From Cyber Risk to Board Risk: Governing Security in the Age of Frontier AI

Frontier AI Cybersecurity Series — Part 3 of 3

⏱ 20–25 min read

Executive Summary

Frontier AI is reshaping the cybersecurity threat landscape by potentially reducing the time, expertise, and resources needed to discover vulnerabilities, exploit weaknesses, and conduct coordinated cyber operations. Recent incidents across Japan and South Korea, together with the G7’s planned AI-enabled cyberattack exercises, highlight growing concerns about organisational preparedness, operational resilience and the wider consequences of cyber incidents. However, the involvement of AI in individual attacks must be distinguished from broader evidence of accelerating cyber threats.

For senior management and boards, the central challenge is no longer simply whether organisations can defend against increasingly sophisticated threats, but whether existing cyber risk governance remains effective when attacker capabilities, operating speed and risk assumptions change. Recent guidance from the Australian Signals Directorate, the Financial Stability Board and the Bank for International Settlements reinforces the importance of adaptive risk oversight, organisational resilience and clearly defined accountability.

Three strategic implications emerge:

a. Previously accepted cyber risks may require reassessment. Legacy vulnerabilities, architectural exceptions, and deferred remediation decisions may become more significant if AI lowers barriers to exploitation. Therefore, reassess risk acceptance when material threat conditions change, rather than relying solely on established review cycles.

b. Cybersecurity performance must be evaluated through business outcomes. Traditional operational measures, such as alerts investigated or vulnerabilities remediated, remain useful but may not adequately demonstrate whether critical services and business operations are protected. As Microsoft argues in its Agentic SOC whitepaper, security operations should increasingly focus on measurable exposure reduction, disruption of attack paths and improved resilience.

c. Machine-speed defence requires human-defined governance boundaries. AI-assisted detection and response may improve defensive speed, but organisations must establish appropriate decision authority, safeguards, escalation mechanisms and human oversight, particularly where automated actions could affect critical business services.

The leadership priority is not simply to introduce more AI, additional security controls or more governance processes. It is to ensure that cyber risk governance becomes sufficiently adaptive, accountable and risk-informed to respond to changing threats.

Ultimately, Frontier AI raises a fundamental question for senior management and boards:

Are we governing cyber risk based on today’s threat environment, or relying on assumptions that may no longer hold?

Key Takeaways

a. Adaptive governance matters more than additional bureaucracy. Organisations should focus on timely risk reassessment, decision-oriented reporting and meaningful board assurance.

b. Risk acceptance is not permanent. Frontier AI may change the assumptions behind previously accepted vulnerabilities, security exceptions and deferred remediation decisions.

c. Cyber risk must be understood in business terms. Effective oversight requires understanding how technical weaknesses could affect critical services, customers and organisational resilience.

d. Preparedness must be tested, not assumed. Evaluate incident response and crisis management arrangements against credible, rapidly evolving cyber threat scenarios.

e. AI-assisted defence requires clear accountability. Faster detection and automated response must operate within human-defined risk boundaries and appropriate governance oversight.

---

Author View

Frontier AI may not only change how cyberattacks are conducted. It may also change whether the cyber risks organisations have already accepted remain acceptable.

In my view, the most important governance implication is not simply that boards need greater awareness of AI-enabled threats. It is that organisations must be prepared to challenge the assumptions underlying their existing risk decisions.

A vulnerability accepted because exploitation was considered difficult, a legacy system retained because compensating controls were considered sufficient, or a response capability judged adequate under previous threat conditions may warrant reassessment as attacker capabilities evolve.

For me, effective cyber risk governance isn’t about adding more committees, policies, or reporting requirements. It is about ensuring cybersecurity leaders can translate changing threats into business consequences, senior management can make timely, informed risk decisions, and boards can obtain meaningful assurance that critical services remain resilient.

The real test of governance is not whether a risk was formally accepted, but whether the organisation can recognise when that decision needs to change.

To translate these strategic implications into practical oversight, Figure 1 introduces the Adaptive Cyber Risk Governance Cycle, a proposed conceptual framework that connects changes in cyber threats to enterprise risk decisions. It outlines four interrelated responsibilities: reassessing material risks, translating technical exposures into business consequences, strengthening defensive readiness and obtaining governance assurance. Continuous feedback helps ensure that risk decisions remain relevant as threat conditions evolve.

