The cybersecurity and threat landscape is nearly unrecognizable from the one just a few years ago. Businesses have artificial intelligence to thank for that, as well as the institutionalization of global criminal organizations.
In the U.K. alone, cyber insurance claim payouts are up 230% from the year prior, per a Monday (Nov. 10) report. And that’s not even counting the $2.5 billion hit from the Jaguar Land Rover’s cyberattack this fall which is thought to be the most economically damaging attack in the nation’s history.
The reason it doesn’t count toward the 230% claim payout total? Jaguar Land Rover didn’t have cyber insurance at the time of the attack. Which is potentially another lesson for businesses.
Against this backdrop, B2B companies are turning to data protection assessments (DPAs) and cyber audits not as compliance paperwork but as strategic instruments of trust. A few years ago, a “data protection assessment” might have meant a spreadsheet of security controls checked against ISO 27001 or SOC 2 standards, filed away until next year. But today, that attitude is perilous.
Read more: Why CFOs and CISOs Should Care About B2B Cyber Audits
Advertisement: Scroll to Continue
From Checkbox to Core Discipline
For many B2B firms, the challenge can lie in defining what “cyber risk” means. Regulators rarely provide exhaustive checklists. Instead, they expect organizations to consider both the likelihood and the severity of harm. That includes obvious threats like unauthorized access, but also subtler issues such as algorithmic bias, misuse of software tools, or opaque data-sharing among partners.
Establishing operational cyber guardrails starts with understanding the provenance of data. “You’ve got to have some idea of the chain of custody,” Pradheep Sampath, chief product officer at Entersekt, told PYMNTS in an interview posted Aug. 27.
In practice, a robust assessment can start with data mapping. Companies must trace the flow of information from collection to deletion: who touches it, where it resides, and which systems or third parties interact with it. Cloud architectures and global supply chains complicate the picture, especially when data crosses jurisdictions.
The output isn’t just a risk register; it’s a set of actionable insights. A DPA may reveal, for example, that a marketing automation platform transfers data to an analytics vendor lacking standard contractual clauses for, for example, the European Union’s General Data Protection Regulation (GDPR). Corrective steps might include vendor replacement, new contractual safeguards, or localized data storage.
Meanwhile, the cyber audit, once the domain of IT departments, is becoming a cross-functional engagement designed to examine not just firewalls and encryption protocols, but governance, employee training, vendor management, and incident response plans. For B2B firms that process or host customer data, the audit outcome can determine eligibility for major contracts.
Data from PYMNTS Intelligence in the August edition of The 2025 Certainty Project report, “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms,” found that attackers frequently seek to compromise a vendor first, then use the trust relationship to infiltrate their target firm.
Read more: How Payments Automation Helps CFOs Keep Up With Their Own Data
The Future of Corporate Foresight
Technology may drive the mechanics of data protection, but culture determines its success. DPAs force organizations to grapple with human behavior, the real wildcard in cybersecurity. They expose not only coding flaws but procedural gaps: employees oversharing credentials, departments stockpiling unnecessary data, or vendors failing to encrypt transfers.
“Fraud is growing as fast, or faster, than the pace that the overall B2B market is growing,” Eric Frankovic, general manager of business payments at WEX, told PYMNTS.
In the U.S., Texas’ new Data Privacy and Security Act (TDPSA), which took effect in July 2024, mandates that any business processing consumer data must document and justify its handling of that information. This, along with comparable state-level laws in California and elsewhere have made a business case for DPAs and audits that is no longer abstract.
The real power of DPAs lies not in the forms themselves but in what they represent: a shift from reactive compliance to proactive accountability. Regulators worldwide are moving toward enforcement models that demand demonstrable diligence. Simply claiming to follow best practices is no longer enough; organizations must prove it through documented evaluations and evidence of follow-through.
As artificial intelligence and predictive analytics accelerate, DPAs may evolve again — into automated, continuous monitoring systems. Already, some companies are using AI tools to scan for processing activities that trigger DPA thresholds, flagging risks in real time. Others are integrating assessment frameworks directly into DevSecOps pipelines, ensuring new products are privacy-reviewed before deployment.
And, ultimately, this convergence of law, technology, and ethics could signal a maturing digital economy.
