The real cost of ignoring cybersecurity risk assessments

In the next in a series of articles, Greg Du-feu, Managing Director of Du-feu IT Solutions, discusses why ignoring cybersecurity risk assessments could cause huge problems for your glazing business.

Cybersecurity risk assessments are often misunderstood. Some fabricators view them as paperwork or an unnecessary cost. But in reality, a proper assessment could be the one thing that keeps your business operating when a cyberattack hits.

Think of it like an MOT for your IT. You wouldn’t drive a van with bald tyres and no brakes. Yet every week, fabricators across the UK are effectively doing just that with their technology — running critical systems without knowing their weak points.

In this article, we’ll explore what a cybersecurity risk assessment actually does, what happens when you skip it, and why the long-term costs of inaction far outweigh the investment.

What a Cybersecurity Risk Assessment Does

A risk assessment identifies where your business is vulnerable and what the real-world impact of an attack would be. For a glazing fabricator, this typically includes:

1. ERP and Order Systems: Are they patched and properly secured?
2. Accounting and Financial Data: Who has access? Is MFA enabled?
3. Supplier Portals and Email Accounts: Are they protected from phishing?
4. Backups and Disaster Recovery: Can they be restored quickly?
5. Hardware and Software Inventory: Are you still using unsupported devices or operating systems?

The result is a clear picture of your exposure, ranked by priority, with actionable steps to fix each issue.

What Happens When You Skip It

When fabricators skip assessments, they operate blind. You don’t know what risks exist until one turns into a crisis. Here’s what that can look like:

• Ransomware Lockdown: An unpatched firewall lets in ransomware. ERP systems are encrypted, halting production for 10 days. The ransom is £50,000 — plus another £15,000 in lost contracts.
• Invoice Fraud: Attackers compromise an email account in accounts payable and send fake supplier invoices. £12,000 gone before anyone notices.
• Data Breach: Customer data is stolen, triggering ICO fines and reputational damage.

The cost isn’t just financial. It’s emotional. It’s the stress of explaining to customers why jobs are delayed, why wages are late, or why systems are down.

Real-World Example

In early 2024, a Midlands-based fabricator suffered a ransomware attack through an outdated remote access system. The entire ERP database was encrypted, leaving the team unable to process orders, invoices, or deliveries.

By the time their IT provider restored operations, 12 days had passed. Installations were postponed, clients were furious, and two major contracts were cancelled. The business lost more in two weeks than the cost of three years of proactive cybersecurity improvements.

The Cost Equation

Let’s look at the numbers:

Scenario	Cost Estimate
Average UK ransomware ransom	£15,000–£60,000
Average downtime cost (per day)	£5,000–£10,000
Reputational damage & lost business	£10,000+
Cyber insurance premium increase	15–30%

 

Compare that to a professional cybersecurity risk assessment — typically way less than the cost of one day’s downtime.

The Supply Chain Impact

Your customers and partners depend on your uptime. If your systems go down, they go down with you. Increasingly, large contractors are asking for evidence that suppliers take cybersecurity seriously. Without documentation or certification, you risk being cut from preferred supplier lists.

How Often Should Fabricators Assess Risk?

At least once a year, and ideally after any major IT change — new ERP, new site, or staff restructuring.

Cyber threats evolve constantly. What was secure six months ago might be vulnerable today.

Final Word

A cybersecurity risk assessment isn’t a box-ticking exercise. It’s a roadmap for protecting your business, reputation, and revenue.

Fabricators who skip it eventually learn the hard way — downtime, stress, and customer loss. Those who invest early prevent disaster before it strikes.

Stay proactive. Follow Dufeu IT on LinkedIn, connect with me personally, or visit dufeu-it.co.uk/contact to see how we’re helping other glazing businesses build resilience.