Foreword vii

Preface xi

Executive Summary xxi

1 Cyber-attacks Jeopardize Companies’ Pace of Innovation 1

2 It Could Get Better—or $3 Trillion Worse 31

3 Prioritize Risks and Target Protections 53

4 Do Business in a Digitally Resilient Way 77

5 Modernize IT to Secure IT 101

6 Engage Attackers with Active Defense 123

7 After the Breach: Improve Incident Response across Business Functions 141

8 Build a Program that Drives toward Digital

Resilience 157

9 Creating a Resilient Digital Ecosystem 185

Conclusion 209

Acknowledgments 213

About the Authors 215

Index 217

JAMES M. KAPLAN is a partner with McKinsey & Company in New York. He coleads McKinsey’s global IT infrastructure and cybersecurity practices.

TUCKER BAILEY is a partner in the Washington, DC location of McKinsey’s Business Technology Office.

DEREK O’HALLORAN is Head of Information Technology and Electronics Industries at the World Economic Forum.

ALAN MARCUS is Head of Information and Communication Technology Industries at the World Economic Forum.

CHRIS REZEK is a senior expert consultant with McKinsey & Company in Boston.