Figure 1. The Adaptive Cyber Risk Governance Cycle. An original conceptual framework illustrating how evolving cyber threats inform risk reassessment, business impact evaluation, management response and board-level assurance.

---

When the Threat Changes, Should Governance Change Too?

Cybersecurity is no longer viewed solely as a technical responsibility. Many organisations incorporate cyber risk into enterprise risk management and support it with established governance frameworks, risk appetite statements, management committees, and board-level oversight. These arrangements provide an essential foundation for accountability, investment decisions and organisational resilience.

However, effective governance depends not only on the controls and processes an organisation has established, but also on whether the assumptions supporting its risk decisions remain valid.

Frontier AI introduces a potential challenge to those assumptions. As discussed in Parts 1 and 2 of this series, AI-assisted capabilities may reduce the time, expertise and resources required to identify vulnerabilities, combine weaknesses and execute cyber operations. The Bank for International Settlements highlights how Frontier AI could accelerate exploitation and compress the time available for defensive action, while the Australian Signals Directorate encourages boards to consider whether emerging AI capabilities could alter existing cyber risk assessments.

This creates a governance challenge that extends beyond the speed of cybersecurity operations.

An organisation may have formally accepted a vulnerability because exploitation was considered difficult, the likelihood of attack was assessed as relatively low, or existing compensating controls were judged sufficient. Such decisions may have been reasonable when originally approved. However, if attacker capabilities change materially, the same risk acceptance may no longer reflect the organisation’s actual exposure.

The vulnerability may not have changed. The assumptions behind the decision to accept it may have.

The issue is therefore not that established governance frameworks have become obsolete. Risk appetite, accountability, independent oversight and resilience planning remain fundamental. Instead, organisations may need to strengthen how they incorporate emerging threat intelligence, changes in attacker capability, and evolving business dependencies into existing governance processes.

For cybersecurity leaders, this means translating technical developments into clear implications for business risk. For senior management, it means reassessing previously accepted exposures when material conditions change. For boards, it means obtaining sufficient assurance that management can recognise, escalate and respond to emerging risks before they create significant organisational consequences.

This leads to the central question explored throughout this article:

If the threat environment is changing faster than traditional risk review cycles, how can organisations keep governance responsive without compromising accountability and informed human judgement?

Recent Events Are Raising the Governance Stakes

Recent cybersecurity developments across Asia show why Frontier AI’s implications extend beyond technical security operations and increasingly warrant senior management and board attention.

In October 2026, reports from Japan highlighted a series of ransomware attacks affecting organisations across different industries. These incidents exposed weaknesses involving legacy infrastructure, operational dependencies and business continuity. Although AI may be reducing the barriers to conducting cyberattacks, its direct involvement in individual incidents has not always been established.

Similarly, South Korea reported significant data exposures and cyber incidents affecting financial institutions and other organisations. Industry commentary on several financial-sector incidents reported using an AI-assisted penetration testing tool alongside a large language model, showing how established attack techniques can be executed more quickly. However, these accounts should not be interpreted as evidence that all reported incidents involved AI, or that the attacks were fully autonomous.

The significance of these incidents lies not only in how the attacks were conducted, but also in how their consequences extended into business operations, customer information, service availability and organisational trust.

A compromised application, vulnerable identity or affected technology provider can create consequences well beyond the initial technical weakness. When critical services depend on interconnected systems and third parties, a cyber incident’s effects may extend across multiple organisations.

These developments are consistent with concerns raised by the Bank of England and the European Systemic Risk Board, which highlight how increasingly capable cyber threats, combined with technology concentration and operational dependencies, could contribute to wider financial and operational disruption.

A key development occurred on 16 October 2026, when Reuters reported that G7 finance leaders agreed to conduct tabletop exercises involving AI-enabled cyberattack scenarios. The planned exercises aim to test existing response arrangements and identify opportunities to strengthen preparedness across financial authorities and potentially participating institutions.

This represents an important shift in emphasis: from recognising emerging AI-related cyber threats towards examining whether existing crisis management and resilience arrangements can respond effectively.

For organisations, the lesson is not that every cyber incident now involves Frontier AI, or that existing security controls have suddenly become ineffective. Instead, the changing threat environment makes a stronger case for examining whether established assumptions about exposure, response timelines, and recovery capabilities remain realistic.

