The NotPetya cyberattack in 2017 significantly affected Mærsk’s short-term operational capabilities and customer service. More importantly, it marked a turning point in the company’s transition to a risk-based approach for cybersecurity investments and enhancements. Before initiating this transition, top leadership, in collaboration with stakeholders across the organization, assessed the business criticality of its applications and their roles in key business operations. This assessment provided the foundation for prioritizing investment areas effectively.

Consequently, Mærsk adopted a quantified risk reduction strategy, translating risk into a “dollars-lost” equivalent, which facilitated meaningful discussions with the board and chief financial officer (CFO), ultimately securing essential funding for its cyber transformation programme. This strategy also guided decisions on where to invest in developing, operationalizing and embedding cyber capabilities.

By using Monte Carlo simulations and other risk-modelling techniques, Mærsk enabled data-driven, risk-based decision making. This methodology has also significantly improved due diligence and purchasing decisions. The steps taken since 2017 have resulted in better investment prioritization, reduced cyber risk exposure and enhanced resilience across Mærsk’s operations.