Cyber risk starts at the top: The governance challenge behind cyber resilience

Despite record investment in cybersecurity, breach rates remain stubbornly high. In a recent Cyber Uncovered webinar, Mitigo director Kerrie Machin argued that boards need assurance, not just technology.

Ask a room of business leaders to score their organisation's cyber resilience out of ten and the results are often revealing. During a recent Cyber Uncovered webinar hosted by Mitigo, the cyber risk management partner to the professional services sector, most attendees rated their organisations somewhere in the middle. More than half scored themselves a five or six out of ten, while one in eight admitted they were unsure how resilient their organisation was.

That uncertainty points to a wider problem. Many organisations have invested heavily in cybersecurity, but far fewer can confidently demonstrate that their investment is effectively managing risk.

UK businesses spent approximately £6 billion on cybersecurity in 2018. By 2024, that figure had risen to £13.2 billion. Yet the proportion of businesses experiencing cyber breaches has barely moved. The government's latest Cyber Security Breaches Survey found that 43% of UK businesses suffered a breach or attack in the past 12 months, the same proportion reported in 2018. More than doubling investment has not reduced the rate at which firms are being breached.

For Kerrie Machin, that statistic highlights a fundamental misunderstanding about cyber resilience.
"It's not the absence of technology. It's the absence of the assurance that the technology is the right technology, and that it's configured correctly."

The challenge facing organisations today is therefore not simply a technology problem. It is a governance problem.

Cyber risk is a board responsibility

That message has become increasingly clear in recent years.

In April 2026, government ministers wrote to business leaders highlighting growing concerns over the cyber capabilities of artificial intelligence and urging organisations to take greater ownership of cyber risk. The message was straightforward: cyber risk should not be delegated to IT and forgotten about. Boards must take ownership.

"This isn't a job that you should be delegating out to IT and forgetting about. You've got to take ownership of this as a board."

For many organisations, this represents an important shift in thinking. Cybersecurity has traditionally been viewed as a technical issue, owned by IT teams and external service providers.

Increasingly, however, regulators, clients, insurers and stakeholders expect boards to understand cyber risk in the same way they understand financial, operational and regulatory risk.

Yet many boards have not caught up. According to the Cyber Security Breaches Survey 2025, only 27% of businesses have a board member responsible for cybersecurity, down from 38% in 2021. Just as expectations on boards are rising, fewer are taking formal ownership of the risk.

Ultimately, it is the board that is accountable when things go wrong. If a cyber incident disrupts operations, compromises sensitive information or attracts regulatory scrutiny, responsibility rests with the organisation's leadership, not its technology providers.

Cyber resilience is no longer just an operational concern. It is a core governance responsibility.
The missing piece: Assurance

The government's Cyber Governance Code of Practice provides a framework for organisations seeking to improve cyber resilience. It focuses on five key areas: risk management, cyber strategy, people, incident planning and response, and assurance and oversight.

According to Kerrie, organisations most commonly fail at two points: "The first is no risk assessment. The second is no assurance that you're actually managing or controlling your risk effectively."

Too many organisations begin their cybersecurity journey by asking what technology they should buy. They go to their IT provider, implement recommended controls and assume the problem has been solved.

But that approach bypasses an essential step: understanding the risk.

"How do you know that's the right technology? How do you know where your gaps are, where your blind spots are?"

Without a clear understanding of business risk, organisations cannot know whether their controls are appropriate, sufficient or effectively configured.

This is where assurance becomes critical.

Technology plays an important role in cyber defence, but implementing controls is not the same as proving those controls work. Boards need evidence that risks have been identified, controls have been properly implemented, and those controls are delivering the intended outcomes.

That means asking difficult questions:

• Are we actually secure?
• Are the right controls in place?
• Are they configured correctly?
• What are our most significant risks?
• Are we meeting our legal and regulatory obligations?

The answers should come from independent scrutiny rather than assumption.

"If you are relying on the people that set your IT up to come back and say, 'Yes, it's all okay,' they're marking their own homework. From an audit perspective, that just doesn't work."

For boards, this distinction matters. Reassurance provides comfort. Assurance provides evidence.
The board owns the risk. Management implements the controls. IT providers deliver the tools. But somebody independent must be able to assess whether those controls are genuinely effective and whether the organisation's cyber risk is being managed appropriately.

When governance fails

Throughout the webinar, Kerrie shared examples of organisations that had invested heavily in cybersecurity but still suffered significant breaches.

In each case, technology was present. The failure lay elsewhere.

Some organisations had monitoring tools that identified problems but lacked effective response processes. Others had security controls that had never been properly tested or reviewed. In some cases, weaknesses in configuration or oversight meant attackers were able to bypass protections that leaders believed were working effectively.

The lesson was consistent: successful cyber attacks are not always the result of missing technology. More often, they expose a lack of assurance that existing controls are operating as intended.

As cyber threats become increasingly automated and AI-enabled, that gap between investment and assurance becomes even more significant.

What boards should ask

For boards, improving cyber resilience does not necessarily start with buying more technology.

It starts with governance.

That means ensuring cyber risk has clear ownership, understanding the organisation's risk profile, seeking independent assurance and testing incident response plans before they are needed.

Non-executive directors have an important role to play too.

"If you're a non-exec, you should be part of this. You should be asking these awkward questions as well."

The webinar's central message was straightforward: cyber resilience is not measured by how much technology an organisation buys. It is measured by how confidently its leaders can answer a handful of fundamental questions:

• What are our most significant cyber risks?
• How do we know our controls are working?
• Who independently verifies that assurance?
• Are we prepared for what happens when prevention fails?

As cyber threats continue to evolve, those questions belong firmly in the boardroom.

From awareness to action

Understanding cyber risk is one thing. Demonstrating that it is being effectively managed is another.

For many accountancy firms, the challenge isn't a lack of investment in cybersecurity. It's obtaining the independent assurance needed to confirm that risks have been properly identified, controls are operating as intended, and governance arrangements are delivering the resilience that partners, clients and regulators expect.

As trusted advisers handling highly sensitive financial, commercial and personal data, accountancy firms are an attractive target for cyber criminals. Firms must be able to demonstrate not only that cyber controls are in place, but that those controls are appropriate, effective and regularly reviewed.

At Mitigo, we help firms bridge that gap. As a Strategic Partner to both ICAS and ICAEW, we work with accountancy firms across the UK to strengthen cyber governance, improve resilience and gain independent assurance over their cyber risk management arrangements.

Our focus is not on selling technology. It's on helping partners and leadership teams understand their exposure, evidence their resilience, meet their regulatory and professional obligations, and make informed decisions about cyber risk.

Whether your firm is looking to undertake a cyber risk assessment, gain independent assurance over existing controls, test an incident response plan or better understand its cyber governance responsibilities, the objective remains the same: ensuring cyber resilience is built on evidence, not assumptions.

To learn more about how Mitigo can support your organisation, visit www.mitigogroup.com.

This blog is one of a series of articles from our commercial partners, Mitigo. The views expressed are those of the author and not necessarily those of ICAS.