the day it fails, and prove you’re ready. Pull out your incident response and business continuity plans and read them as if the outage is happening today. Most of the ones I see were written for a world where IT sat down the hall, and you had weeks to patch. Write down your workarounds: paper order forms, a printed call list, a backup way to pay people, and who does what in the first hour. Then get your leadership team around a table for 2 hours and walk through it. And restore a backup, for real, to prove it works. A backup you’ve never restored is a hope, not a plan.

Once that’s done, have someone who didn’t build your environment check all of it. You’d never let your bookkeeper audit their own books, and the same goes double for your MSP. They hold the keys to your servers, your cloud, and your data, and this is no time to trust blindly. Write down what you did and when you did it. That record is exactly what your insurer, lender, board, and buyer will ask to see.

Because cyber risk isn’t about what you think or feel. It’s what you can prove.

Your move

CEOs and CFOs, this is an operating and financial risk now, not an IT project. What gets unplugged, what gets funded, and what risk you accept are your calls, and your 2027 renewal, your cost of debt, and your revenue forecast all ride on them. But you’re not cyber experts, and nobody expects you to be. You also shouldn’t have to take your IT team’s word for it. Bring in an independent advisor who works for you, not for IT or the MSP, to give you guidance and direction when you need it. You wouldn’t sign off on the audit without your CPA. Don’t sign off on this without someone in your corner either.

Owners, do you actually know where you stand? Maybe your team has kept up. Maybe they haven’t. Most owners I meet can’t answer that question with evidence, and that’s the real problem. Being brilliant at the ordinary starts with finding out. Check every device, server, laptop, and cloud account, and find out when each was last patched and who’s responsible for it. Then validate, validate, validate. Patching is critical, but so is knowing whether your internal and outsourced IT teams are actually doing what they say they’re doing. Trust, but verify.

Sellers, the buyer will find it, so find it first. And please don’t wait until you go to market. If Jason is right, the next 18 months are exactly when your buyer will be doing diligence, and every issue they turn up becomes a price cut, an escrow or a reason to walk. The time to move is now. Start early, fix what you find, and go to market with the evidence in hand.

Buyers, move past the checklist and validate. Treat your cyber risk evaluation the way you’d treat a quality-of-earnings report. You’d never close on earnings you hadn’t verified, so don’t close on a cyber condition you haven’t verified either.

And to buyers and sellers both, I hear the same line on almost every deal: “Mike, time kills deals.” I agree with that. So do cyber breaches and events. A few weeks spent validating before close costs far less than a breach that shows up after.

The next 18 months will be hard on a lot of good companies run by good people. Some of them will come out the other side with better insurance, cheaper money and a higher multiple than their competitors. Others will spend those months paying for decisions they didn’t know they were making.

You get to choose which one you’ll be. But you have to choose now.