When a cyber-attack strikes an organisation, the damage rarely stays in the IT server room. In September 2025, an attack on Jaguar Land Rover halted production for around five weeks. The independent Cyber Monitoring Centre later estimated it cost the UK economy about £1.9 billion and disrupted more than 5,000 organisations across the supply chain. It is the most economically damaging cyber event in the country’s history. For years, cyber security was treated as a specialist concern. It was delegated to a Chief Information Security Officer, budgeted as a cost and reviewed by the board perhaps once a year. That model is breaking down. Digital technology is no longer one part of the organisation; increasingly, it is the organisation. Supply chains, customer relationships, financial systems and critical national infrastructure all depend on interconnected technologies, and artificial intelligence is accelerating that dependence. Even the supermarket freezer is now a networked device. In October 2026, attackers remotely switched refrigeration units in more than 500 French shops to temperatures as high as 50°C overnight, spoiling tonnes of food and causing fires in some stores. Weeks later, a further wave hit supermarkets in Belgium, Sweden, Luxembourg, the Netherlands, Estonia and Ireland. These are not really stories about firewalls. They are stories about leadership: about decisions made – or not made – in boardrooms long before any attacker arrived. A LEADERSHIP CHALLENGE Regulators and governments have noticed. Expectations that boards and directors own digital risk, rather than simply receive reports about it, are rising across sectors. The question leaders face has shifted from “Are we secure?” to something harder: “How do we lead responsibly when we can never be completely secure?” That question sits at the heart of the new Cyber Leadership Forum (CLF) at Lancaster University Management School. Bringing together experts from academia and from practice, the CLF organises its work around three interconnected pillars. TRUST, GOVERNANCE AND STRATEGIC RESPONSIBILITY The first pillar asks: how can organisations govern digital risk responsibly while building trust, resilience and sustainable strategic capacity? Governance and accountability come first. When an incident occurs, who owns the decision to shut down systems, notify customers or engage with attackers? Boards do not need to become technical experts, but they do need enough digital fluency to ask the right questions and challenge the answers they receive. 24 |
RkJQdWJsaXNoZXIy NTI5NzM=