Skip to content
CISOteria

Tag: Cyber Resilience

The Board Is Asking Cybersecurity Questions. But Can It Judge the Answers?

Posted on by CISOteria

The Board Has the Answers. Does It Understand Them?

A board can review every cybersecurity report, ask every recommended question, approve more investment, and still fail to govern cyber risk properly.

Cybersecurity has quietly changed the job description of the board, not because directors are expected to understand malware, analyse attack techniques, or debate the merits of competing security technologies, but because cyber incidents increasingly determine whether an organisation can continue operating, comply with regulatory obligations, preserve stakeholder trust, and execute its strategy. 

The discussion has therefore moved from technology to governance. This raises an uncomfortable question that many boards still need to answer: what does real accountability for cybersecurity look like?

For years, the answer seemed simple. Cybersecurity became a regular board topic, the CISO gave quarterly updates, dashboards became more detailed, and directors approved more spending or asked for independent reviews. From the outside, this looked like strong governance.

Recent academic research suggests that the reality is more complicated.

When Oversight Becomes Theatre 

A Full Agenda Is Not Proof of Governance 

One of the most important findings from recent research is not simply that boards struggle with cybersecurity. It is that many directors believe they are providing effective oversight, while cybersecurity specialists looking at the same process disagree.

The researchers interviewed directors, cybersecurity executives, and senior consultants, while also reviewing 1,000 firms from the Russell 3000. Only 14.7% reported having at least one director with cybersecurity or closely related expertise. More than half of the non-expert directors interviewed believed that specific cybersecurity expertise was not necessary for effective oversight, while none of the expert directors agreed.

The difference was not about effort. Non-expert directors attended meetings, reviewed reports, completed training, and asked questions just as expert directors did. The problem was that these activities could still remain symbolic if directors did not have enough knowledge to understand which information was truly reassuring and which information should change the board’s view of risk.

Governance is not measured by how many meetings are held or how many reports are reviewed. It is measured by whether directors can challenge assumptions, influence important decisions, and recognise when positive metrics hide serious weaknesses.

The researchers describe this as the difference between symbolic and substantive oversight. Symbolic oversight looks like governance. Substantive oversight improves the decisions that follow.

More Dashboards, Same Blind Spot 

Reports Still Need Context

The natural response to weak oversight is often to give directors more information: more dashboards, more indicators, more reports, and more external reviews.

But the problem is often not a lack of information. It is a lack of context, interpretation, and challenge.

A lower number of critical vulnerabilities may mean security has improved, but it may also mean the organisation changed how it measures them or reduced the scope of its scanning. High compliance scores may show that processes are being followed, but they may say very little about whether the organisation can continue operating during an attack. A positive assurance report may confirm that a review took place without showing whether it covered the systems, suppliers, and dependencies that matter most.

Without context, information can create confidence instead of understanding.

The information gap may also be larger than boards realise. In a supporting survey, CISOs estimated that the median share of peers who filtered reports to make themselves or their managers look better was 40%. The study does not prove that 40% of board reports are false, but it does show that experienced security leaders see selective reporting as a real governance risk.

A board without enough expertise may not notice when information has been softened, simplified, or framed to highlight progress. More importantly, it may not realise that there is anything to notice.

Monitoring Does Not Mean Governing 

Another study offers a useful way to think about this issue. Instead of treating oversight as a regular reporting task, the authors argue that boards should approach cybersecurity as an ongoing process of strategic sensemaking.

They describe three activities: scanning, interpretation, and action. These should continue before an incident, during an attack, and throughout recovery.

The board’s role is not to manage cybersecurity operations. It is to make sure the organisation keeps identifying important risks, understands what they mean for the business, and makes decisions that improve long-term resilience.

Accountability Starts Before the Incident

Governance failures often begin long before a cyber incident reaches the boardroom.

They begin when ownership of important risks is unclear, when business leaders assume cybersecurity belongs only to the security team, when supplier risk is reviewed separately from business continuity, or when management’s confidence is not supported by evidence the board can examine.

By the time an incident happens, many of the decisions that shape its impact have already been made. The organisation has already decided which systems are most important, which risks it will accept, which remediation deadlines can move, and which recovery capabilities deserve funding.

Strategic oversight therefore starts with clear ownership, clear decision rights, reliable evidence, and a direct link between cyber risk and business priorities.

The Questions Have Changed

For many years, boards asked whether the organisation had the right controls, whether regulatory duties had been met, or whether audits had found serious weaknesses. Those questions still matter, but they are no longer enough.

A stronger governance discussion asks whether the board understands which cyber risks could affect the organisation’s strategy, who owns those risks outside the security team, what evidence supports management’s confidence, and how directors would know if their current view of risk was no longer correct.

These questions are harder because they do not only ask for information. They ask for understanding.

Smart Directors Can Still Ask the Wrong Questions 

The study does not say that every board must appoint a former CISO. It does show that boards without real cybersecurity knowledge face a greater risk of confusing visible governance activity with effective oversight.

