The period's incidents in industrial environments and at software suppliers expose a cost that rarely appears in technical reports: what's lost isn't database records, it's operations.
When an attack reaches a production environment and a plant halts precautionarily, the bill is made of perishable product, shifts paid without output, supply contracts with deadline clauses, and shelf position in retail that someone else occupies while you're out.
None of those items enters the usual security metrics, which tend to count exposed records and system downtime. Those are technology metrics for a problem that became operational.
That's why the decision to halt production is usually taken by whoever runs the company rather than by the technical team: the information needed to decide isn't on the monitoring dashboard.
The preparation that reduces that cost comes earlier and is simple to describe: knowing in advance which system can be switched off without halting the whole line, and having agreed who authorises the stop before anyone has to authorise it under pressure.