The UK Manufacturing Cyber Risk Gap and Your Website or App: A Guide for D2C Brands in UK

Direct answer: Nearly a third of UK manufacturers were hit by a cyber incident in the past year, and half of those affected had no incident response plan in place. For D2C brands in the UK, this matters because your storefront, checkout, and customer data sit downstream of the same fragile supply chains and often carry the same weak points — outdated plugins, unmonitored third-party integrations, and no documented plan for what happens when something breaks.

The trend comes from the Make UK cybersecurity report, published in 2026, which found that close to a third of UK manufacturers experienced a cyber incident in the past twelve months, and that roughly half of the businesses affected did not have a formal incident response plan when it happened. This is a manufacturing-sector statistic, but D2C brands in the UK should not read it as someone else's problem. Many D2C operations depend on manufacturing partners for fulfilment, white-label production, or dropship logistics, and a breach anywhere in that chain — a compromised order file, a leaked customer list, a hijacked API feed — can surface directly on your storefront. The report's second finding is the more uncomfortable one for smaller, growth-stage brands: readiness lags exposure. A business can be digitally active, selling well, and still have no plan for the day its checkout goes down or its customer database is exposed. That gap between "we're online" and "we're prepared" is exactly where D2C brands tend to sit, because the pressure to launch, iterate, and hit growth targets usually crowds out the unglamorous work of incident planning.

It's worth being clear about what "cyber incident" covers in a report like this, since the term spans a wide range of severity. It can mean anything from a phishing attempt that a staff member correctly identified and reported, through to a full ransomware lockout of production systems. The Make UK report groups these together, which is standard practice for an industry-wide survey, but it means the headline figure describes exposure to incidents broadly rather than to catastrophic breaches specifically. That distinction matters for how D2C brands should read the finding: the point isn't that a third of manufacturers suffered a business-ending event, it's that a third of them encountered something serious enough to register as an incident, and half of those had nothing written down for what to do next. That's a low bar for "prepared," and even by that low bar, half the affected businesses didn't clear it.

What the Make UK Finding Actually Shows

The Make UK cybersecurity report is a manufacturing-industry survey, not a retail one, so it's worth being precise about what it does and doesn't say. It reports two connected facts: incident frequency (nearly a third of manufacturers affected in the past year) and response readiness (about half of those affected lacked a plan). It does not give a breakdown by attack type, cost per incident, or sector crossover into D2C retail — so this piece won't invent numbers in those areas. What the finding does establish, credibly, is a pattern: digital exposure in UK supply chains has outpaced the operational discipline needed to handle it. Manufacturers who never saw themselves as "tech companies" are now running order portals, supplier logins, EDI integrations, and cloud inventory systems — all attack surface they didn't have a decade ago, layered onto processes that were never designed with security as a first-class concern.

D2C brands are built on the same layering problem, just from the other direction. You started with a storefront and a payment processor, then added an email platform, a loyalty app, a reviews widget, a subscription tool, a chatbot, and a returns portal — each one a separate login, a separate vendor, a separate piece of code injected into your site. Every plugin and every third-party script is a door. The manufacturing story is relevant to you precisely because it shows what happens when door-count grows faster than plan-quality: readiness becomes theoretical rather than actual, until an incident makes the gap visible in the worst possible way — a public outage, a data exposure notice, or a customer-facing checkout failure during a launch window.

It's also worth sitting with why the gap exists rather than treating it as carelessness. Manufacturers didn't set out to under-invest in incident response; they simply digitised operations faster than they updated governance, because digitisation delivered visible efficiency wins while response planning delivered nothing until the one day it mattered. D2C brands make the identical trade-off for the identical reason. Every new tool you bolt onto a storefront has a clear, immediate business case — faster checkout, better email capture, richer reviews — while the cost of not having a documented response process is invisible right up until it isn't. That asymmetry, more than any single technical failing, is what the Make UK numbers are really describing.

Why This Matters Specifically for D2C Brands in the UK

Trust Is the Product, Not Just the Site

D2C brands sell direct trust: the promise that this is the real brand, at the real price, handling your data and your money responsibly. A breach, or even a visibly clunky, outdated, or slow-to-recover site, damages that trust in a way that's disproportionate to the technical severity of the incident. A manufacturer with a supply-chain breach can often absorb the hit quietly through B2B relationships, working it out contract to contract with partners who understand the operational realities involved. A D2C brand with a customer-facing incident is dealing with public perception in real time, on the same channels it uses to sell — the same Instagram audience, the same email list, the same review pages that drive new customer acquisition. There's no quiet B2B channel to absorb the damage in; the incident and the sales pitch live in the same feed.

The UK Regulatory Backdrop Raises the Stakes

UK D2C brands operate under UK GDPR and are expected to demonstrate reasonable technical and organisational measures to protect customer data. A cyber incident without a documented response plan doesn't just cost recovery time — it raises questions about whether "reasonable measures" were in place at all, which matters for both regulatory exposure and customer communication. Brands that can point to a tested process for incident detection, communication, and recovery are in a materially different position than brands improvising in the moment.

This isn't a call to treat every redesign as a compliance exercise — most D2C founders will rightly bristle at that framing. But it is a reason to notice that the operational discipline regulators expect and the operational discipline that actually protects a brand's reputation point in the same direction. A documented plan, a clean integration map, and clear data retention rules aren't primarily there to satisfy an auditor; they're there because they're what a well-run digital business looks like from the inside. The compliance benefit is a side effect of doing the underlying work properly, not the main reason to do it.

Growth-Stage Brands Are Structurally Under-Prepared

The Make UK finding that half of affected manufacturers had no incident response plan tracks with what's generally true of growing digital businesses across sectors: response planning tends to be one of the last things built, because it has no immediate revenue payoff. D2C brands in particular often run lean teams, outsource development in bursts, and accumulate third-party tools quickly during growth phases. That's a rational way to move fast — but it means the gap between "digitally active" and "digitally resilient" tends to be wider here than in more mature, slower-moving businesses.

There's a compounding effect worth naming here too. A manufacturer that has one core order system tends to have one clear place to focus response planning. A D2C brand, by contrast, typically has its risk spread thinly across a dozen small surfaces — the storefront platform, the email tool, the reviews widget, the loyalty app, the payment gateway, the shipping integration, the customer service chat tool, and whatever analytics or personalization layer sits on top of all of it. None of these individually feels like a major risk, which is exactly why none of them gets a documented plan. The risk isn't concentrated enough anywhere to force the conversation — until an incident forces it all at once, and the team discovers that no single person actually understood how all the pieces connected.

What Changes in Practice for Your Website and App

The practical shift isn't "build a security department." For most D2C brands, it's about closing specific, identifiable gaps that tend to open during rapid growth.

1. Audit What's Actually Running on Your Site

Most D2C sites accumulate scripts, plugins, and embedded widgets faster than anyone tracks them. A proper audit — not a guess — of every third-party integration touching checkout, customer data, or the core storefront is the starting point. Anything unused should be removed; anything essential should have an owner and a known update cadence.

2. Separate Design Decisions From Security Debt

This is where interface work and technical resilience intersect more than people expect. A storefront redesign or UX refresh is the natural moment to also retire legacy plugins, consolidate redundant tools, and rebuild flows — like checkout, account creation, and password reset — with cleaner, more current, better-maintained components. Good UI/UX Design & Branding work isn't purely cosmetic; done properly, it forces a review of every screen and every integration a customer touches, which is exactly the surface area an incident would hit.

The mistake to avoid is treating a redesign purely as a visual exercise and leaving the plumbing untouched. A brand can ship a beautiful new checkout flow on top of the same unmaintained payment plugin, the same forgotten analytics script, and the same third-party widget nobody remembers installing — and walk away having improved conversion while leaving the actual risk exactly where it was. The value of pairing design work with a security-minded audit is that the two checklists overlap almost entirely: anything worth redesigning is worth reviewing for what's actually running underneath it.

3. Write the Incident Response Plan Before You Need It

A response plan doesn't need to be elaborate. It needs to answer, in advance: who gets notified first, who talks to customers, who talks to the payment processor, what the fallback page looks like if checkout goes down, and how customer communication is drafted and approved under time pressure. The manufacturers in the Make UK report who lacked a plan weren't necessarily careless — they simply hadn't prioritised documenting a process for a scenario they hoped wouldn't happen. That's the exact trap growth-stage D2C brands fall into too.

