Minimum viable company – the new cyber paradigm for Consumer & Retail

For some time now, organizations have been aware that it is no longer a question of if, but when, they will face their next incident or data breach. For consumer & retail companies, this threat is even more persistent given their typically high profiles and brand recognition – which can enable sales but also make them a bigger target for disgruntled customers or activists.

The consumer & retail sector has seen a huge boom in e-commerce, accelerated during the pandemic, which, along with complex supply chains, multiple third-party relationships, large amounts of customer data, and a high-profile presence, has made organizations far more susceptible to attacks.

A cyberattack on a consumer & retail company does not just impact the organization and its revenue; it also threatens the data, identity, and potentially the health of thousands and possibly millions of customers – in a very visible manner. In the face of such adversity, how can you weather the storm, fulfill your commitments to stakeholders, and maintain your reputation?

Enter the 'minimum viable company' (MVC). It’s the smallest possible version of an organization that can still function and serve customers should an incident bring down part(s) of the operations and systems.  

An MVC comprises only the most essential components of a company that are critical to its survival and success, streamlined to create a leaner, more agile, and adaptable organization. For established, large organizations, an MVC could involve optimizing operations and supply chains, concentrating on the most profitable customer segments, and using technology to automate processes, improve efficiency, and reduce costs. This is especially relevant to large consumer & retail companies that have grown in complexity through mergers and acquisitions – and/or that have multiple consumer touchpoints to deliver a frictionless, omnichannel experience.

The MVC concept can also be a great model for a startup, introducing lean, efficient practices and operations from the beginning.

By focusing on the value proposition and revenue streams, an MVC can help improve resilience – not just to cyberattacks, but also to natural disasters, economic downturns or other unexpected events that have become more frequent over the last years and even in recent months.

According to the KPMG 2023 CEO Outlook,1 less than half of corporate leaders believe their organizations are well-prepared to address cyberattacks. Cybercriminals are increasingly targeting consumer & retail organizations to steal confidential customer information or disrupt the business. Data breaches can compromise the personal financial details of millions of customers, damaging consumer trust.

In addition, natural catastrophes, geopolitical change, and pandemics like COVID-19 can expose consumer & retail supply chain vulnerabilities, making 'just-in-time' inventory practices look risky rather than efficient.

Against such threats, the MVC offers the potential to maintain business continuity and to help minimize business disruption. As a starter, companies should redefine organizational scope in terms of people, processes, technology, and assets (including key partners), gain board approval, and establish the right governance.

Creating a resilient consumer & retail MVC goes beyond cybersecurity and requires companies to reexamine their core operations and shed the excess. These eight steps can assist companies in building an MVC: