Cybersecurity has decisively moved out of the server room and into the boardroom. As attacks increasingly threaten operations, revenue, reputation and customer trust, organisations are being forced to rethink who owns cyber risk — and how resilience should be funded, measured and managed.
“Cybersecurity has moved beyond the IT department. When an attack can stop operations, disrupt revenue and damage customer trust, cyber risk becomes business risk and a boardroom responsibility,” says Keyur Shah, Associate Field CISO, Sophos.
The challenge is compounded by attackers who increasingly use AI and operate across identity, email, endpoint, network and cloud. Shah argues that defending these layers independently is no longer enough.
Connected defence
“The new playbook is ‘connected defense’: prevention, detection, threat intelligence and response working as one system,” says Shah. For CISOs, he adds, resilience is measured not by the number of tools deployed, but “by how quickly we can see, decide, contain and recover — and how prepared we are before the attack happens.”
That shift also changes boardroom conversations around investment and accountability.
“Cyber risk is business risk. IT leaders need to translate technical concerns into plain business language, free of jargon, to effectively make the case for budget and demystify the mid- to long term risk cyber threats present to the board,” says Jan D’Herdt, SANS Certified Instructor at SANS Institute.
Resilience first
Investment, however, cannot focus solely on technology. D’Herdt stresses that “everyone in an organisation holds responsibility for cybersecurity,” particularly as shadow IT expands the potential attack surface.
Measuring success also requires a different mindset. “Strong cyber protection looks like business as usual. It’s boring but boring is the goal,” he says.
When incidents happen, disciplined decision-making becomes critical. “Don’t get tunnel vision on how an attack happened. Zoom in on why it happened, so history doesn’t repeat itself.”
As Shah concludes, in the AI era, “decision speed and coordinated response will define cyber resilience.”
