Why Boards Must Take a More Proactive Approach to Cybersecurity

In today's business world, cybersecurity plays a central role in the sustainability and success of organizations. However, boards of directors often underestimate their company's cybersecurity preparedness and their managerial roles in this area. A recent survey found that while 71% of executives considered their cybersecurity budgets adequate or high, only 39% felt their board's understanding of cybersecurity was sufficient. A proactive board must look beyond growth strategy and help ensure long-term business stability and resilience. Effective cyber oversight is essential. In practice, boards should actively scrutinize cyber risk and readiness. When it comes to cybersecurity, the supervisory approach encourages leadership teams to anticipate risks, identify resource needs, and test response plans. Cyber resilience and business continuity are essential priorities.

Three Fundamental Mistakes Boards of Directors Make Regarding Cybersecurity

The consequences of shortcomings in cybersecurity can be serious. Outdated systems and inadequate defenses can lead to costly strategic, reputational, and operational losses. Boards of directors must address three fundamental errors to strengthen their oversight roles:

1. Underestimating the Business Consequences of Inaction

Many executives readily discuss strategic vision and growth while overlooking the potential consequences of inadequate cybersecurity funding. The cost of cyber incidents raises questions about whether board members, executives, and employees should understand the value of a day's work, grasp the limits of tolerance for short-term operational disruptions, and identify potential vulnerabilities. Viewing cybersecurity solely as a cost item leads to it being perceived as a compliance burden left to operational managers. However,a controlling point of view Recognizing the strategic importance and business value of cybersecurity, the company emphasizes that funding and audit decisions can have significant consequences. The failure of United Health subsidiary Change Healthcare to implement multi-factor authentication, resulting in the disclosure of 190 million patient records and costs exceeding $2.5 billion, is a prime example of this inaction.

2. Creating Excessive Technical Debt

Technical debt Technical debt is a significant and often overlooked cyber risk, encompassing elements such as outdated infrastructure, unresolved maintenance, expired software, and missing patches. These vulnerabilities can lead to unnecessary security breaches, unforeseen outages, and productivity losses. Boards of directors can address this technical debt through impairment assessments and contingent liability estimates, similar to due diligence approaches used in merger and acquisition processes. Tenet Health's $100 million revenue loss due to outdated infrastructure and the data breach affecting over 150 companies via Snowflake servers illustrate the tangible costs of technical debt.

3. Not Embracing Bad News as a Business Development Opportunity

It's a natural human tendency for managers to downplay or conceal bad news. However... a controlling mindset This approach fosters a culture of "what should go right" and "what could go wrong," enabling widespread sharing of risk information. It eliminates organizational blame. The First American Financial case, where 800 million mortgage data points were exposed and internal IT security reports were leaked to the public without the knowledge of executives, highlighted the importance of open communication and proactive oversight. Auditors acknowledge that cyber risk cannot be completely eliminated, and therefore, measures are necessary to address vulnerabilities and breaches earlier and more effectively. transparency and open dialogue They encourage action. A cyber incident is not the time to start sharing bad news; rather, regulators continuously explore and adopt solutions to unresolved challenges to improve operations, tighten processes, and mitigate risks.

Five Steps to Becoming a Better Supervisor

Boards of directors,reducing cyber risks and increasing endurance To achieve this, one must adopt a supervisory mindset. Five concrete steps are suggested:

1. Place oversight at the center of board cybersecurity discussions and decisions. This enables managers to think proactively and fulfill their strategic oversight duties.

2. Encourage your cyber teams to think broadly about the consequences of inaction. A comprehensive approach is needed to address the strategic, financial, operational, and reputational consequences of cyber threats.

3. Conduct frequent due diligence to better understand and reduce technical debt. This identifies risks that could jeopardize the strategy, disrupt the value chain, and negatively impact financial results.

4. Consider the strategic advantages of cybersecurity investments, in addition to their cost. Cybersecurity is a competitive advantage It should be positioned as a source.

5. Rethink the board's cybersecurity updates as a learning opportunity. This creates a culture that doesn't personalize performance gaps and job challenges, fosters learning, and encourages employees to voice potential problems.

A supervisory mindset is critical for boards of directors in mitigating cybersecurity risk, building resilience, and establishing a realistic foundation for sustainable growth. This perspective moves cybersecurity from a compliance exercise to a more sustainable one. lasting strategic advantage It encourages meaningful thoughts and actions that elevate one to a higher level.

How proactive is your board of directors in managing cybersecurity risks?

First published: LinkedIn, 2025-06-13 16:16. Original article: https://www.linkedin.com/pulse/y%C3%B6netim-kurullar%C4%B1n%C4%B1n-siber-g%C3%BCvenli%C4%9Fe-daha-proaktif-yakla%C5%9F%C4%B1m%C4%B1-%C3%B6zhan-mix2f