For most of the last decade, boards have treated cybersecurity, resilience, and crisis management as a briefing topic — something the CISO or COO presents twice a year, gets a few questions, and files away until the next incident. That approach no longer matches the risk boards are carrying.
Ransomware, supply chain disruption, geopolitical instability, and tightening regulation (NIS2, DORA, and a growing list of national cyber-disclosure rules among them) have turned security and operational resilience into core strategic risks, not IT problems. Yet most boards are still composed almost entirely of directors with financial, legal, commercial, or industry expertise. Very few have anyone in the room who has run an incident response, managed a crisis under real time pressure, or can independently judge whether the organisation’s resilience posture matches its risk exposure.
The structural blind spot
The result is a structural blind spot. Boards end up depending entirely on management’s own account of how prepared the company is — with no one at the table equipped to stress-test that account, ask the harder follow-up question, or recognise when a briefing is understating the risk.
OUR RECOMMENDATION
Boards should build dedicated security, resilience, and crisis management capability directly into their governance structure — through one of two routes.
Two routes to the same goal
ROUTE 1
A full board member
The first is appointing a full board member with this expertise, giving the organisation a director who carries fiduciary responsibility, sits in every session, and shapes strategy, budget, and risk appetite from the inside.
ROUTE 2
A special adviser
The second is engaging a special adviser: an expert who briefs the board regularly, joins key discussions, and is available when a crisis hits, without occupying a formal board seat. This route is faster to put in place, more flexible, and often a natural first step for boards not yet ready to change their formal composition.
Either path closes the same gap. It gives the board an independent, informed voice on security and resilience — one that can translate technical risk into business terms, challenge assumptions before they become blind spots, and help the board act decisively rather than reactively when disruption hits.
A briefing twice a year no longer matches the risk boards are carrying.
A quarterly discipline
This capability only holds up if it’s paired with a standing discipline: the corporate or family risk map itself needs to be revisited every quarter, not annually. Geopolitical conditions are moving too fast for a once-a-year review to stay relevant — a risk map assessed in January can be materially out of date by the time the board reconvenes in the autumn.
A quarterly cadence should also be the moment the board asks two harder questions: does management still have the right structure and the right people to handle the risks on that map, or does this call for new hires or a different setup? And, just as importantly, does the board itself still have the right people around the table?
A board that is willing to periodically and critically examine its own composition — not only management’s — is far better placed to keep pace with a risk landscape that no longer sits still. Boards that build this capability now, ahead of a crisis, are the ones that protect value, reputation, and continuity when it counts. Boards that wait tend to find out how exposed they were only after the fact.
KEY TAKEAWAYS
- Security and resilience are now core strategic risks, but few boards have anyone who can independently judge them.
- Close the gap with a board member or a special adviser who brings real security and crisis experience.
- Review the risk map every quarter, and use that moment to check both management’s and the board’s own composition.
At Percys, this is one of the governance capabilities we encourage every board we work with to evaluate — and one we’re happy to help think through, whichever route fits your organisation best.
RELATED READING
