Headlines to Oversight: What Cyber and AI Mean for the Board

A virtual gathering of CISOs and board directors led to a fascinating discussion that reinforced how quickly the boardroom conversation around cybersecurity and AI is changing.

Thanks to our moderator, Rob Sloan, VP of Cybersecurity Advocacy at Zscaler, for guiding the group through this important discussion, as well as our speakers Helmuth Ludwig and Vish M Narendra and our attendees for sharing their insights with the group.
 

KEY TAKEAWAYS

Frontier AI Is Changing the Speed and Nature of Cyber Risk

• AI adoption is moving faster than many organizations’ governance structures, creating simultaneous pressure to capture the benefits while ensuring protections keep pace. A central board question is: Are we moving fast enough to capture value, and are governance, security, and reporting evolving fast enough to keep pace?
• Attack timelines are compressing dramatically as frontier models operate at machine speed and can chain vulnerabilities, while AI is making social engineering increasingly sophisticated.
• Operational technology remains particularly vulnerable. The “if it works, don’t touch it” mentality around critical equipment conflicts with the need to patch vulnerabilities and protect increasingly connected factories.
• Many boards are still developing enough AI and cyber fluency to challenge management effectively. This can create a bias toward optimistic reporting unless directors are deliberate about probing assumptions and gaps.

Transparency Matters More Than All-Green Cybersecurity Scorecards

• All-green scorecards can create false confidence, especially when boards lack the technical depth to challenge what sits behind the metrics. For any cybersecurity metric, directors should ask: Does this cover 100 percent of our infrastructure? Coverage is rarely complete, particularly where acquisitions continually change the attack surface.
• Boards should create psychological safety for CISOs and management to surface vulnerabilities quickly. “Bad news is good news, and good news is bad news.” A blameless postmortem culture allows issues to surface early enough to reduce the blast radius.
• Confidence should come from understanding where coverage is strong, where gaps remain, what mitigating controls exist, and how management will know if something goes wrong. The discussion should also probe what is keeping the CISO and CIO up at night and where management may be overconfident.
• Directors should focus less on whether a dashboard looks reassuring and more on whether management can explain how it is thinking about security.

AI Security Readiness Is Often a Deployment Problem

• Zscaler findings from more than 800 enterprise security assessments showed exposed, ungoverned AI across every company assessed. In 87 percent, tools capable of mitigating identified risks were already available but were not configured or deployed correctly.
• Frontier models create an opportunity to shift cybersecurity from reactive detection toward proactive threat hunting, identifying vulnerabilities, connecting them to emerging threats, and accelerating remediation.
• Resilience is becoming the critical framing: assume some attacks will succeed, minimize the blast radius, and ask how quickly the organization can contain, restore, and recover.

Agentic AI Requires Human Accountability

• AI agents should be treated like other workers, with unique identities and credentials, least-privilege access, and role-based controls. Governance should be tiered according to potential blast radius, with the strongest controls around agents capable of creating material financial, regulatory, privacy, or operational consequences.
• Agentic drift is a core governance issue: How will we know if an agent moves outside its intended scope? Controls and visibility need to make that detectable.
• Accountability cannot reside with the agent. As the potential impact increases, accountability must attach to a human, including determining when the blast radius is significant enough to require a human in the loop.
• A key board-level question is not just whether controls exist, but whether the organization will know when an agent moves outside its intended swim lane.

Open-Weight Models Create a Different Security Trade-Off

• Open-weight models provide greater control, but that control transfers greater security responsibility to the organization. Most enterprises do not have the resources to replicate the protections surrounding leading frontier models.
• Frontier models can become less useful for certain offensive security testing as restrictions increase, creating cases where open-weight or older models provide needed capabilities. The trade-off is greater utility against potentially greater security exposure.
• Economics may push more workloads toward open-weight models, while specialized vertical models create additional security considerations.
• Organizations need to determine which workloads belong on frontier versus open-weight models and whether they have the resources to protect models operated on their own infrastructure.

Cyber Risk Acceptance Needs Enterprise Accountability

• Cyber risk should not be accepted independently across business functions. Individually reasonable decisions can create unacceptable aggregate exposure, making enterprise-wide situational awareness and a clear risk owner essential.
• Cybersecurity cannot become solely the CISO’s problem. Business leaders remain accountable for their decisions, while security operates as a business partner that helps solve the business problem with appropriate protections.
• Third-party access illustrates the challenge: vendors may need direct access to critical equipment, but that access must be governed because third parties may not operate to the same security standards.
• The board-level issue is who can accept cyber risk on behalf of the company and how aggregate exposure is understood.
• Boards should be explicit about who has the authority to accept cyber risk on behalf of the enterprise, rather than allowing that authority to diffuse informally across business units.

Board Structure and Time Allocation May Need to Evolve

• Cybersecurity often sits within an already crowded Audit Committee agenda, limiting the depth of discussion. Alternative structures include dedicated Cybersecurity Risk Committees, Governance and Trust Committees, and Technology and Strategy Committees combining AI, cyber, and broader digital issues.
• Regular CISO and CIO engagement with the relevant committee chair between formal meetings can create space for deeper discussion and targeted follow-up, with a distilled view then brought into the committee meeting.
• The governance structure should reflect the organization’s risk and the depth of oversight required. Boards should consider whether cyber has enough agenda time, whether Audit remains the right home for detailed oversight, and what needs to reach the full board.
• Boards differ widely in how much time and depth directors want on cyber and AI topics, but 25–30 minutes is often not enough for meaningful oversight.

Resources

• Zero Day Clock
• Cybersecurity: Seven Steps for Board Directors | by Andy Brown & Helmuth Ludwig (if you would like a hard copy, please email Rob Sloan with your mailing address)

Thank you to our partner for making this event possible.