For senior management and boards, the central question is therefore not simply whether the organisation has experienced an AI-enabled cyberattack.

It is whether the organisation understands how changing attacker capabilities could affect its critical services, operational dependencies and ability to respond under pressure.

The governance challenge begins before an incident occurs — when emerging threats alter the likelihood, speed or consequences of risks that an organisation already carries.

Accepted Cyber Risk Is Not Necessarily Permanent Risk

Cybersecurity risk management has always involved making decisions under constraints. Organisations cannot eliminate every vulnerability, replace every legacy system, or immediately remediate every security weakness. Business continuity requirements, technology dependencies, operational complexity and limited resources often require management to prioritise remediation and formally accept certain residual risks.

Risk acceptance is not necessarily a failure of cybersecurity governance. It can be a legitimate, risk-informed decision when supported by appropriate assessment, accountability and oversight.

However, the validity of that decision depends on the assumptions under which it was made.

Traditionally, organisations have assessed cyber risk by considering factors such as vulnerability severity, exposure, exploitability, attacker capability, existing controls and potential business impact. An organisation may have accepted a weakness because exploitation required specialised expertise, substantial preparation, or access that was considered difficult to obtain.

Frontier AI may change some of these conditions.

The Bank for International Settlements observes that Frontier AI could reduce the expertise, time and resources required to conduct cyber operations, including vulnerability discovery and multi-stage exploitation. Similarly, guidance from the Australian Signals Directorate encourages boards to consider whether AI-enabled capabilities could invalidate previous cyber risk assessments or make combinations of existing weaknesses more exploitable.

Consider an organisation running a legacy application that cannot be upgraded immediately because it supports a critical business process. Management may have accepted the associated vulnerability because of its limited exposure, the complexity of exploitation, and the effectiveness of compensating controls.

If AI-assisted capabilities subsequently make it easier to discover an exploitation pathway or combine that vulnerability with weaknesses in identity and access controls, the organisation’s risk exposure may increase even though the application itself has not changed.

Figure 2. How Frontier AI May Change the Economics of Existing Cyber Risk. An illustrative comparison of how changes in attacker capabilities may affect previously accepted cyber risks.

This creates an important distinction between the original risk-acceptance decision and that decision’s continued validity.

A previously approved risk should not automatically remain acceptable simply because it has been documented, assigned an owner or scheduled for a future review.

At the same time, emerging AI capabilities should not automatically reclassify every accepted vulnerability as critical. A credible reassessment must still consider actual exposure, exploitability, threat intelligence, compensating controls, business criticality and potential consequences.

The governance priority is therefore to set appropriate reassessment triggers when material changes occur. These may include new exploitation techniques, credible threat intelligence, changes in system exposure, deterioration of compensating controls or increasing dependencies on critical services.

For cybersecurity leaders, this requires translating technical changes into updated risk assessments and clear remediation recommendations. For senior management, it requires reviewing whether the resulting exposure remains within approved risk appetite and determining whether additional treatment or investment is necessary.

Boards should not be responsible for approving individual vulnerability exceptions or directing technical remediation. Instead, they should obtain appropriate assurance that management has effective processes for identifying, escalating, and reassessing material cyber risks.

A risk decision that was reasonable when originally approved may no longer remain reasonable when the assumptions supporting it have materially changed.

Ultimately, effective cyber risk governance should distinguish between accepting a risk and allowing that acceptance to continue without sufficient reassessment. As attacker capabilities evolve, organisations need risk management processes that respond to meaningful changes in exposure rather than relying exclusively on fixed review cycles.

From Technical Incidents to Enterprise Consequences

Cybersecurity performance is often communicated through technical indicators such as vulnerability severity, patching progress, security incidents, detection capabilities and remediation status. These measures provide essential visibility into how effective security operations are. However, they do not always explain a cyber incident’s potential consequences for the wider organisation.

The severity of a technical weakness does not necessarily reflect its potential business impact.

A critical vulnerability affecting an isolated, non-essential system may present limited operational consequences when effective controls are in place. Conversely, a vulnerability assessed as moderate could create substantial business exposure if it affects a privileged identity, a critical application or a technology provider supporting multiple essential services.

