Board oversight gains urgency as AI cyber risks grow

Artificial intelligence is transforming cyber risk management from a technical concern into a critical issue for corporate boards. This shift was highlighted by Andrew Bailey, chair of the Financial Stability Board, who warned G20 officials in August that frontier AI could rapidly change the dynamics of cyber threats. Bailey emphasized the urgency of robust response and recovery capabilities within financial institutions, alongside resilience among providers of essential technology.

Recent data from IBM's Cost of a Data Breach Report reveals the growing impact of AI-enabled cyber attacks, with one in four malicious incidents now involving artificial intelligence—up 56% from the prior year. Such breaches cost organizations approximately $6 million on average, a notable increase of about $1 million compared to the $4.99 million average for non-AI breaches.

Despite this, AI has also been leveraged to bolster cybersecurity defenses. Enterprises that extensively use AI and automation in security operations reported saving an average of $1.93 million per breach, a stark contrast to those relying on no AI tools at all.

The World Economic Forum's Global Cybersecurity Outlook 2026 underscores the centrality of AI in the cybersecurity landscape for 2026, with 94% of respondents anticipating AI to be the most significant driver of change in this field. Similarly, 87% of organizations have already integrated AI into their cybersecurity strategies. For corporate boards, the rise of AI-related vulnerabilities represents a multifaceted challenge, extending beyond mere budget approvals.

Boards now grapple with decisions concerning business continuity, data governance, third-party risks, identity controls, and authority during cyber incidents—all of which have profound implications for revenue, regulatory compliance, customer trust, and the restoration of critical services.

The distinction between traditional cybersecurity and cyber resilience is becoming increasingly crucial as cyber attacks escalate in speed and sophistication. While conventional programs primarily focused on preventing intrusions, resilience strategies assume that certain security measures may fail and evaluate whether an organization can maintain operational functionality, contain damage, and facilitate recovery without losing control over vital functions.

AI introduces complexities to this process by potentially accelerating the attack cycle. Advanced models can aid threat actors in identifying vulnerabilities, automating exploitations, and generating convincing impersonations at an unprecedented scale. Conversely, AI-driven defensive tools can expedite threat detection, triage, and response, underscoring the importance of robust governance and human oversight in managing these sophisticated AI security solutions.

The National Institute of Standards and Technology (NIST) is addressing these challenges by developing a Cybersecurity Framework Profile tailored for Artificial Intelligence. This effort aims to guide organizations in navigating the risks associated with AI systems while simultaneously enhancing their cyber defense capabilities. Recent workshop findings have spotlighted several key concerns, including governance structures, AI attack surfaces, taxonomy, risk-based guidance, and usability.

Given the interconnected nature of modern supply chains, where companies often rely on a limited number of cloud platforms and software suppliers, a failure at a major vendor can cascade into widespread operational disruptions. As such, boards are being urged to rigorously test their recovery plans under realistic scenarios rather than relying solely on compliance checklists.

This includes determining which systems need to be restored first, establishing clear authority during crises, defining communication protocols, and ensuring that backup systems, alternative suppliers, and manual workarounds remain functional even under extreme pressure.

One significant governance shortfall identified in recent studies is the prevalence of inadequate AI access controls. Over 20% of surveyed organizations have experienced breaches targeting AI models or applications, while 92% of those affected lacked proper access controls for AI systems. Notable attack types, such as model inversion and prompt injection, have resulted in significant financial losses.

Furthermore, the rise of AI agents and automated applications has introduced new complexities in managing non-human identities, which can wield extensive privileges and operate at machine speeds. This necessitates enhanced inventory management, access boundaries, secrets management, and auditability to mitigate associated risks.