Directors with cybersecurity expertise are more likely to notice gaps, challenge assumptions, test reports, and separate technical detail from business impact. Their value is not mainly in explaining technology. It is in improving the board’s judgement.

One of the most important findings is that directors without cybersecurity expertise often do not realise that their oversight may lack depth. This creates a serious blind spot because boards cannot easily fix a weakness they do not recognise.

That does not mean one expert should carry the responsibility for the whole board. All directors still need to understand how cyber risk affects strategy, operations, finance, compliance, and trust. Expertise should improve the board’s work, not replace shared responsibility.

If Everyone Owns Cyber Risk, No One Does

Both studies point to the same basic issue: effective cybersecurity governance depends on visibility.

Directors need to know who owns important risks, how decisions are made, what evidence supports management’s confidence, which dependencies affect resilience, and how risk is changing across the organisation. Without that visibility, accountability is difficult to test or prove, even when everyone is acting in good faith.

Technology cannot create board accountability, but it can make accountability easier to see, challenge, and support with evidence.

This is where a governance platform can help. Its value is not in creating another separate dashboard, but in connecting risks, ownership, controls, evidence, compliance duties, and third-party relationships in one place.

Conclusion

The Board Will Be Judged by What It Can Prove 

Regulators, investors, customers, and executive teams increasingly expect boards to show not only that cybersecurity appears on the agenda, but that directors understand how cyber risk is governed, challenged, and connected to strategy.

That expectation cannot be met through reporting alone. It requires boards that are willing to question their own assumptions, organisations that can prove accountability instead of only describing it, and governance processes that turn cybersecurity from a technical issue into a business decision.

The boards that govern cyber risk well will not necessarily be those that receive the most information. They will be those that can challenge what they are told, recognise what is missing, and connect cyber risk to the decisions that shape the organisation’s future.

For Further Reading

This blog post is based on insights and analysis from:

  • Lowry, Michelle R., Anthony Vance, and Marshall D. Vance. “Inexpert supervision: Field evidence on boards’ oversight of cybersecurity.” Management Science 72.2 (2026): 783-804. https://doi.org/10.1287/mnsc.2023.0414

Geopolitical Cyber Risk: The Hidden Threat Your Risk Register Is Missing

Posted on by CISOteria

The Internet Doesn’t Care About Your Threat Model, But Geopolitics Just Rewrote It Anyway 

Geopolitical cyber risk can start changing your exposure long before anyone updates the risk register.

A treaty gets signed between two countries. Nobody in your security team reads about it. Nobody adds it to the risk register. Yet within months, the networks carrying data between those countries begin forming more direct connections.

No firewall changed. No vulnerability disappeared. The structure underneath the internet simply adjusted to a new expectation of risk. 

Now change the conditions. Sanctions. A diplomatic crisis. A border skirmish. Network operators begin reconsidering who they depend on, which traffic they accept, and how much instability they are willing to carry. They do not always wait for a government order. Sometimes companies move first because they can already see the risk approaching. 

This is not theory. Researchers analyzed routing relationships across more than 70,000 internet networks, 173 countries, and 96 months. They found that a treaty was associated with a 58.5% increase in direct interconnection agreements between networks across the countries involved. 

That is not a rounding error. That is the internet reorganizing around power politics without a single CISO in the room. 

Here’s the uncomfortable part: your risk register probably doesn’t have a line item for “geopolitical relationship between Country A and Country B.” 

But perhaps it should. 

Because that relationship may already be shaping which networks carry your data, which suppliers remain dependable, which regions are becoming harder to support, and how quickly the business could recover if one of those dependencies disappeared. 

The Threat Model Is Missing Something

The World Economic Forum Just Confirmed What CISOs Suspected

The Global Cybersecurity Outlook 2026 surveyed more than 800 security leaders across 92 countries. It found that 64% of organizations now factor geopolitically motivated cyberattacks, including espionage and critical infrastructure disruption, into their overall risk strategy. 

That’s not a niche concern anymore. That’s a majority. 

And it’s not paranoia. Politically motivated cyber activity rarely stays contained within governments. It spills into telecommunications providers, cloud platforms, suppliers, transportation systems, financial infrastructure, and businesses that were never the primary target. 

Those organizations do not need to be part of the conflict. Their position inside the digital ecosystem is enough. 

A company may be targeted because of the customers it serves, the technology it operates, the research it holds, the infrastructure it supports, or the access it can provide to someone more strategically valuable. 

Sometimes you are the target. Sometimes you are the route. 

Confidence Is Falling Exactly When It Should Be Rising

The same WEF report found that 31% of respondents lacked confidence in their country’s ability to respond to a major cyber incident affecting critical infrastructure. Last year, that number was 26%. 

Confidence is going down while geopolitical instability is going up. That gap is where surprises live. 

And the gap isn’t evenly spread. Confidence in critical infrastructure protection sits at 84% in the Middle East and North Africa. In Latin America and the Caribbean, it’s 13%. If your organization operates across regions, your actual exposure varies wildly depending on which government, which infrastructure, and which alliance sits behind each office you have. 

