← All insights ←

Cybersecurity in the boardroom: we know the risk, yet we wait for the breach.

By · Published: 12 October 2026

Cyber ResilienceBoard of DirectorsDecision-MakingRisk Management
Cybersecurity in the boardroom: we know the risk, yet we wait for the breach.

In the conversations I have with executive teams and boards, nobody considers cyber risks overstated. Even so, implementation is surprisingly often left undone. The board lacks the expertise, there is no time, there is no budget. This applies to data protection as much as to cybersecurity. That usually changes on a single day: the day the first attack succeeds and the company ends up in the headlines.

The new swissVR Monitor II/2026 provides the figures behind this pattern. What concerns me is the question behind it. Why do boards that know the risk act only once the damage has occurred?

More victims, fewer questions

For the Monitor, 281 board members were surveyed between the end of May and the beginning of July 2026. Of these, 41 per cent say their company has already been the victim of a cyber attack. Three years ago the figure was 28 per cent. The study attributes the increase to small and medium-sized companies. Among them, the share has almost doubled, from 20 to 37 per cent, while among large companies it remained largely stable, rising from 45 to 48 per cent. The argument that a company is too small to interest attackers is now contradicted by the figures.

Preparation looks no better. In 55 per cent of companies, plans to restore IT after a serious attack are missing or have never been tested. Three quarters have no written strategy that takes AI-assisted attacks into account. The share of boards that rehearse crisis management for a cyber attack has risen from 34 to 51 per cent. That is progress. The other half still does not rehearse.

The figure that concerns me most appears later in the study. Although considerably more companies are being hit, fewer boards receive reports on the need for action and investment: 35 per cent compared with 53 per cent three years ago. A quarter of boards receive no regular cyber reporting at all. Exposure is rising, while questions in the boardroom are becoming rarer. The authors cautiously interpret this as a sign that cyber resilience is seen as a one-off task. I read it more bluntly: after an initial wave of investment, many boards have ticked the topic off like a completed project.

A smoker knows the statistics

This reminds me of the smoker who quits only when diagnosed with lung cancer. Or of the patient with high cholesterol who does not change their diet even with the test result in hand. Both know their risk better than any outsider. But change is tedious and demands discipline. I know this from my own daily training. It demands enormous discipline and often an effort of will. The effect shows only after months, and no single day proves that the training was worth it.

It is no different in companies. Among respondents, 39 per cent report that plans to restore IT exist but have never been tested. That is the diet plan on the fridge door. It reassures because it exists, and it has no effect because nobody follows it. The same gap appears within the board itself. Of the boards surveyed, 84 per cent have adopted a risk policy that addresses cyber risks. About half of them rehearse the emergency.

So it is not knowledge that is missing. Decision psychology explains quite precisely what is.

The psychology of doing nothing

Doing nothing feels safer than acting: the psychologist Christopher Anderson has summarised the research on decision avoidance and describes four effects:

  • we postpone decisions,
  • we stay with the status quo,
  • we prefer omission to action,
  • and once we have missed an opportunity, we are even less likely to act afterwards.

Anderson attributes this behaviour to both reason and emotion. One important driver is anticipated regret. Those who stick with the status quo have a ready justification and feel less regret, even when the outcome is poor. I call this a psychological form of complacency. A board that postpones the security budget by a year formally takes no decision. It simply leaves everything as it is.

Hope replaces strategy: a security budget is a certain cost in this year’s income statement, comparable to an insurance premium. The damage it is meant to prevent remains a probability. Daniel Kahneman and Amos Tversky showed that people weigh rare events very differently in their decisions. If a risk is described concretely and is present in our minds, we tend to give it too much weight; this is why we buy insurance. Kahneman also notes that a rare event carries particular weight when it comes explicitly to mind. A board that has never been attacked lacks that image. A budget is tangible and visible; a cyber attack remains abstract. Kahneman and Dan Lovallo also describe optimism as a major source of risk taking. Postponing the investment buys the hope that nothing will happen. Hope, however, is not a strategy. Moreover, prevention has no visible return. If it works, nothing happens, and in hindsight the budget looks unnecessary.

We protect ourselves against the damage we know: Kahneman cites Howard Kunreuther’s observation that protective measures are usually designed for the worst disaster actually experienced. This explains why so much happens after an attack. Only then does the board have its own image of the damage, such as an operational standstill, which according to the Monitor is by far the most frequent consequence of an attack, at 42 per cent. Until then, an attack remains something in the newspaper that happens to others.

Omissions remain invisible: Anderson also describes how people assign less responsibility and less blame to an omission than to an action. Public perception reflects this. Attention usually goes to the perpetrators, hardly ever to the decisions that made the attack easier. That was also the case with the attack on PK Softech AG, the developer of the pension software used by Publica, the pension fund of the Swiss Confederation. Those who point to the perpetrators need not explain their own gaps. As long as this remains the case, doing nothing is socially cheaper for a board than an uncomfortable investment decision.

