The cost extends beyond getting servers running again
A known vulnerability can remain open even after the alert has circulated. The missing piece may be a list of affected applications, an available owner or post-change verification. When an incident happens, the organisation discovers the systems to treat, business dependencies and resources it needs at the same time. Each unanswered question slows the response.
WannaCry and Equifax illustrate two different consequences: disruption to essential services and large-scale data exposure. Their costs reflect their own circumstances. For your organisation, the useful lesson is to understand the tracking failures that allowed a technical issue to grow so large.
WannaCry: an estimated £92 million cost to the NHS
In its October 2018 progress report, the UK Department of Health and Social Care estimated that WannaCry cost the NHS £92 million. The estimate covers lost activity and IT costs associated with the attack and recovery. The report also records more than 19,000 cancelled appointments. This is an institutional estimate in pounds at the time.
The National Audit Office adds a crucial point: most infected NHS devices ran Windows 7, which was still supported, but lacked the patch available from March 2017. Explaining the incident solely through Windows XP would miss the operational lesson. Tracking support deadlines and tracking patch deployment are complementary tasks.
Sources: UK Department of Health and Social Care, WannaCry cost estimate, October 2018, National Audit Office, WannaCry and NHS investigation, 2017
Equifax: a known alert, followed by a settlement worth hundreds of millions
In July 2019, the FTC announced that Equifax had agreed to a global settlement of at least $575 million, potentially reaching $700 million, following its 2017 data breach. Approximately 147 million people were affected. The FTC alleged that Equifax failed to patch after receiving an alert about a critical vulnerability in March 2017.
That figure describes a global settlement; it is not the complete cost of the incident. The case raises a practical question for every leadership team: when an alert arrives, can you identify affected occurrences, the teams that must act and evidence that the work actually succeeded?
Make every handover visible
A resilient organisation connects monitoring, applicability, priority and action. For each issue, the report should identify the product, version, affected services, owner, deadline and any blocker. If a supplier must release a package or confirm compatibility, that dependency becomes a tracked action too.
After intervention, compare the observed version with the expected fix and retain evidence. For a critical application, combine technical verification with a business-function check. Leadership can then distinguish verified fixes, approved exceptions and situations still awaiting information.
Present a monitoring budget people can assess
To assess your needs, start with your own dependencies: unavailable services, staff diverted to response, contractual commitments and recovery capability. Track the time needed to assess an alert, find owners and close actions. These measures help size the service and compare periods over a stable scope.
With CyberLifeCycle, every alert has ownership and follow-through
CyberLifeCycle starts with your inventories or SBOMs and handles monitoring, assessment, prioritisation and reporting. Relevant alerts are linked to known occurrences, false positives are resolved and follow-up makes the work visible. Your teams carry out remediation; you receive a clear view of progress and decisions required. The aim is an organisation ready to act, with decisions and evidence that remain available.
Sources consulted
- UK Department of Health and Social Care, WannaCry cost estimate, October 2018Accessed on 30 October 2026.
- National Audit Office, WannaCry and NHS investigation, 2017Accessed on 30 October 2026.
- FTC, Equifax settlement announced on 22 July 2019Accessed on 30 October 2026.