One year ago, Jaguar Land Rover stopped building cars. I've spent the last 12 months thinking about the middle of this story rather than just the beginning.

It remains unknown how the attackers broke through. No UK authority has published an initial access vector and neither has the company, so anyone offering insights or opinions about this is simply guessing. 

Here's what's on the record. Abnormal system behavior first appeared August 31, 2025. The next day, the company took its systems offline worldwide, stopping three UK plants and its Slovakian operation, which, combined, built close to one thousand vehicles a day. A phased restart began October 8; production returned to normal in mid-November; and the Cyber Monitoring Centre didn't declare full recovery until January 2026. That same body put the cost to the UK economy of nearly £1.9 billion, with roughly 5,000 organizations affected downstream. The Bank of England named the disruption in November, when third quarter growth came in under forecast.

Now, consider what a decision of that size actually tells you. Nobody halts global production for five weeks because it seems prudent. You do it when every smaller option has been examined and rejected.

Be careful about what that proves, though. It doesn't prove the attacker reached the factory floor. It proves that responders couldn't demonstrate otherwise. That distinction matters because containment isn't only about limiting where an intruder can travel. It's about being able to show where they can't, quickly enough that you don't have to assume the worst and act on it.

Would I have made the same call? The first day, yes. Two weeks later, no. A five-week shutdown isn't one decision; it's the same decision remade every morning because nothing in the environment allows it to be scoped any smaller. That part wasn't decided in September. It was decided in every planning cycle where separating the corporate domain from the plant floor got pushed to next year.

Industry numbers explain why this keeps happening. Frontline incident response reporting now puts the average time from initial access to first lateral movement at 29 minutes — with the fastest observed case at 27 seconds. IBM's 2025 breach research puts the global mean at 181 days to identify an intrusion and a further 60 days to contain it. The adversary crosses your environment in half an hour, and the average defender closes the door two months later. Detection has absorbed a decade of investment. Containment has mostly absorbed slogans. Can you express yours as a number today? How many systems can one compromised identity reach, how long would it take you to isolate them, and how much of the business would you have to shut down while you figured it out? If the answer requires a meeting, a spreadsheet, or an incident to find out, then you don’t really have a containment metric yet.

Jaguar Land Rover reportedly had not finalized cyber cover before the incident and appeared to be uninsured. The company declined to comment. To get the bigger picture, just look at the other major cyber incidents that happened that same year in the UK. One major retailer carried cover capped at £100 million against costs it warned could reach £300 million. Another put its lost profit of nearly £120 million with limited insurance recovery. None of that reaches the thousands of downstream suppliers holding no cover at all for somebody else's outage. Downtime rather than data is the loss-driver in manufacturing. I would expect renewal conversations to move from control attestations towards proof of how fast you can isolate.

Regulation is heading the same way, and geography is instructive. The UK's existing framework covers energy, healthcare, transportation, water, and digital infrastructure. Manufacturing sits outside it. Cross into the EU and vehicle manufacturing is explicitly named in scope, carrying obligations for access control and supply chain security, incident notification within tight deadlines, and personal accountability for senior management. The same company and the same production network answer different regimes depending on which side of a border a plant happens to sit. Plan on containment evidence becoming something you file rather than something you promise.

So how do you contain your blast radius? Hint: Not through the architecture diagram and not through the roadmap. If one privileged account is stolen this afternoon, how many systems can it reach? And how many minutes pass before you sever that access without stopping the line? Twenty-nine minutes is the standard somebody else has set for you. In my experience, most security leaders can answer the first question approximately and the second not at all. “We'd have to scope it” is the five-week answer.

Going forward, ask your team the 10-minute question: If we discover a compromised privileged account right now, can we contain it within 10 minutes without stopping the business? Not eventually. Not after we scope the environment. Ten minutes. If the answer is no, you’ve found the gap that matters. As for me, I’m still minding it and I’d rather close it before the line stops.

‍