We want to complete a project: a project has a budget and an end date. Cyber resilience does not follow this logic. In the world of artificial intelligence and cybersecurity, both the attacks and a company’s own attack surface change constantly. There is no end point any more, only stages of development. The decline in reporting on the need for action fits this picture. The topic is considered settled, so nobody asks about it any more.

Two amplifiers in the boardroom

The first amplifier is the information base: 62 per cent of boards draw their knowledge of cyber resilience from the executive team, that is, from the people they are meant to supervise. A CEO who asks for a larger security budget is at the same time telling the board that the current state is not good enough. Anyone who has led an executive team knows this dilemma. A third of boards have a member with cyber or IT expertise; a quarter bring in an external specialist. The study combines cyber and IT expertise in one category and relies on self-assessment. A member with an IT background, however, is not automatically a member who can assess a company’s cyber resilience. In July, in the article ‘Cyber Reporting to the Board on Its Own Is Not Yet Governance’, I explained why reporting alone does not amount to oversight.

The second amplifier is the board agenda: for the next twelve months, improving efficiency ranks first at 33 per cent. Security management, including cyber resilience, comes eighth at 18 per cent. Efficiency projects deliver figures that become visible in the next set of accounts. Every automation and every AI agent, however, creates new access rights and interfaces that attackers can exploit. In the Monitor’s interview, Frank Desiere calls this the flip side of every AI efficiency initiative the board approves.

Discipline instead of hope

These mechanisms cannot be wished away. A board can, however, counter them with structures that work without relying on willpower in each individual case. That is discipline at board level.

Against hope, a figure serves the board best. It asks the executive team: what would a three-week business interruption cost us, and how much of it are we prepared to bear? In the Monitor’s interview, Sandra Emme recommends putting a concrete figure on cyber risks. Once the damage and the security budget are quantified, the board compares two amounts, and the diffuse danger loses its psychological advantage.

An omission becomes visible once it requires a decision. If the board decides against a measure, it accepts the residual risk and records the reasons in the minutes. Convenient inaction thus becomes a decision the board stands behind. This also affects the executive team. If it requests an investment in cybersecurity and the board actively rejects it, the board bears the responsibility for that decision. The executive team is not released from its duty, but its request is documented. An informed, reasoned and minuted decision can be defended if the worst happens. After a silent postponement this is hardly possible. Such a decision also needs an expiry date; otherwise the minutes become the next diet plan on the fridge door.

A crisis exercise supplies the missing image of the damage without the damage having to occur. Who decides on a ransom demand, and at what point does a reporting obligation apply? How do we model our liquidity if operations are at a standstill for weeks? How does our financial situation develop if production is down for an extended period? Such questions are better settled at the table beforehand than on the night of the attack. This includes tested recovery plans whose results are reported to the board. Today, according to the Monitor, only about one board in seven is regularly informed about such tests.

A board counters project thinking with a fixed rhythm. Cyber resilience belongs on the agenda as a recurring item, with an annual reassessment of the threat landscape and of the maturity level achieved for each measure. Every proposal for an efficiency or AI project also states which attack surface it creates and what it costs to secure.

The board’s dependence on the executive team decreases as its own competence grows. That can be a member with experience in cybersecurity or an independent specialist who challenges the reporting.

Where the comparison with the smoker ends

The comparison with the smoker has a limit, and that limit is the decisive point. The smoker risks their own health. The board makes decisions about a company that, as a rule, does not belong to it alone, and therefore also about jobs and client data. Ultimate oversight is a non-transferable duty under Art. 716a OR. If board members breach their duty of care and damage results, they can be held personally liable under Art. 754 OR.

According to the Monitor, 84 per cent of respondents hold D&O insurance. That changes little. Emme notes that the board is not liable for the attack itself, but it is liable for poor preparation and for strategic mistakes during the crisis. Whether an insurer pays out in the event of a claim depends on the policy wording and the general terms and conditions. Anyone who declares tested recovery plans in the insurer’s questionnaire when they have never been tested puts the cover at risk. In the Monitor, Frank Desiere sums it up as follows: ‘D&O cover does not replace this care; it presupposes it.’

Technology can be delegated. Responsibility cannot. A board that acts only after the first attack knew enough beforehand. It decided too late. The diagnosis has been on the table for years. The treatment begins in the boardroom, and it demands discipline.

Transparency note

Generative AI was used in a supporting role for the research and editorial preparation of this article. The conceptual design, the selection and weighting of the content, the expert assessment, the final wording of the text and the responsibility for all statements and conclusions rest with me.

Sources