Cybersecurity and AI: A Board’s Responsibility

Eight Principles for Effective Cyber-Risk Governance in the AI Era

Cybersecurity in the AI Era: A Critical Board Responsibility

The convergence of artificial intelligence and cybersecurity represents the most significant shift in the digital risk landscape since cloud computing. As organisations accelerate digital transformation initiatives, boards face unprecedented governance challenges that traditional security frameworks fail to address.

Recent data from the World Economic Forum Global Risk Report 2025 reveals a troubling trend: AI-enhanced cyber-attacks have increased 300% since 2023, with automated threats now capable of exploiting vulnerabilities at machine speed. Australia and other major economies have elevated AI-powered cyber threats to their highest security priority, acknowledging the asymmetric advantage these technologies provide to threat actors.

The stakes for boards have never been higher. A successful breach now costs organisations an average of $5.6 million per incident, while regulatory penalties under expanded cybersecurity disclosure requirements can exceed $10 million. Beyond financial impacts, the reputational damage from AI-related security failures has proven particularly devastating, with affected companies experiencing customer trust erosion that persists long after technical remediation.

Against this backdrop, the Australian Institute of Company Directors has fundamentally revised its cybersecurity guidance, explicitly recognising that AI governance and security require board-level oversight and strategic integration. This shift reflects the reality that AI simultaneously represents an organisation’s greatest competitive opportunity and most significant security vulnerability.

For directors, understanding this dual nature of AI technologies has become non-negotiable. Those who treat cybersecurity merely as an IT function rather than a strategic business imperative expose their organisations to existential risks while missing crucial opportunities for competitive differentiation through secure AI deployment.

However, common mistakes made by boards when it comes to cybersecurity can undermine an organisation’s cyber-resilience. These mistakes include:

• Siloing the cyber-risk discussion from broader AI governance conversations

• Skipping or failing to understand evolving cyber-risks, especially AI-related vulnerabilities

• Failing to prioritize the most valuable digital and data assets that AI systems may access

• Overlooking the human factor in AI security

• Falling victim to sophisticated AI-enabled cyber-attacks without a tested crisis plan in place

“Cybercriminals increasingly leverage AI technologies to automate and enhance their attacks, finding new ways to manipulate human trust and bypass security protocols they can’t overcome via technical means alone. Understanding the impossibility of stopping all incidents will enable an organisation to shift its focus from planning for failure to learning from and reacting to failure in this new AI-enhanced threat landscape.” (Australian Cyber Security Centre, 2024)

Board members must set the tone for the rest of the organisation

To help boards understand the organisation’s cybersecurity posture in an AI-driven world, and to fulfill their cybersecurity responsibilities, here are eight principles for effective cyber-risk governance:

1. Integrate cybersecurity into the organisation’s corporate governance framework

Cybersecurity should not be seen as just an ICT issue, but rather as a strategic business enabler that can help organisations achieve their goals. Directors must elevate cybersecurity as a board issue and develop a priority list that outlines cybersecurity’s new place within the corporate governance framework. This approach allows directors to maximise their involvement and ensure cybersecurity integration into the organisation’s overall strategy. This must now include specific provisions for AI security and governance.

2. Ensure organisational design supports cybersecurity in the AI era

Boards should ensure that their organisation’s design supports cybersecurity by having effective cyber-risk management structures in place that account for AI systems. This includes ensuring that management has the necessary ICT, cyber, and AI expertise to assess and manage cyber risks, and that there is clear reporting and communication between management and the CEO, and the board on cybersecurity issues, particularly those related to AI deployments.

3. Understand the economic drivers and impact of cyber risk, including AI-specific risks

Boards should have a clear understanding of the economic drivers and impact of cyber risk on their organisation, including the unique risks posed by AI technologies. This includes understanding the organisation’s data holdings, how data is used to train and operate AI systems, the potential financial, reputational, and operational consequences of a cyber-attack (especially those leveraging AI), as well as the benefits of investing in preventative cybersecurity measures designed to counter advanced threats.