Frontier AI may make understanding these relationships even more important. As discussed in Part 2, AI-assisted capabilities could enable attackers to identify and combine weaknesses across interconnected systems more efficiently. Consequently, vulnerabilities that appear manageable when assessed individually may contribute to more significant attack paths when considered collectively.

The implications become more complex when organisations depend on shared technology infrastructure, cloud services and third-party providers.

The Bank of England and the European Systemic Risk Board have highlighted concerns that increasingly capable cyber threats, combined with technology concentration and operational interdependencies, could drive broader disruption. A compromise affecting a common service provider may affect multiple organisations, even when those organisations maintain their own cybersecurity controls.

Recent incidents reported across Japan and South Korea further illustrate the importance of considering operational dependencies, customer information and service availability alongside the immediate technical cause of a cyber incident. These incidents should not all be attributed to Frontier AI, but their business consequences remain relevant to understanding organisational cyber exposure.

This creates an important challenge for enterprise risk governance.

An organisation may demonstrate progress through improved vulnerability remediation rates, reduced alert volumes or faster incident investigation. Yet these improvements do not necessarily establish whether its most critical business services are adequately protected against plausible attack scenarios.

Microsoft’s Agentic SOC whitepaper similarly argues for moving beyond activity-based security measures towards outcomes such as reducing exposure, disrupting attack paths and strengthening resilience. Although presented as a proposed security operating model, this perspective reinforces the need to connect operational performance with meaningful risk reduction.

For cybersecurity leaders, the challenge is therefore to translate technical indicators into information that supports enterprise-level decision-making. This requires understanding which assets and services are most critical, how they depend on one another, where material attack paths exist, and what consequences a compromise could trigger.

For senior management, these insights support decisions about investment priorities, risk treatment, business continuity and recovery capabilities.

For boards, the objective is not to review every vulnerability or operational security metric. The objective is to obtain sufficient assurance that management understands the organisation’s material cyber exposures and their potential implications for critical services, customers, financial performance, regulatory obligations, and organisational resilience.

Boards do not need to understand every technical detail of an attack path. They need to understand how that attack path could become a material business consequence.

Ultimately, effective cyber risk governance requires organisations to move beyond viewing vulnerabilities and incidents as isolated technical events. The more important consideration is how those exposures interact with business dependencies, operational resilience and the organisation’s capacity to withstand and recover from disruption.

From Threat Awareness to Tested Preparedness

Organisations have long invested in cybersecurity incident response plans, crisis management frameworks, business continuity arrangements and disaster recovery capabilities. These measures set out key responsibilities and procedures for managing cyber incidents. However, their effectiveness depends not only on how comprehensively they are documented, but also on whether they can operate under realistic threat conditions.

Having an established cyber incident response plan is not the same as demonstrating that an organisation can execute it effectively under pressure.

Frontier AI introduces additional considerations for organisational preparedness. As discussed earlier, AI-assisted capabilities may accelerate vulnerability discovery, exploitation, and multi-stage cyber operations, potentially reducing the time available for detection, containment, and management decisions.

This creates a potential mismatch between how quickly an incident develops and how long organisations need to investigate, escalate, and coordinate their responses.

A particularly relevant development emerged in October 2026, when G7 finance leaders agreed to conduct tabletop exercises involving AI-enabled cyberattack scenarios. According to Reuters, the initiative aims to review existing response protocols and identify opportunities to strengthen preparedness, with private financial institutions participating depending on the scenarios.

Although these exercises had not yet been completed at the time of reporting, the initiative reflects growing recognition that emerging cyber threats require more than awareness and documented response procedures. They also require practical examination of how institutions and authorities would coordinate their decisions and actions during a significant incident.

This emphasis aligns with the UK Financial Conduct Authority’s observations on Frontier AI and cyber resilience, which highlight the importance of organisational readiness, governance, and the ability to translate emerging capabilities into effective defensive outcomes.

For organisations, the implication is not necessarily to replace existing incident response or resilience frameworks. Instead, organisations should examine whether current testing scenarios adequately reflect changing attacker capabilities and increasingly interconnected business operations.

Traditional exercises may focus on a ransomware incident, data breach or prolonged system outage. These remain relevant scenarios. However, organisations may also need to consider how their response arrangements would perform when an attacker can adapt rapidly, exploit multiple weaknesses, or create simultaneous disruptions across interconnected systems and third-party services.

Such exercises should examine more than technical containment.