Rehearse the Plan, Don't Just Write It

A plan that exists only as a document nobody has read tends to fail the same way no plan at all does — the first time it's needed is also the first time anyone tests whether it actually works. A short annual walkthrough, even a hypothetical one run over an hour with the core team, surfaces gaps that are invisible on paper: an outdated contact for the payment processor, a communication template that doesn't match the brand's actual voice, or an assumption about who has access to a system that turns out to be wrong. This is a cheap step relative to the value it adds.

4. Treat Automation and Integrations as Attack Surface, Not Just Efficiency Wins

Many D2C brands lean on automation for order routing, inventory sync, and customer service — often built quickly, sometimes without a clear owner. If you're evaluating whether to build these integrations in-house or buy off-the-shelf tools, the build-versus-buy decision has real security implications alongside cost ones, covered in more depth in Business Process Automation Software: Build or Buy?. The wrong choice here doesn't just cost money — it adds unmonitored doors into your systems.

5. Don't Let Personalization Efforts Outrun Data Hygiene

Personalized product recommendations are one of the highest-leverage things a D2C brand can do for conversion, but they depend on collecting and storing more customer behavioural data, which raises the stakes if that data isn't handled carefully. The approach detailed in Ecommerce Personalization: Using Data to Recommend the Right Products is worth pairing with a hard look at where that data lives, who can access it, and how long it's retained — personalization and data minimisation aren't opposites, but they do require deliberate design.

6. Give One Person Clear Ownership

Perhaps the simplest fix, and the easiest to skip, is naming a single person accountable for the site's security posture — not necessarily a technical specialist, but someone whose job includes knowing what's running on the site, who to call if something breaks, and when the last audit happened. The Make UK data suggests that half of incident-affected manufacturers hadn't done even this much. In a small D2C team, this can be a founder, an ops lead, or a development partner with a standing brief — what matters is that the responsibility isn't left to fall between roles, which is what tends to happen by default.

What to Do About It

Start with visibility before you start with spending. Map every system touching customer data or payments, identify which ones are unmaintained or unowned, and prioritise fixing the storefront-facing gaps first — they're the ones customers and regulators will notice fastest. From there, a redesign or rebuild that consolidates tooling and modernises the customer-facing flows does double duty: it improves conversion and trust signals while quietly retiring the legacy risk sitting underneath the old interface. This is also a reasonable moment to look at where your infrastructure decisions sit relative to broader capacity constraints in digital infrastructure — the kind of resource bottlenecks discussed in The Real AI Power Bottleneck Isn't Generation — It's the Grid Connection Queue — since AI-driven personalization and automation tools you might add later depend on infrastructure that has its own emerging constraints.

Sequence the work so that quick wins come first and larger structural changes follow once you have a clearer picture. A one-week integration audit costs almost nothing and immediately tells you where the highest-risk gaps sit. A short, plainly written incident response plan can be drafted in an afternoon by two or three people and immediately closes the "no plan at all" gap the Make UK report highlights. Only after those two steps should a brand commit to a larger redesign budget — at that point, the scope of the rebuild is informed by actual findings rather than guesswork, which tends to keep the project both cheaper and more focused than starting with a full rebuild and hoping it happens to catch the right issues along the way.

Pricing Context: Where This Kind of Work Typically Falls

Closing the gap between "digitally active" and "digitally resilient" usually means a scoped design and rebuild engagement rather than a full platform migration. Here's how that tends to map onto typical service tiers:

Tier	Typical scope for this scenario
Essential — $1,000	Focused audit and redesign of a single high-risk flow (checkout, account, or password reset) with outdated plugins retired
Growth — $2,000	Full storefront UI/UX refresh consolidating third-party tools, modernising key customer touchpoints, and documenting the integration map
Enterprise — $4,000+	End-to-end redesign across web and app, integration consolidation, and structured handoff supporting an incident response plan

Key Takeaways

• Nearly a third of UK manufacturers had a cyber incident in the past year, and half of those had no response plan — a readiness gap, not just a security one, per the Make UK cybersecurity report, 2026.
• D2C brands share this exposure through supply-chain partners, third-party plugins, and fast-growth tool accumulation.
• A storefront redesign is a natural opportunity to retire legacy, unmaintained integrations alongside improving the customer experience.
• Write an incident response plan before an incident forces you to improvise one under pressure.
• Treat automation and personalization tooling as attack surface that needs an owner, not just a growth lever.
• Prioritise visibility — a full map of what's running on your site — before committing budget to any rebuild.

