Cybersecurity is no longer waiting outside the boardroom door. The bigger question is whether boards are ready for what comes next.
For years, cybersecurity was treated as a technical conversation; something the CISO, CIO or security team handled.
That model is gone.
Today, cyber risk can influence revenue, customer trust, business continuity, AI adoption, regulatory exposure and even strategic growth.
And the numbers are making that shift difficult to ignore.
The World Economic Forum reports that 73% of organisations now consider cybersecurity a business priority, yet only 59% of boards back that priority with financial resources. Even more concerning, only around half of leaders say their boards fully understand the cybersecurity risks associated with AI.
That tells me something important:
Awareness has reached the boardroom. Governance hasn’t caught up yet.
The boardroom question has changed
The question is no longer:
“Are we secure?”
It should be:
“Are we making the right decisions about risk, technology and resilience?”
Because today’s enterprise is changing faster than traditional governance models.
AI agents are entering workflows.
Third-party ecosystems are becoming deeply interconnected.
Digital identities are multiplying.
Cyber-enabled fraud is evolving.
And technology decisions are increasingly becoming business decisions.
WEF’s 2026 outlook identifies AI as the defining force in cybersecurity, with 94% of respondents calling it the biggest driver of change and 87% identifying AI-related vulnerabilities as the fastest-growing cyber risk during 2025.
This isn’t simply a security problem.
It is a leadership problem.
What should a board actually ask?
I believe FIVE QUESTIONS deserve far more attention:
1. What could materially disrupt our business?
Not every vulnerability deserves board attention. The focus should be on risks capable of affecting revenue, operations, reputation or strategic objectives.
2. Where is AI making decisions on our behalf?
Boards need visibility into where AI is being deployed, what authority it has and who remains accountable.
PwC now recommends that boards treat AI as an enterprise transformation spanning strategy, capital allocation, operations, talent and risk; not merely as a technology initiative.
3. How quickly can we recover?
Prevention matters. Resilience matters more when prevention fails.
4. What risks are sitting outside our organisation?
Suppliers, platforms, partners and technology ecosystems can create exposure that isn’t visible on a traditional security dashboard. WEF reports that 65% of large companies identify third-party and supply-chain vulnerabilities as their greatest cyber-resilience challenge.
5. Do we have the right expertise around the table?
This may become one of the most important questions of all.
PwC’s 2026 research finds that 71% of directors say AI is the board capability most in need of strengthening.
From reporting risk to governing risk
This is where I believe the next generation of cybersecurity leadership must evolve.
A board doesn’t need another technical presentation filled with acronyms, threat counts and colourful dashboards.
It needs clarity.
What matters?
What could hurt the business?
What should we invest in?
What should we stop?
Where are we comfortable taking risk?
And when something goes wrong, who owns the decision?
That is the difference between cybersecurity reporting and cyber governance.
The next boardroom advantage
AI is making this conversation even more urgent.
Boards are beginning to use AI themselves, but adoption is still behind expectations. PwC reports that 99% of surveyed executives believe boards should be using AI for oversight, while only 35% of directors say their boards currently do so.The opportunity isn’t to put AI into every board process.
It is to build enough AI literacy, cybersecurity awareness and risk judgement to ask better questions.
Because the board of the future won’t be judged by how much technology it understands.
It will be judged by how intelligently it governs technology.
My View
Cybersecurity has officially entered the boardroom.
Now we need to make sure it doesn’t enter merely as another risk report.
It needs to become part of the conversation around strategy, resilience, trust, investment and growth.
The strongest boards won’t ask management to eliminate every risk.
They will ask:
“Do we understand the risk well enough to make the right decision?”
That, to me, is the real evolution of cybersecurity leadership.
The boardroom doesn’t need more fear.
It needs better judgement.
https://www.weforum.org/stories/cybersecurity/cybersecurity-governance-gap
https://www.weforum.org/publications/global-cybersecurity-outlook-2026
https://datawater.com/third-party-supply-chain-cyber-risk/
https://www.pwc.com/us/en/services/governance-insights-center/library/board-oversight-ai.html
