Getting Your Cloud Strategy Right

Learning Lessons from Recent UK Cyber Attacks

Your business infrastructure is only as strong as its weakest link. When a major cyber attack hits, the damage goes far beyond disrupted operations—it threatens your reputation, customer trust, and bottom line. The wave of high-profile incidents hitting UK organisations in 2025 should be a wake-up call: resilience isn’t a nice-to-have. It’s essential. And your cloud strategy sits right at the heart of it.

These Attacks Aren’t Happening to “Other People”

Let’s talk about what’s actually been happening. In April 2025, Marks & Spencer was hit by a ransomware attack that brought down online ordering, click-and-collect services, and even in-store payments. The attack, linked to the hacking group “Scattered Spider,” came through social engineering—attackers impersonated staff and convinced help desk employees to reset credentials. Once inside, they had the keys to the kingdom. The estimated cost? £300 million in direct losses, with another £1 billion wiped off market value.

Co-op had a similarly brutal experience. A breach in April 2025 forced them to shut down business systems entirely. The result: £206 million in lost revenue over six months, 6.5 million members’ data compromised, and a return to pre-tax losses. Perhaps most concerning—they didn’t have cyber insurance.

Then there’s Jaguar Land Rover. Their attack triggered a five-week production shutdown, crippled supplier networks across the UK, and resulted in what analysts are calling the costliest cyber incident in UK history—an estimated £1.9 billion hit. The breach exposed how interconnected modern manufacturing really is: when JLR’s IT systems fell, so did factories, retail systems, and supply networks, all at once.

These are household names with serious budgets and strong security teams. If they’re vulnerable, everyone is.

The Cloud Paradox: Your Best Defence and Your Biggest Risk

Here’s the thing about cloud infrastructure: it absolutely can make you more resilient than traditional on-premises setups. But—and this is crucial—only if you do it properly.

The cloud offers real advantages. Distributed architecture across multiple availability zones means your workloads can failover when things go wrong. Pay-as-you-go scalability helps you handle both legitimate traffic spikes and malicious ones. And hyperscalers like AWS, Google Cloud, and Azure invest heavily in security, redundancy, and global connectivity in ways most individual businesses simply can’t match.

But migration alone doesn’t flip a magic “resilience switch.” Here’s where things get tricky:

• Legacy workloads lifted “as-is” often don’t benefit from cloud resiliency features. If you’ve just moved your problems to someone else’s servers, you haven’t really solved anything.
• Shared responsibility means the cloud provider secures the infrastructure, but you’re still responsible for your workloads, access controls, identity management, data security, and configuration. That’s a lot of surface area to get right.
• Complexity breeds risk. Hybrid and multi-cloud architectures expand your attack surface. More moving parts mean more chances for misconfiguration, and attackers are brilliant at finding those gaps.
• Business continuity isn’t automatic. Backups, failover plans, incident response protocols—these all need to be designed, documented, tested, and regularly updated.

In short: moving to the cloud without a proper strategy is like building a house on sand. It might look good, but it won’t withstand the storm.

What These Attacks Actually Teach Us

Strip away the headlines and technical jargon, and these incidents reveal three uncomfortable truths.

Business interruption equals brand damage equals lost revenue. M&S’s breakdown hit during a key trading period, Market Capitalisation. Co-op went back into the red. JLR’s production lines stopped completely for over a month with supply chains feeling the full force of the impact of no production. This isn’t just an IT problem to fix—it’s business survival.

Attackers exploit weak governance, not just technical vulnerabilities. The M&S attack came through social engineering and a third-party service provider. These aren’t sophisticated zero-day exploits—they’re fundamental security hygiene issues. Identity controls, third-party governance, network segmentation, regular testing—these basics still trip up major organisations because leadership assumes “it won’t happen to us.”

Recovery is a skill, not a hope. JLR’s five-week shutdown shows that “turning it back on” isn’t simple. In the cloud world, you need tested failover logic, data continuity plans, clear roles, and realistic timelines. The question isn’t “what if we get hit” but “how fast can we recover, and what state will we recover to?”

Building Real Resilience: What Actually Matters

If you’re serious about cloud resilience, here’s what needs to happen.

1. Design for Failure From Day One

Before you migrate anything, audit your current infrastructure properly. Map dependencies, understand data flows, and define recovery requirements. Then architect for resilience: multi-zone capability, automatic failover, immutable backups, disaster recovery logic baked in from the start. This isn’t optional extra work—it’s the foundation.

2. Security Can’t Be Bolted On Later

Identity and access controls need to be hardened. Multi-factor authentication should be mandatory, not optional. Least-privilege access must be enforced. Third-party integrations need scrutiny. The M&S and Co-op incidents prove that attackers don’t need sophisticated malware when you’ve left gaps in the basics.

3. Governance and Continuity Planning

Real resilience means having monitoring in place, escalation procedures documented, incident response plans tested, and backups regularly verified. If you’re running hybrid or multi-cloud environments, that governance overhead multiplies. Plan for the scenarios that keep you up at night: “What happens if our primary region fails?” “Can we still access our management consoles?” “How quickly can we restore from backup?”

4. Operational Readiness and Continuous Improvement

A good cloud strategy isn’t a one-time migration project. It’s continuously monitored and optimised for performance, cost, security, and resilience. Your scaling logic should handle both legitimate load and attack traffic. Cost controls should prevent budget disasters. And your team needs to know the playbook inside and out.

5. Choose the Right Partner

Strategy requires the right expertise. You need specialists who understand not just cloud migration, but cloud resilience—people who know operational support, monitoring, and incident recovery inside out. A partner who acts as an extension of your team, not just a ticket-logging service.

Why DeeperThanBlue Fits This Picture

When it comes to building genuine cloud resilience, you need a partner who covers the full lifecycle—and that’s where DeeperThanBlue comes in. Our cloud migration service handles everything from readiness assessment through secure architecture design and post-migration optimisation. Our consulting approach focuses on unlocking business value and navigating transformation with confidence, not just ticking technical boxes.

From a resilience perspective, that matters. We partner with major hyperscalers—Google Cloud, Azure, AWS, IBM Cloud—and hold Kubernetes Certified Service Provider accreditation, meaning we’re set up for modern, cloud-native architectures. We emphasise proactive support, continuous optimisation, dedicated customer success teams, and 24/7 coverage. You’re not just migrating once and hoping for the best—you’re building something that stays resilient over time.

Our approach includes thorough pre-migration audits that identify vulnerabilities before an attacker does, secure architecture with segmentation built in by default, multi-cloud expertise so you’re never locked into a single vendor, and continuous monitoring with real-time threat response. Plus, we invest in training your team, ensuring your internal capabilities grow alongside your cloud infrastructure.

What’s Coming Next

Cloud resilience isn’t a set-and-forget exercise. The threat landscape evolves, business demands shift, regulations tighten, and technology moves fast.

Attack sophistication continues to rise. We’re already seeing supply chain compromises and third-party provider exploits. Hybrid and multi-cloud environments are becoming standard, which adds complexity—your governance and automation need to handle multiple platforms seamlessly.

AI and automation will both help and hinder. Use machine learning for anomaly detection, but expect adversaries to use automation for scale and speed. Cloud resilience will increasingly differentiate market leaders—your customers will value your availability and responsiveness as part of your core proposition. And regulation is only getting stricter. Data sovereignty requirements, continuity obligations, and cyber insurance prerequisites will force cloud strategies to be auditable, demonstrable, and robust.

Don’t Wait Until It’s Too Late

Here’s the uncomfortable truth: waiting until an attack happens is far too late. The cloud offers enormous promise—flexibility, scalability, cost efficiency—but it only delivers if you build for resilience from the beginning.

The incidents we’ve discussed show that disruption goes way beyond IT. It hits operations, shareholder value, brand trust, and customer relationships. Whether you’re planning a cloud migration, optimising your existing landscape, or tightening your resilience posture, now is the time to act.

Resilience isn’t about avoiding disruption entirely—that’s impossible. It’s about being prepared, recovering quickly, learning from incidents, and staying ahead of evolving threats. A strong cloud strategy means that when disaster strikes, you don’t open the door to chaos. You close it, bounce back, and keep moving forward.

Getting your cloud strategy right means planning smart, partnering with people who know what they’re doing, and executing boldly. DeeperThanBlue offers the expertise, partnerships, and ongoing support to make cloud resilience business as usual—not just another buzzword.

Ready to strengthen your cloud resilience? Get in touch with DeeperThanBlue.

• Share