At a glance
- AI-driven attack vectors are raising breach costs, while AI expertise remains limited on boards.
- Cyber governance requires boards to align cybersecurity, AI adoption, business strategy, and risk tolerance.
- Board oversight should focus on areas including strategic alignment, regulatory compliance, and monitoring and reporting.
- Boards can strengthen cyber governance through cyber simulations, regular education sessions, and other practical strategies.
As AI accelerates both cyber threats and cyber defence capabilities, boards must ensure their organizations are prepared to respond to risk at the speed at which it now develops.
For many organizations, the consequences of falling behind are becoming significant as cybersecurity incidents increase in frequency and cost.
In fact, the global average cost of a data breach in 2026 is US$4.99 million, which is a 12% increase from 20251. This is a new record high, influenced heavily by a surge in AI-driven attack vectors1.
Global average cost of a data breach 1
Of course, financial repercussions are not the only cost organizations face when they deal with a cybersecurity incident. Reputational and operational damages can also cripple the business.
Cyber risk is a board-level issue, yet cyber expertise ready for today’s AI-driven risks remains relatively uncommon in the boardroom. From 2021 to 2025, disclosure of technology expertise among S&P 500 directors rose from 20% to 51%, while cybersecurity expertise increased from 15% to 27%2. While the trend is encouraging, not all areas of expertise are advancing at the same pace. AI expertise barely ticked up, from 1.5% to 2.7% in that same time period, and only 23% of surveyed executives consider their board highly fluent in AI2.
Technology expertise is growing, but AI expertise lags
As cybersecurity becomes a speed problem, how can directors strengthen board cybersecurity and help prevent their organization from becoming the latest breach headline? It starts with asking the right questions.
Strengthening cyber governance: Key areas of focus for boards
Technology capabilities have grown significantly over the years, empowering organizations to operate more efficiently and drive expedited outcomes. As technology and AI platforms become increasingly intertwined within workflows and business objectives, board members need to evaluate technology decisions in the same way they evaluate strategic business decisions.
Just as the board guides an organization’s business direction, it is also now responsible for ensuring that the correct technology elements are enabled to support the business strategy and the right level of cyber risk tolerance is achieved and managed.
To strengthen board cybersecurity oversight, directors should focus on the following areas:
Six strategies to increase your cybersecurity knowledge
For boards to successfully oversee their organization’s cybersecurity program, bridging the current knowledge gap is essential. This will help ensure cybersecurity is adequately addressed in regular board meetings and allow boards to confidently carry out their duties where cybersecurity is concerned.
Here are six strategies you can use to build your knowledge and become more prepared to integrate technology risk into decision-making processes:
Ensure you are getting regular updates about cybersecurity and AI-related risks. During these sessions, carve out time to discuss the top risks in your industry and relevant experiences of similar organizations, and ask questions around what your business is doing to mitigate, prevent, or respond to the risk of those types of incidents. The answers you receive may be key in strengthening your organization's defence framework.
It's important to shift the focus from technical metrics to common sense metrics that highlight risk and value. For example, identifying the number of end-of-life systems with vulnerabilities and the controls in place to mitigate their risks, or discussing the complete costs of cyber breaches, which includes the actual response team, legal support, as well as the impacts to insurance premiums and the organization's revenue. Use industry benchmarks to compare your organization with others in your vertical, helping you understand where the organization stands and what improvements are required.
By bringing in external cybersecurity experts, especially those with extensive technology or AI experience, board members can not only enhance their cybersecurity knowledge, but also get support “translating” technology-focused information into risk-focused insights and strategies. Ultimately, adding a cyber seat to the board will offer regular access to the expertise you need that complements your organization's risk management, security, and technology teams.
To get a deeper understanding of actual cyber threats and how to respond to them, consider hosting facilitated incident simulations. These exercises should reflect modern threat scenarios, including AI-enabled attacks, compromised AI tools, or vulnerabilities stemming from the organization's broader technology ecosystem. They will help you understand your role as a board member during a cyber event, potential impacts, areas for continuous improvement in process flows, and build muscle memory.
In the event of a cyber attack, board members should actively engage with and receive updates from the security experts and incident response teams. By staying updated on the incident progress and outcomes, they can offer independent oversight and ask questions to uncover any lingering risks. It's also important for boards to understand how the organization plans to respond to future cyber attacks.
What you can learn from close calls or even a previous cyber incident may be what stops it from happening again. Cyber incidents are rarely isolated events, and recurring weaknesses often create opportunities for future attacks. Ask how many times these close calls or actual incidents have happened and what the organization has learned to identify gaps and develop appropriate measures.
The board’s critical role in managing cyber risk
What has changed in recent years is the level of scrutiny around the board of directors. After all, boards are there to help the organization manage risk—and that includes risks from cybersecurity incidents in a landscape increasingly shaped by AI-enabled threats.
Regulators are increasingly holding boards and executives accountable for compliance failures. Failing to keep pace with evolving cybersecurity requirements can extend well beyond fines to include lost business, operational disruption, and reputational damage.
It is your fiduciary duty to not only provide independent oversight to manage the company’s cybersecurity posture, but also to challenge your organization in different ways to raise the bar for your defence framework.
How BDO can help
Boards can’t govern risks they don’t understand. Our board education sessions help directors bridge the knowledge gap by translating evolving cyber and AI-driven threats into practical risk, oversight, and resilience considerations for the board. In these sessions, we show board members how to refocus a technology-centred conversation into one about business risk, helping you strengthen oversight and ask the right questions of your teams.
In addition, our Perpetual Defence framework can help organizations elevate their cybersecurity posture, and get pre-emptive threat management that adapts to evolving cybersecurity risks. The framework helps you assess your security posture, set up 24x7x365 monitoring and response capabilities, and validate resilience through operational and offensive security testing.
Connect with our cybersecurity leadership team today
Enhance your knowledge of cybersecurity and be prepared for whatever the threat landscape brings next.
Sources:
Cost of a Data Breach Report 2026, IBM, 2026.
Report: In the S&P 500, Disclosure of AI Risks Surges from 12% to 83%, The Conference Board, April 22, 2026.