If your storefront has accumulated more tools and plugins than anyone can currently account for, that's usually the first sign it's time for a proper look. book a meeting with our team to walk through where the gaps are and what a scoped fix would actually look like.

Frequently Asked Questions

What did the Make UK cybersecurity report actually find?

It found that nearly a third of UK manufacturers experienced a cyber incident in the past year, and that around half of those affected had no formal incident response plan at the time. It's a manufacturing-sector survey, published in 2026, and doesn't include D2C-specific figures.

Why should a D2C brand care about a manufacturing sector report?

Many D2C brands depend on manufacturing and fulfilment partners, so a breach anywhere in that supply chain can surface on the storefront. The underlying pattern — digital exposure growing faster than response planning — applies just as much to fast-growing retail brands as it does to manufacturers.

Does this mean my D2C brand is at direct risk from manufacturer breaches?

It depends on how tightly integrated your systems are with suppliers — shared order files, EDI feeds, or portal logins all create potential points of exposure. The report doesn't quantify this crossover, but the general principle of shared risk through integrated systems holds regardless of sector.

What is an incident response plan, in practical terms?

It's a documented process covering who gets notified first, who handles customer communication, how a fallback page or degraded mode works if checkout fails, and how the business coordinates with payment processors and regulators if data is exposed. It doesn't need to be lengthy — it needs to be actually written down and rehearsed.

Why do so many growing brands skip writing one?

Because it has no immediate revenue payoff and competes for attention with feature launches, marketing campaigns, and sales targets. It tends to get built only after a near-miss or an actual incident, which is the exact pattern the Make UK report describes among manufacturers.

How does UI/UX design connect to cybersecurity at all?

A redesign forces a full review of every screen and integration a customer interacts with, which is often the first time anyone audits what third-party tools are actually running. Rebuilding checkout, account, and password-reset flows with current, well-maintained components closes gaps that accumulate silently over time.

What's the first practical step for a small D2C team?

Map every third-party script, plugin, and integration currently running on the site, and identify which ones no longer have a clear owner or update schedule. Visibility comes before any spending decision.

Should I prioritise a full rebuild or a targeted audit first?

Start with a targeted audit of the highest-risk flows — checkout, account creation, password reset, and data collection points — before committing to a full rebuild. That keeps early cost proportionate to the actual risk you find.

How much does this kind of work typically cost?

For a D2C brand, this usually falls between $1,000 for a focused single-flow audit and redesign, and $4,000+ for a full end-to-end web and app overhaul with integration consolidation. Growth-tier engagements around $2,000 typically cover a full storefront refresh.

How long does a typical engagement like this take?

A focused flow-level redesign can often be scoped and delivered in a few weeks; a full storefront consolidation project generally runs longer depending on how many integrations need to be reviewed and replaced. Timelines depend heavily on how much legacy tooling is in place.

Is UK GDPR relevant to this specific issue?

Yes — UK GDPR expects businesses to demonstrate reasonable technical and organisational measures to protect personal data. A cyber incident without any documented response plan raises questions about whether those measures were genuinely in place, independent of the incident's technical severity.

What counts as "customer data" that needs protecting here?

Names, addresses, order history, payment tokens, loyalty program details, and any behavioural data collected for personalization all count. The more personalization and automation a brand runs, the more categories of data accumulate and need active management.

Does personalization increase my risk exposure?

It can, because effective personalization requires collecting and storing more behavioural data about customers. That's not a reason to avoid personalization — it's a reason to pair it with clear data retention and access policies from the start.

What's the difference between building automation in-house and buying a tool?

Building in-house gives more control over security practices but requires ongoing maintenance responsibility; buying a tool shifts some of that burden to the vendor but adds a third party with access to your data. Both choices carry real security trade-offs alongside the usual cost and speed considerations.

How do I know if a plugin or integration is a security risk?

Signs include no recent updates, no clear internal owner, broad permissions it doesn't need, or origin from a vendor you no longer actively use. An audit that inventories update history and ownership for every tool is the most reliable way to surface this.

What happens if my checkout goes down during a high-traffic period?

Without a plan, teams typically improvise a fix live, which is slower and riskier than following a rehearsed fallback process. A documented plan defines a degraded-mode page, a communication template, and clear ownership so recovery doesn't depend on whoever happens to be online.

Can a small team realistically maintain an incident response plan?

