Cyber risk is a board responsibility, and reacting after an attack is no longer enough. Attackers using AI now move faster than detection, so directors need to work closely with security teams, ask hard questions, fund prevention and make everyone in the organisation cyber-aware, aiming to cut detection time to minutes.
We live in a world where digital and cyber threats are as real as physical ones. As board members and non-executive directors, we’re the guardians of our organisation’s reputation, assets, and integrity. And in today’s digital age, that means being the guardians of our cybersecurity posture as well.
You might think that things are improving. After all, the average time it takes hackers to be discovered has dropped from nine days to six. But don’t be fooled. This isn’t a victory lap. It’s more like a red flag.
Cybercriminals are getting faster, smarter, and more ruthless. Fuelled by artificial intelligence, they can now infiltrate our systems with lightning speed and wreak havoc before we even know they’re there. It’s like playing cat and mouse, except the mouse is armed with a digital weapon.
The traditional approach to cybersecurity – reacting to attacks after they happen – is no longer enough. We need to move from firefighting to prevention. Every second counts. The goal? To reduce the time between a cyberattack and its detection to seconds or minutes, not days.
Having worked in and around cyber risk since the late 1990s, primarily during my time at EY, I’ve seen the evolution of threats firsthand. It’s disheartening to see many boards still grappling with the fundamentals of cybersecurity. The reality is, cyber risk is an existential threat to organisations of all sizes. I’ve helped numerous organisations conduct in-depth cyber risk assessments, developing strategies to protect their most critical assets. It’s clear that a proactive, board-led approach to cybersecurity is essential for survival in today’s digital landscape. Every board needs to grasp the gravity of this challenge and take decisive action.
So, what can we do? As board members, we need to be deeply involved in cybersecurity. We need to build strong relationships with our information security teams, asking tough questions and demanding proactive strategies. Regular audits, continuous improvement, and investments in cutting-edge technology are essential. And let’s not forget about the human element – everyone in the organisation, from the boardroom to the mailroom, needs to be cyber-aware.
The stakes are high. A single cyberattack can cripple a business. But with the right leadership and a proactive approach, we can turn the tables on the cybercriminals. It’s time to make cybersecurity a boardroom priority. The future of our organisation depends on it.
What are your thoughts on this new approach? Do you have any specific areas you’d like to focus on?
Want to know more about how I can help? Reach me at LinkedIn here or contact me today for a no obligation discussion.
#cybersecurity #riskmanagement #board #leadership
Frequently asked questions
Why should boards own cyber risk?
The article treats board members and non-executive directors as guardians of the organisation’s reputation, assets and integrity, which now includes its cybersecurity posture. A single attack can cripple a business, and cyber risk is an existential threat to organisations of all sizes, so it cannot be left to the information security team alone.
What should directors ask their security team?
The article urges directors to build strong relationships with information security teams, ask tough questions and demand proactive strategies. Practical areas include regular audits, continuous improvement, investment in current security technology, and making sure staff across the organisation are cyber-aware. The underlying test is how quickly an attack would be detected.
How quickly should a cyberattack be detected?
In mid-2024 the article noted that average attacker dwell time had fallen from nine days to six, and warned this was no cause for comfort because attackers using AI move faster. Its target is to cut the time between an attack and its detection to seconds or minutes rather than days.
Working with Ecaveo
Paul Forrest is a London-based fractional Chief AI Officer, non-executive director and board adviser. Putting cyber and AI risk on the board agenda, with clear questions and detection targets for management, is part of the board advisory and AI governance work available to directors. See fractional Chief AI Officer and AI consultancy, read about Paul’s board and non-executive work, or book a conversation.
Read next. AI-Orchestrated Cyber Espionage Changes the Defensive Baseline and Data Security and Privacy. More articles and research in Insights.