They should also test whether management can make timely decisions with incomplete information, whether escalation authorities are clearly understood, whether critical business services can continue operating, and whether recovery priorities remain appropriate when several systems are affected concurrently.

For cybersecurity leaders, this means testing incident response capabilities against credible, evolving threat scenarios. For senior management, it requires validating decision-making arrangements, cross-functional coordination and recovery priorities.

Boards should obtain assurance that management has meaningfully tested resilience arrangements, identified material weaknesses, and is addressing corrective actions.

Importantly, a successful tabletop exercise does not guarantee that an organisation will withstand a real cyberattack. Exercises provide structured opportunities to identify weaknesses, challenge assumptions and improve preparedness before an actual incident occurs.

The value of cyber resilience testing lies not simply in demonstrating that a plan exists, but in identifying whether the organisation can make effective decisions and sustain critical services when its assumptions are challenged.

Ultimately, Frontier AI reinforces the need for organisations to move beyond recognising emerging threats towards continuously validating their ability to respond. As the threat environment evolves, organisations should assess preparedness through realistic exercises, demonstrated response capabilities, and the timely resolution of material weaknesses.

Machine-Speed Defence Still Requires Human Accountability

As cyber threats become faster and more adaptive, organisations face increasing pressure to strengthen their detection, investigation and response capabilities. Traditional security operations, which often rely on sequential analysis, manual investigation, and human intervention, may struggle to respond consistently as attacks outpace established operational processes.

AI-assisted security operations offer a potential response to this challenge.

Microsoft’s Agentic SOC: The New Operating Model for Continuous Defense proposes a shift from task-driven security operations towards continuous, outcome-focused protection. Under this model, AI agents can support activities such as investigation, correlation, validation and coordinated response, allowing security professionals to focus more attention on complex decisions, risk priorities and oversight.

The proposed operating model reflects a broader evolution in cybersecurity: moving beyond the volume of security activities performed towards whether those activities meaningfully reduce exposure and strengthen organisational resilience.

However, greater automation in cybersecurity operations should not be confused with greater autonomy in organisational risk decision-making.

An automated security system may isolate a compromised endpoint, disable a suspicious account, or block potentially malicious activity within seconds. These actions may be appropriate when the organisation understands the potential consequences and has established suitable safeguards.

Governance considerations become more significant when automated actions could interrupt critical business services, affect legitimate customer transactions, disable shared infrastructure, or create unintended operational consequences.

In such circumstances, the question is not simply whether AI can execute a defensive action faster than a human analyst. It is whether that action falls within the organisation’s approved risk appetite, operational tolerances and decision-making authority.

The Financial Stability Board’s sound practices for responsible AI adoption emphasise governance, accountability, risk management and human oversight. Although this guidance primarily addresses risks associated with organisations’ own adoption of AI, its principles are relevant when considering the governance of AI-enabled defensive capabilities.

This creates an important distinction between automating operational actions and delegating accountability for their consequences.

Organisations may appropriately authorise certain low-impact, reversible defensive actions to operate automatically within predefined conditions. More consequential actions may require additional validation, escalation or human approval, depending on their potential effects on business operations.

The appropriate level of oversight should therefore reflect the action’s risk and impact, rather than assuming every automated decision requires manual approval or that all defensive actions should operate without intervention.

For cybersecurity leaders, this requires clearly defined automation boundaries, appropriate testing, monitoring, auditability, and mechanisms to override or reverse actions when necessary.

For senior management, this requires ensuring that AI-enabled security capabilities remain consistent with enterprise risk appetite, operational resilience requirements, and established accountability arrangements.

Boards are not responsible for supervising individual automated security decisions. Instead, boards should obtain assurance that management has established appropriate governance over consequential uses of AI, including clear ownership, effective controls, and escalation arrangements.

The organisation must also consider the wider implications. As AI agents take on more investigative and operational responsibilities, cybersecurity professionals may increasingly shift toward validating findings, assessing business consequences, managing exceptions, and exercising judgement.

This does not eliminate the need for human expertise. Instead, it may increase the importance of professionals who can understand both technical risks and their implications for organisational decision-making.

Machine-speed defence should operate within human-defined risk boundaries — not outside human accountability.

Ultimately, the objective is not to choose between automation and human oversight. It is to establish an operating model in which AI can improve defensive speed and consistency while management retains responsibility for risk decisions, operational consequences and organisational resilience.

What Should Boards Be Asking Differently?

Boards are increasingly expected to oversee cybersecurity and digital risk effectively. However, meaningful oversight does not require directors to become technical specialists or participate in day-to-day security decisions.

Instead, boards need sufficient information to understand material exposures, challenge management’s assumptions and assess whether the organisation’s cybersecurity strategy remains aligned with its risk appetite and business priorities.

The Australian Signals Directorate’s guidance on Frontier AI cyber threats encourages boards to consider how emerging attacker capabilities may affect existing risk assessments and organisational preparedness. Similarly, the Financial Stability Board emphasises governance, accountability and effective oversight in the responsible adoption of AI.

The challenge is not simply to ask more cybersecurity questions, but to ask questions that reveal whether the organisation’s existing risk assumptions and response capabilities remain valid.

Five questions deserve particular attention.

Figure 3. Five Questions for Effective Board Oversight of Cyber Risk. An executive-level summary of the key questions boards should ask to assess risk acceptance, critical service resilience, operational dependencies, AI-enabled defensive accountability and tested preparedness.

1. Are previously accepted cyber risks still acceptable under the changing threat environment?

Boards should seek assurance that management has established effective mechanisms to reassess material cyber risks when attacker capabilities, exploitation techniques, or organisational exposures change.

This includes understanding whether legacy vulnerabilities, deferred remediation decisions and security exceptions remain within approved risk appetite.

The key consideration is not how many risks have been accepted, but whether current, credible assessments support their continued acceptance.

2. Can the organisation detect, contain and recover from cyber incidents quickly enough to protect critical business services?

Traditional cybersecurity reporting often focuses on detection and response metrics. While these remain important, boards should also understand how operational performance relates to the organisation’s ability to sustain critical services.

Management should be able to explain whether existing response and recovery capabilities remain realistic under scenarios involving faster exploitation, multiple affected systems or significant operational disruption.

The objective is to assess resilience in business terms rather than relying exclusively on technical performance indicators.

3. Do we understand how interconnected weaknesses and third-party dependencies could amplify cyber risk?

Cyber incidents do not always remain confined to a single application, infrastructure component or service provider.

As organisations become increasingly dependent on interconnected systems, shared infrastructure, and external technology providers, relatively isolated weaknesses may have wider operational consequences.

Boards should therefore seek assurance that management understands material dependencies, plausible attack paths and potential concentration risks affecting critical services.

This is particularly relevant where a single technology provider or shared platform supports multiple business functions.

4. Where are the boundaries between automated cyber defence and human decision-making?

AI-enabled security operations may let organisations investigate threats and execute defensive actions faster. However, increased automation introduces important questions about decision authority, accountability and operational consequences.

Boards should seek assurance that management has established appropriate governance over consequential automated actions, including defined authority, safeguards, monitoring and escalation arrangements.

The objective is not to require human approval for every security action, but to ensure that the level of oversight reflects the potential business impact of automated decisions.

5. Have our crisis management and resilience arrangements been tested against credible AI-enabled cyber threat scenarios?

An established incident response plan provides an important foundation, but it does not necessarily demonstrate that an organisation can respond effectively to rapidly evolving cyber incidents.

The G7’s October 2026 agreement to conduct AI-enabled cyberattack tabletop exercises reinforces the growing importance of testing preparedness against emerging threat scenarios.

Boards should seek assurance that management’s exercises challenge assumptions, test cross-functional decision-making, and identify improvements to the organisation’s ability to protect and restore critical services.

The quality of oversight depends not only on whether exercises are conducted, but also on whether material findings lead to meaningful corrective action.

Turning Questions into Meaningful Assurance

These five questions should not become an additional checklist that increases reporting without improving decisions.

Their value lies in helping boards distinguish between evidence of cybersecurity activity and evidence that material risks are being managed effectively.

Management should clearly explain significant exposures, the assumptions supporting risk decisions, the effectiveness of critical controls, and the actions required where resilience gaps remain.

Boards should also recognise that cybersecurity assurance cannot eliminate uncertainty. Emerging threats, complex dependencies, and evolving technologies will continue to create risks that cannot be fully predicted or prevented.

Effective board oversight is not about demanding certainty. It is about ensuring that management recognises uncertainty, challenges outdated assumptions and makes informed decisions within the organisation’s risk appetite.

Ultimately, the most valuable board discussions will move beyond asking whether cybersecurity controls are in place towards examining whether those controls, risk decisions and resilience capabilities remain appropriate for the organisation’s changing threat environment.

Governance Must Become More Adaptive, Not Simply More Complex

As Frontier AI challenges existing cyber risk assumptions, organisations may respond by adding committees, reporting requirements, or oversight processes. However, greater governance complexity does not necessarily improve risk management.

Most established organisations already have enterprise risk management frameworks that define risk appetite, accountability and escalation responsibilities. The priority, therefore, is to strengthen how these arrangements identify material changes, support timely decisions, and maintain effective oversight.

Measure the effectiveness of cyber risk governance by the quality and timeliness of decisions, not simply by the number of policies, committees, or reports an organisation maintains.

From Periodic Reviews to Risk-Triggered Reassessment

Organisations should complement scheduled cyber risk reviews with clear triggers to reassess material exposures. These may include credible changes in exploitation capabilities, deterioration of compensating controls or increased exposure of critical systems.

Incorporate such triggers into existing risk management and escalation processes, assigning responsibilities for determining whether previously accepted risks remain within the approved risk appetite.

Reassessments should remain proportionate to the threat’s credibility, the organisation’s exposure, and potential business consequences. Not every emerging AI capability or vulnerability warrants immediate escalation to senior management or the board.

From More Reporting to Better Decision-Making

Effective governance requires reporting that supports decisions rather than simply demonstrating cybersecurity activity.

Management reporting should explain what has materially changed, how those changes affect critical business services and risk appetite, and whether additional risk treatment, investment or escalation is required.

This approach lets senior management and boards focus on significant exposures and decisions that require attention, while retaining enough technical evidence to support credible assurance.

From Defined Accountability to Responsive Accountability

Adaptive governance also depends on clear decision authority across cybersecurity, technology, business operations, risk management and other relevant functions.

When material cyber risks emerge, organisations should be able to identify who is responsible for reassessment, who can approve risk treatment, and when escalation is required.

Organisations should understand and test these responsibilities before a significant incident occurs, particularly when decisions must be made under time pressure or with incomplete information.

Adaptive governance is not about making every decision faster. It is about ensuring that material risks reach the right decision-makers at the right time, with sufficient information and clear accountability.

These improvements do not necessarily require new governance structures. By integrating risk-triggered reassessment, decision-oriented reporting, and clear escalation authority into existing arrangements, organisations can strengthen responsiveness without adding unnecessary complexity.

The next stage of cyber risk governance is not necessarily about building more governance. It is about making governance more relevant, responsive and effective when the assumptions underlying risk decisions change.

From Machine-Speed Threats to Risk-Informed Leadership

Frontier AI represents an important development in the evolving cybersecurity landscape. Its potential to accelerate vulnerability discovery, exploitation and coordinated cyber operations challenges established assumptions about how organisations assess, manage and respond to cyber threats.

However, the implications extend beyond adopting more advanced security technologies.

Throughout this three-part series, one theme has emerged: as cyber threats evolve in speed and capability, organisations must reconsider whether their defensive capabilities, risk decisions, and governance arrangements remain appropriate.

In Part 1, Frontier AI and the New Cyber Threat Model, we examined how AI could change attacker capabilities by reducing the time, expertise, and resources required to conduct cyber operations. The emerging concern was not simply new attack techniques, but the possibility that existing threats could become faster, more scalable, and increasingly accessible.

Part 2, Defending at Machine Speed: How Defence-in-Depth and Zero Trust Must Evolve, explored the defensive implications of this changing threat environment. It argued that established cybersecurity principles remain relevant, but their implementation must become more connected, adaptive, and faster-responding. Defence-in-Depth and Zero Trust should therefore be viewed not merely as collections of individual controls, but as complementary approaches to limiting exposure, disrupting attack paths and strengthening organisational resilience.

Part 3 has extended the discussion from cybersecurity operations to enterprise risk governance.

The central challenge is whether organisations can recognise when changing attacker capabilities invalidate previous risk assumptions, reassess material exposures and make informed decisions before technical weaknesses develop into significant business consequences.

This requires a coordinated leadership response.

Cybersecurity leaders must continue strengthening technical capabilities while translating emerging threats into meaningful business risk information. Senior management must ensure that risk treatment, investment priorities and operational resilience remain aligned with the organisation’s changing exposure. Boards must exercise effective oversight by challenging material assumptions, assessing management’s preparedness and obtaining appropriate assurance over significant cyber risks.

These responsibilities are interconnected but not interchangeable.

Boards should not become operational cybersecurity decision-makers, just as cybersecurity teams should not independently determine the organisation’s tolerance for material business consequences.

Effective cyber resilience depends on clearly defined responsibilities, timely information and informed decisions across all levels of leadership.

Importantly, the objective should not be to pursue automation without limits or to assume that every emerging AI capability represents an immediate critical threat.

Organisations must continue exercising proportionate, evidence-based judgement. Organisations should evaluate the potential benefits of AI-assisted defence alongside the risks of automation, operational disruption, technology dependencies, and unintended consequences.

Similarly, governance should evolve through stronger risk awareness, responsive reassessment, and meaningful assurance, not unnecessary procedural complexity.

The future of cybersecurity will undoubtedly involve increasingly capable technologies on both sides of the threat landscape. Yet technological sophistication alone will not determine whether organisations remain resilient.

What matters is how effectively organisations understand, govern, and translate those capabilities into decisions that protect critical services, customers, and long-term organisational trust.

The next frontier in cybersecurity may not be defined only by how quickly machines can attack or defend, but by how effectively organisations can recognise changing risks and make informed decisions in response.

Ultimately, Frontier AI is not simply a technological challenge for cybersecurity teams. It is an evolving test of enterprise risk governance, organisational resilience and leadership judgement.

Explore the Frontier AI Cybersecurity Series

This article concludes a three-part series examining how Frontier AI may reshape cyber threats, defensive strategies and cybersecurity governance.

Part 1: Frontier AI and the New Cyber Threat Model

Part 2: Defending at Machine Speed: How Defence-in-Depth and Zero Trust Must Evolve

---

References

[1] Australian Signals Directorate. (2026, September). Frontier AI cyber threat considerations for boards of directors. Australian Cyber Security Centre. https://www.cyber.gov.au/publication/frontier-ai-cyber-threat-considerations-for-boards-of-directors

[2] Bank of England. (2026, July). Financial stability report: July 2026. https://www.bankofengland.co.uk/financial-stability-report/2026/july-2026

[3] Crisanto, J. C., Currat, A., & Yong, J. (2026, September). When machines attack: Frontier AI cyber threats and policy responses in the financial sector (FSI Occasional Paper No. 28). Bank for International Settlements.

[4] European Systemic Risk Board. (2026, July 7). Frontier AI models could strain cyber resilience in the financial system, ESRB warns. https://www.esrb.europa.eu/news/pr/date/2026/html/esrb.pr260707~4e1b68241a.en.html

[5] Financial Conduct Authority. (2026, September 2). Frontier AI and cyber resilience. https://www.fca.org.uk/publications/multi-firm-reviews/frontier-ai-cyber-resilience

[6] Financial Stability Board. (2026, October 15). FSB finalises sound practices for the responsible adoption of artificial intelligence (AI). https://www.fsb.org/2026/10/fsb-finalises-sound-practices-for-the-responsible-adoption-of-artificial-intelligence-ai/

[7] Kihara, L. (2026, October 16). G7 to launch exercises to guard against AI cyber attacks. Reuters.

[8] Lee, J. (2026, October 22). Application protection in the AI era: Lessons from AI-powered breaches at South Korean banks. Infosecurity Magazine.

[9] May, T., & Notoya, K. (2026, October 14). Ransomware attacks have swept Japan. AI may be making them easier. The New York Times. Republished by The Star.

[10] Microsoft. (n.d.). Agentic SOC: The new operating model for continuous defense. Microsoft Security.

[11] Sim, W., & Teo, W. (2026, October 16). Millions of personal records in Japan, South Korea exposed amid surge in AI-powered cyberattacks. The Straits Times.

Disclaimer
The views expressed in this article are those of the author and are provided for general informational and educational purposes only. They do not represent the views of the author’s employer or any organisation with which the author is affiliated. Nothing in this article should be construed as legal, regulatory, investment, or professional advice. Readers should assess the relevance and applicability of any observations or recommendations based on their own circumstances and requirements.