Yes — a lean plan naming two or three people, their responsibilities, and a short communication template is far better than nothing, and is realistic for small teams to maintain. It doesn't need enterprise-scale documentation to be useful.

Is this only relevant to brands that manufacture their own products?

No — it applies to any D2C brand relying on external suppliers, fulfilment partners, or dropship arrangements, since those relationships create the same kind of shared digital exposure the report describes. Brands that manufacture in-house face a version of the same risk directly.

What role does Scult play in addressing this?

Scult's UI/UX Design & Branding work is well suited to the redesign side of this problem — auditing and rebuilding customer-facing flows while retiring outdated, unmaintained integrations along the way. It's a natural entry point for brands that need both a better customer experience and a cleaner technical footing.

Does a redesign actually reduce security risk, or just improve looks?

A properly scoped redesign includes a technical review of every integration touching the redesigned flow, which is where the risk reduction actually happens — not from visual polish alone. The value is in the audit work that has to happen to do the redesign properly.

What's a reasonable first question to ask a development partner about this?

Ask them to walk through how they'd audit your current third-party integrations before touching any design work, and what they'd flag as immediate risk versus longer-term cleanup. Their answer tells you whether they're thinking about this holistically or just visually.

How does this connect to broader AI infrastructure trends?

As D2C brands adopt more AI-driven personalization and automation, they become more dependent on infrastructure capacity that has its own emerging constraints, such as grid connection delays for data centres. It's a reason to plan infrastructure and integration choices with some slack built in, rather than assuming capacity will always keep pace with ambition.

What's the realistic cost of doing nothing here?

The report doesn't provide a cost figure, so it would be wrong to state one — but the general pattern from unplanned incidents across digital businesses is that recovery under pressure, without a plan, tends to be slower and more visible to customers than a planned response would be. The cost shows up in trust and recovery time more than in a single line item.

Should I be worried specifically about ransomware?

Ransomware is one of several incident types that can affect any digitally active business, but the Make UK report doesn't break down incident types, so it isn't accurate to single it out as the primary threat here. The more actionable takeaway is readiness generally, regardless of the specific incident type.

How often should I re-audit my site's integrations?

A reasonable baseline is a full audit at least once a year, plus a lighter review every time a new tool or plugin is added to a customer-facing flow. Growth-stage brands adding tools frequently may need to check more often.

Does this apply to mobile apps as well as websites?

Yes — mobile apps carry the same third-party SDK and integration risks as websites, often with less visibility since app store review doesn't catch every dependency issue. Any audit should cover app-side integrations with the same rigor as the website.

What's the relationship between incident response and customer trust?

Customers generally forgive a handled incident more readily than a mishandled one — clear, fast, honest communication matters more than the incident never happening at all. A plan exists specifically to make that fast, clear response possible under pressure.

Is this more relevant to brands using Shopify, WooCommerce, or custom-built stacks?

The specific risks differ by platform, but the underlying pattern — plugin and integration sprawl outpacing maintenance — applies across all of them. Platform-hosted stores tend to have more third-party app risk; custom stacks tend to have more code-maintenance risk.

What should I ask a manufacturing or fulfilment partner about their own security posture?

Ask whether they have a documented incident response plan and how they'd notify you if a breach affected shared systems like order files or inventory feeds. Given that half of affected manufacturers in the report had no plan, this is a reasonable and increasingly necessary question to ask directly.

Can a redesign be phased to manage cost?

Yes — starting with the highest-risk single flow, such as checkout, and expanding from there is a practical way to manage cost while still making meaningful progress. This maps closely to the tiered pricing structure most engagements follow.

What's the biggest mistake growth-stage D2C brands make here?

Treating security and response planning as something to address after a problem occurs rather than before, which is exactly the pattern the Make UK report documents among manufacturers. Fast growth makes this mistake more likely, not less, because there's always something more urgent competing for attention.

Do I need a dedicated security specialist on staff?

Not necessarily at early stages — many of the highest-value steps, like auditing integrations and documenting a response plan, don't require a full-time specialist, just deliberate attention during a redesign or growth phase. As the business scales, dedicated ownership becomes more worthwhile.

How does this affect app store or platform compliance?

Data handling and security expectations from platforms like Apple and Google are generally stricter around clearly disclosed and minimised data collection, so a cleaner integration footprint also tends to ease compliance reviews. It's a secondary benefit of the same audit work.