Sanctions Leave a Blind Spot 

The Internet Gets an Exception 

Here’s a detail that is easy to miss when assessing geopolitical cyber risk: internet interconnection is routinely exempted from sanctions regimes.

The US Treasury has explicitly authorized peering with sanctioned telecom providers in Cuba, Iran, and Sudan since 2009. The EU clarified in 2022 that sanctions on Russia do not apply to the telecommunications infrastructure keeping communications running.

Why does this matter for you? Because it means the usual tools, tariffs, sanctions, and contract enforcement, do not fully reach the layer where your data actually moves. Almost 99.5% of interconnection agreements between networks are handshake deals with no formal contract at all. There is no clear legal backstop. The protection the business is used to relying on elsewhere may not exist here. 

The Real Risk Isn’t the Sanction, It’s the Retaliation

When China placed tariffs on Australia after a diplomatic dispute in 2020, the story didn’t end with trade numbers. Cyberattacks against Australian targets spiked immediately after, and by 2024, twenty members of an Australian parliamentary group focused on China had been directly targeted.

This is the pattern security leaders need to internalize: geopolitical tension doesn’t stay in the news cycle. It shows up as attack traffic, weeks or months later, often aimed at organizations that had nothing to do with the original dispute. 

Shadow AI Opens Another Front 

Urgency Moves Faster Than Governance

Geopolitical pressure changes how people work. A regional team needs a translation immediately. Procurement wants a supplier document summarized. Security needs to review unfamiliar material. Operations is trying to keep moving while normal support channels are unstable. 

So someone opens an AI tool nobody approved. 

The obvious risk is data leakage. The less obvious one is that the organization has just created another external dependency without checking where the service processes data, which infrastructure supports it, which jurisdictions affect it, or whether access could disappear when conditions change. 

One urgent task becomes a repeated shortcut. The shortcut becomes a workflow. Then leadership discovers that sensitive work depends on a tool with no contract, no accountable owner, no continuity plan, and no clear record of where the information went. 

Shadow AI belongs in the geopolitical cyber risk conversation because instability does not only change external threats. It also creates internal pressure to adopt services faster than the organization can assess them. 

That is how a tool nobody approved becomes part of a risk nobody mapped. 

So What Should CISOs Do? 

Nobody Owns the Whole Picture 

Geopolitical risk sits in a strange no-man’s-land inside most companies. Legal watches sanctions. Finance watches currency and commercial exposure. Procurement watches suppliers. Operations watches service delivery. Threat intelligence teams watch nation-state activity. 

Yet nobody may own the question that connects all of them: What happens to the business if political conditions change the security, availability, or trustworthiness of a dependency we rely on?

The WEF data suggests that large organizations are beginning to close this gap. Among organizations with more than 100,000 employees, 70% increased their focus on nation-state threat intelligence, compared with 30% of smaller organizations. Large organizations were also more likely to deepen engagement with government agencies and information-sharing groups, at 49% compared with 26%. 

Translation: the biggest players are already treating geopolitics as a core input to security decisions. Many others are still treating it as background noise. 

Turning Uncertainty Into a Decision 

The organizations doing this well are not guessing. They are mapping exposure the same way they would map any other risk: which vendors operate in which countries, which conflicts or political relationships affect them, and which of those conditions could change fast enough to matter. 

CISOs do not need to predict every geopolitical development. They need a repeatable way to decide whether it changes the organization’s risk. Ask three questions before the risk register falls behind: 

  • What changed?
    Did targeting increase, sanctions affect a provider, or a region become less stable? 
  • What does it touch?
    Which services, vendors, data flows, users, and recovery processes depend on it?
  • What decision changes?
    Does the organization need tighter monitoring, faster remediation, stronger access controls, an alternative provider, tested recovery, or board escalation? 

That is the practical translation CISOs need to make. A vague warning gives leadership something to worry about. A clear exposure gives leadership something to decide. 

Resilient Companies See More 

Highly resilient organizations do not rely on controls alone. They involve security earlier, map more of the ecosystem around them, and test what happens when a dependency fails. Among highly resilient organizations, 70% involve security in procurement, 59% assess supplier security maturity, 48% map their ecosystem in detail, and 44% run incident or recovery exercises with partners. 

Same threats. Same world. Completely different visibility.

That visibility does not remove geopolitical cyber risk. It gives the business enough time to act before a supplier, region, network, or hidden AI dependency makes the decision for it. 

Conclusion: The Risk Register Is Already Late

Global conflict, nation-state activity, sanctions, and regional instability will keep changing the conditions around your organization, often before any system fails and before any alert gives the security team a reason to look. 

The CISO cannot control those conditions. The job is to recognize when they have changed the organization’s exposure, identify which suppliers, regions, data flows, and unapproved tools now carry more risk, and turn that change into a decision leadership can defend. 

Could the organization show the board, today, which dependencies would become critical if geopolitical conditions shifted tomorrow? 

Geopolitical cyber risk is not simply another category to add to the register. It changes the likelihood, impact, urgency, and ownership of risks already there.

The risk register may already be late. The decision does not have to be.

For Further Reading

This blog post is based on insights and analysis from: