What should a board ask about AI and cyber risk?

AI changes a company's cyber risk in four ways at once. Attackers use it to move faster and at greater scale. Deepfakes attack the oldest security control there is, recognising the person you are dealing with. The company's own AI tools and agents open a new route in. And staff using unapproved AI tools leak data out. Directors know this: in PwC's 2026 survey of US directors, 69 per cent named cyber security, data privacy or intellectual property as their top AI concern. What most boards lack is a short set of questions that test whether management has changed anything as a result. This page sets them out, with the UK framework a board is now expected to follow.

Why it is at the top of the board agenda#

The UK's National Cyber Security Centre judged in January 2024 that AI "will almost certainly increase the volume and heighten the impact of cyber attacks over the next two years" (NCSC), and in May 2025 that it will "almost certainly continue to make elements of cyber intrusion operations more effective" through 2027, with a growing divide between organisations that keep pace and those that do not (NCSC). Its Annual Review 2025 recorded 204 nationally significant incidents in the year to August 2025, up from 89. In June 2026 the heads of the Five Eyes cyber agencies, including the NCSC, issued a joint statement addressed to leaders: "Cyber risk can no longer be treated as a purely technical issue," and "The timeline is not years, it is months."

The government's Cyber Security Breaches Survey 2025/26 found 43 per cent of UK businesses, and 69 per cent of large ones, reporting a breach or attack in the previous year. Only 31 per cent of businesses had a board member with explicit responsibility for cyber security, 68 per cent among large businesses. Of the businesses using or considering AI, only 24 per cent had cyber security practices to manage its risks. In WTW's 2026 directors' and officers' survey, 40 per cent of those who rated AI risk highly named AI-enabled fraud and social engineering among their concerns.

1. Attackers move faster#

The clearest documented case is Anthropic's. Its November 2025 report described a group it assessed as Chinese state-sponsored that used its model to carry out "80-90% of tactical operations independently" against about thirty targets, with a handful of successful intrusions. People approved the key steps. The model also "frequently overstated findings and occasionally fabricated data", which is a reminder that attackers face AI's reliability problems too. Google's threat intelligence group reported the same month that it had for the first time found malware families that call language models while they run. The NCSC expects the most significant near-term effect to be AI-assisted discovery and exploitation of vulnerabilities, which shortens the time between a flaw being found and being used against you. Patching that took a month is now too slow.

2. Deepfakes attack recognition#

For most of business history, seeing and hearing the chief financial officer on a call was good evidence that it was the chief financial officer. That control has gone. In early 2024 a finance worker at the engineering firm Arup in Hong Kong made fifteen transfers totalling about US$25 million after a video call with deepfaked versions of the CFO and colleagues; Arup told CNN that none of its internal systems were compromised. The attack needed no hacking at all, only a convincing performance and a process that trusted it. Criminals tried the same with WPP's chief executive, Mark Read, in May 2024 using a voice clone in a Teams meeting, as Marketing Beat and others reported, and with Ferrari's chief executive in July 2024. The Ferrari attempt failed because the executive on the call asked the caller the title of a book the real chief executive had recently recommended. The US Treasury's financial crimes unit, FinCEN, warned banks in November 2024 of rising reports of deepfake media in fraud.

The lesson for a board is that verification has to move from recognition to process. A payment or an instruction is genuine because it came through a channel that cannot be faked, a call back to a known number or a second approver, regardless of who seemed to ask for it.

3. Your own AI is a way in#

Every AI tool that reads outside content and can take actions is a new attack surface. The core weakness is prompt injection: instructions hidden in a document, email or web page that the AI follows as if they came from its user. The NCSC's blog of December 2025 was unusually blunt: "prompt injection attacks may never be totally mitigated", because language models "do not enforce a security boundary between instructions and data". Its advice is design, not detection, for example: "don't let an LLM processing emails from random external people have access to privileged tools". Researchers showed in 2025 that an assistant inside a widely used office suite could be made to leak data by an email the user never opened, a flaw the vendor fixed. The more AI agents a company runs, the more this matters; see how a board should govern AI agents and what your agents can reach.

4. Data leaves through shadow AI#

IBM's Cost of a Data Breach report for 2025 found that 20 per cent of organisations had suffered a breach involving shadow AI, staff using AI tools the company had not approved, and that heavy shadow AI use added about US$670,000 to the cost of a breach. 13 per cent reported breaches of their own AI models or applications, and 97 per cent of those lacked proper access controls for AI. 63 per cent had no AI governance policy or were still writing one. Banning AI tends to push use out of sight; see my company banned AI and what should I never put into AI.

What the UK now expects of boards#

The government and NCSC's Cyber Governance Code of Practice, published in April 2025 for medium and large organisations, sets out what directors should do: name a senior owner for cyber risk, set the risk appetite, "undertake training to improve your own cyber literacy", exercise the incident plan at least annually, "require formal reporting on at least a quarterly basis", and keep a two-way dialogue with the chief information security officer. In October 2025 ministers and the heads of the NCSC and National Crime Agency wrote to the chief executives and chairs of the FTSE 350, as the NCSC described, asking them to adopt the Code, sign up to the NCSC's Early Warning service and require Cyber Essentials in their supply chains.

Law is following. The Cyber Security and Resilience Bill, which begins its Lords report stage on 26 October 2026, would require organisations in its scope, including medium and large managed service providers and data centres, to make an initial incident notification within 24 hours and a fuller report within 72, according to the government's factsheets. It is not yet law. And for companies applying the UK Corporate Governance Code, Provision 29's declaration on the effectiveness of material controls, the first of which arrive in early 2027, covers operational controls; the FRC has published a separate guide on its application to cyber. See Provision 29 and AI.

Questions for the next board meeting#

How has management's assessment of the cyber threat changed because of AI, and what has been done differently as a result? If someone who looks and sounds like our chief executive asks for an urgent payment on a video call, what stops it, and has that been tested? Which of our AI tools read outside content, and what can each of them do or reach if that content contains hidden instructions? How much AI use happens outside approved tools, and how would we know? When did we last rehearse an AI-enabled attack, such as a deepfake instruction or a compromised agent, as part of the annual incident exercise? Does the quarterly cyber report to this board say anything about AI? And are we, as directors, literate enough to judge the answers?

What the board should require#

Verification by process. Payments, changes of bank details and unusual instructions confirmed through a separate, known channel, with no exception for seniority or urgency. Urgency and secrecy are the tell in every deepfake case above.

AI in the inventory and the threat model. Every AI tool and agent listed with what it can read and what it can do, and designed on the NCSC's principle that a system reading untrusted content does not hold privileged access.

A route for staff to use AI safely. Approved tools that are good enough to use, clear rules on data, and monitoring for the rest.

Rehearsal. A deepfake instruction and a compromised AI tool in the annual exercise, with the board taking part.

Reporting. AI-specific lines in the quarterly cyber report: incidents and near misses, attempted impersonations, shadow AI found, and AI tools added.

Where this sits in my own argument#

Deepfakes make a point about judgement more vividly than any study. The control that saved Ferrari was a person asking a question only the real chief executive could answer, and noticing that the request did not fit. The control that failed at Arup was a process that let recognition stand in for verification. As machines get better at producing convincing output, people's ability to notice what does not fit, and their organisation's willingness to let them stop a transaction because of it, becomes the security control. The same question runs through this research, from AI slop to the verification bottleneck: what does the organisation do when it can no longer trust the surface of things? A board that has decided which decisions a machine may make, who can stop each one, what people must remain able to do and how anyone would know if it went wrong has most of its cyber answer already.

What this does not show#

The PwC director figures are from US boards, and I found no UK director survey on AI and cyber for 2026. The UK breaches survey does not measure deepfakes. The WPP and Ferrari accounts rest on press reports, as does the detail of the office-suite flaw. Anthropic's and Google's reports describe what each company saw on its own systems, and both have an interest in showing they detect misuse. IBM's 97 per cent applies only to organisations that had an AI-related breach. The Cyber Security and Resilience Bill may change before it becomes law, and most of its duties will be set by secondary legislation. None of this measures how much AI has added to total cyber losses; the direction is clear and the size is not.