What's the single most useful document to create this quarter?

A one-page incident response plan naming responsible people, communication steps, and a fallback plan for checkout failure is the highest-leverage, lowest-effort document most D2C brands are currently missing. It directly addresses the gap the Make UK report highlights.

How do I balance moving fast with not accumulating this kind of risk?

Build a lightweight review step into how new tools get added — a quick check on data access, update history, and ownership before a plugin goes live — rather than slowing down the whole team. Speed and hygiene aren't mutually exclusive if the check is small and consistent.

Is this a one-time fix or an ongoing responsibility?

Ongoing — new tools, new integrations, and new team members mean the integration map changes continuously, so periodic re-audits are necessary rather than optional. Treating it as a one-time project tends to recreate the same gap within a year or two.

What's the risk of ignoring this and just focusing on growth metrics?

The risk isn't necessarily immediate, but it compounds — every unmaintained integration and undocumented process adds to the eventual cost and disruption of an incident when it does happen. Growth without proportional attention to this creates a widening gap, not a stable one.

Does Scult offer ongoing support after an initial redesign?

Scult's engagements can be scoped for one-time redesign work or structured with ongoing collaboration, depending on what the brand needs going forward. The right starting point is a conversation about current gaps and priorities.

How does data minimisation fit into personalization strategy?

Effective personalization only needs the behavioural data that actually improves recommendations — collecting and retaining more than that adds risk without adding value. Building this discipline in from the start avoids the harder problem of retroactively cleaning up an oversized dataset.

What's a reasonable timeline to get an incident response plan in place?

A basic, usable plan can typically be drafted within a couple of weeks if a small group commits time to it — the main obstacle is prioritisation, not complexity. Waiting for a "better time" is usually how it never gets written.

Should this work be done before or after a major sales event?

Before — high-traffic periods like major sales events are exactly when an unplanned incident is most damaging and most visible, so audits and response planning are best completed well ahead of peak periods. Doing this work reactively during a crisis is the worst-case scenario the plan exists to avoid.

How does this connect to broader UK retail digital trends in 2026?

UK retail generally is under increasing pressure to demonstrate digital trustworthiness alongside good customer experience, and the Make UK finding is one data point among several suggesting that readiness across UK industries hasn't kept pace with digital adoption. D2C brands that get ahead of this stand out precisely because most competitors haven't yet.

What if my brand has never had an incident — does this still apply?

Yes — the report's finding is about a gap in preparedness that exists regardless of whether an incident has happened yet. Not having had an incident is not the same as being prepared for one.

Can this audit reveal opportunities beyond security, like conversion improvements?

Often, yes — auditing every integration and flow tends to surface redundant tools, conflicting scripts, and slow-loading widgets that also hurt conversion and page speed. The security-motivated audit and a performance-motivated audit usually overlap significantly.

What's the role of the CTO or technical lead in a brand without one?

Many D2C brands don't have a dedicated CTO, which means this responsibility often falls to whoever manages the website or an external development partner. Making this ownership explicit — even informally — is itself a meaningful step toward readiness.

How do I explain this priority to stakeholders focused only on growth metrics?

Frame it in terms of what an unplanned incident costs in lost sales, support time, and customer trust during exactly the periods growth matters most, like launches and sales events. Readiness is a growth protection measure, not a competing priority.

Does this apply equally to B2C and B2B-adjacent D2C brands?

The general pattern applies to both, though B2B-adjacent brands often have additional contractual data-handling obligations to business customers that make a documented response plan even more directly necessary. Either way, the underlying gap the report identifies is not sector-specific.

What's the most overlooked area during a typical site audit?

Old, half-forgotten plugins and scripts added for a one-time campaign or feature that were never removed are consistently the most overlooked risk area. They tend to be low-visibility but still retain access to core systems.

Where should a D2C brand start if budget is very limited?

Start with a written inventory of every tool and integration currently live on the site — this costs time, not money, and is the foundation every other step depends on. From there, prioritise fixes by risk rather than trying to address everything at once.

How do I know when the redesign work is actually finished?

There isn't a single finish line, but a reasonable milestone is when every customer-facing flow has a clear owner, every integration has a known update cadence, and the response plan has been written and reviewed by the whole team. From there, the work shifts from a project into a recurring habit of periodic review rather than a one-off fix.