4. Align cyber-risk management with business needs and AI strategy

Cyber-risk management should be aligned with the organisation’s business needs, goals, and AI strategy. This means ensuring that cybersecurity measures are integrated into the organisation’s overall risk management framework and that they support the achievement of business objectives while safeguarding AI systems and the data they process.

5. Incorporate cybersecurity and AI expertise into board governance

While some companies may choose to recruit board directors with cyber-risk, cybersecurity, or AI expertise, boards should at a minimum increase the entire board’s understanding of cyber-risk and AI security through external expertise. Building relationships with their CIO, CISO, or Chief AI Officer can provide internal expertise to guide strategic cybersecurity decisions and improve the organisation’s cyber risk posture in relation to AI systems.

6. Establish AI security and ethics governance frameworks

Boards should establish clear AI security and ethics governance frameworks that define how AI systems will be developed, deployed, monitored, and secured within the organisation. This includes establishing clear roles and responsibilities for AI security, creating processes for regularly assessing AI systems for vulnerabilities, and ensuring ethical guidelines are followed in AI implementation.

7. Implement AI-specific security measures and monitoring

Organisations must implement security measures specifically designed to protect AI systems and defend against AI-enabled threats. This includes monitoring for model poisoning attempts, data manipulation, prompt injection attacks, and other AI-specific vulnerabilities. Boards should ensure regular security audits and penetration testing that includes AI systems.

8. Encourage resilience and collaboration in AI security

Boards should encourage systemic resilience and collaboration within their organisation, and with external partners and stakeholders to improve the organisation’s cybersecurity posture in the face of evolving AI threats. This includes developing peer networks through board governance associations and connecting with other board professionals to share best governance practices across institutional boundaries. Collaboration with industry partners and government agencies on AI security initiatives should remain a priority.

Summary

Board directors carry significant responsibility for organisational cyber resilience in today’s AI-enhanced threat landscape. The eight principles outlined above provide a comprehensive framework for effective cyber-risk governance that integrates AI considerations at the strategic level.

Successful boards recognise that cybersecurity transcends technical departments to become a cornerstone of corporate governance. They cultivate AI and cybersecurity expertise, align security measures with business objectives, and foster collaborative security cultures that adapt to rapidly evolving threats.

As AI technologies transform both offensive and defensive security capabilities, forward-thinking boards will establish robust governance frameworks that address these unique challenges. This proactive approach protects not only digital assets but also stakeholder trust and organisational reputation in an increasingly complex digital ecosystem.

About

Gary Morgan is an experienced board director, CEO, consultant, and corporate advisor with extensive knowledge in strategy, innovation, and growth across various sectors including health tech, aged care, agtech, information security, and research. His focus is on driving business growth through transformational change, with particular emphasis on leveraging emerging deep technologies while maintaining robust governance postures. He serves as a Fellow of the Governance Institute of Australia and on the Griffith University Industry Advisory Board for the ICT School. Gary has co-authored papers and reports published in top entrepreneurship and medical journals.

Acknowledgment: This article updates the original May 2023 publication “Cybersecurity: A Board’s Responsibility” and incorporates AI-assisted research and drafting.

References

1. World Economic Forum. (2025). The Global Risks Report.
2. Australian Institute of Company Directors. (2024). Directors’ Guide to AI Governance.
3. Governance Institute of Australia. (2025). 2025 AI Deployment and Governance Survey Report.
4. Leibel. A, Pales. C. The Secure Board. (2021). Sydney, Australia 
5. The Harvard Law School Forum on Corporate Governance. (2021). Principles for Board Governance of AI and Cyber Risk
6. Australian Institute of Company Directors (2024). Cyber Security Governance Principles
7. National Institute of Standards and Technology. (2024). AI Risk Management Framework.
8. Australian Cyber Security Centre. (2024). Annual Cyber Threat Report 2023 2024.
9. Gartner. (2024). Gartner Identifies the Top 10 Strategic Technology Trends for 2025.
10. World Economic Forum. (2024). AI Governance Alliance.