Can Your Revenue Survive a Leak?

South Korea just decided that data breach fines shouldn't be a rounding error on a balance sheet. They’re moving the ceiling to 10% of total revenue.

This is the biggest story of the week since it destroys the idea that fines are just another cost of doing business. For a small shop, a fine tied to a percentage of turnover isn't some slap on the wrist. It's enough to put you out of business. You might not be based in Seoul, but regulators elsewhere are paying attention to see if this stops breaches better than flat fees do. When failing costs you a tenth of everything you make, compliance isn't a task for your office manager anymore. Now it's about survival.

You could pay a consultant to map every data flow in your building. That's the expensive way. The cheap way actually works: stop collecting data you don't need, and you can't leak what you don't have. Most small firms hoard customer info like digital antiques and keep records from 2014 just in case. That isn't an asset. It's a liability waiting for a fine.

Then there's the AI agent problem, and US Congress is writing the first federal bill to force security standards on these bots. Meanwhile, there's a push to make AI agents keep audit trails for financial reporting.

The risk here isn't just some hack. It's about who is responsible. If an AI handles your invoicing or intake and it hallucinations a discount or leaks private info, you can't tell a regulator the bot did it. They'll ask why you didn't have a runtime control to keep the bot from going rogue.

People will tell you to implement an AI governance framework. Don't listen to them. Most of those are just pricey PDFs that sit on a shelf; if you use agents, you don't need a framework. You need a kill switch and a log of every single thing the agent did. If you can't show a plain-text list of what your bot did last Tuesday at 2 PM, you aren't managing risk, and you're just hoping for the best.

Then you have the vendor trap. Just look at Veradigm and the current third-party data breaches in healthcare. Small firms love outsourcing their headaches to certified vendors because they think a SOC 2 or HIPAA compliance badge is a shield. It isn't.

You might argue that you've already signed a service contract or a Business Associate Agreement, so you're fine. You aren't. A BAA is just paper until the data disappears. It doesn't stop a breach; it just tells you who to sue after the fact. Plus, if your vendor goes bust because of a revenue-based fine, that BAA is worthless.

Your insurers will feel this next. As these agentic risks and huge fines become normal, cyber insurance and professional indemnity premiums will jump for firms that can't prove they monitor vendors. Your insurer doesn't care about a signed contract; they want evidence that you checked the vendor's actual performance.

The cheapest way to handle this is a "Trust but Verify" call. Once a quarter, ask your main vendors for proof. I don't mean a certificate. Ask for a screenshot or a log showing they actually deleted data they were supposed to purge; if they hesitate or send you some generic marketing brochure about security, they're lazy or lying. Either way, they're a risk to your money.

If the trend in South Korea moves west, the time for learning as you go is over. We're hitting an era where one security slip can kill a decade of growth.

Do one thing this week, and find the oldest customer record on your server and ask why it's still there. If you don't have a legal reason to keep it, delete it.