Security investment proposal, 2027

Three investments close the gaps the September intrusion used

Together they cost 610,000 euros over three years. Each one removes a step the intruder needed.

For the executive committee of Meridian Freight, 20 October 2026.

In September nothing was broken into. Each step the intruder took was allowed.

Detection is strong; identity and recovery are not

We scored five capabilities against what an organisation of this size needs. Two are where they should be. Three fall short, and the intrusion went through all three.

Identity, remote access and recovery are furthest from target

Capability today and the target for end of 2027, on a scale of 1 to 5

Source: Hunt & Hackett assessment, October 2026.

Three investments, one for each gap

  1. Device-bound sign-in for everyone

    A stolen session stops working on any other machine. 2,400 people, by March. 190,000 euros.

  2. Separate administration workstations

    Administrator credentials never touch an ordinary workstation again. 38 administrators. 150,000 euros.

  3. Tested recovery of the directory

    A rehearsed rebuild in under eight hours, twice a year. 270,000 euros over three years.

These three remove the most risk for each euro

We costed seven candidate measures and estimated how much of the modelled yearly loss each removes.

The three chosen measures sit furthest above the line

Cost over three years against expected yearly loss removed, k€

Source: loss model in annex A. Estimates, with wide margins.

Most of the money is spent in the first year

360,000 euros in 2027, then 125,000 a year to run

Cost by year and investment, k€

Source: supplier quotes of October 2026 and internal staffing estimates.

All three are in place before the next peak season

  1. Jan 2027

    Administration workstations ordered and built

  2. Mar 2027

    Device-bound sign-in for all 2,400 people

  3. May 2027

    Administrators work only from the new workstations

  4. Jun 2027

    First full recovery rehearsal

  5. Sep 2027

    Peak season begins

The decision today

Fund all three

610,000 euros over three years. Closes every step of the September path.

Fund sign-in only

190,000 euros. Stops the first step; leaves the other two for the next intruder who gets in another way.

Defer to 2028

No cost this year. The gaps stay as they were in September.

Decision requested

Approve 360,000 euros for 2027 and the plan for all three

The running cost of 125,000 euros a year returns to this committee with the 2028 budget.