Both panelists and audience at our recent event on Cyber risk shared some suggested resources non-exec directors could use to make sure they’re asking the right questions.
Please feel free to suggest more resources on this topic that we can add. Thanks to Susanne Alfs at Cyber4Directors for her support.
Cyber Governance Code of Practice (DSIT – Department for Science, Innovation and Technology, 2025)
Cyber Resilience Pledge (Cabinet Office, 2026)
Cyber Security Toolkit for Boards on “Collaborating with your supply chain and partners” (NCSC – National Cyber Security Centre, updated 2025)
Cyber Security Breaches Survey 2026 (DSIT & Home Office)
Ben also shared the questions posed in a recent article by Clara Durodie: The Scariest Part of Claude Mythos is Timeline Collapse. Get in touch at info@nedsinfs.com if you’d like a copy of the full article. The questions he read are below:
Five Questions Boards Should Ask
In light of what Claude Mythos appears to reveal about AI driven vulnerability discovery and systemic cyber risk, here are some incisive questions for boards to start their own discovery:
1. If machine systems can now autonomously discover and chain critical vulnerabilities across decades old infrastructure, what assumptions in our current risk models about software stability and audit cycles are now obsolete?
2. How exposed is our organisation to a shift where the time between vulnerability creation and exploitation collapses from years to days, and do we have any credible capability to operate in a near real time patching environment?
3. If offensive cyber capability is becoming increasingly automated and scalable, what is our true residual risk exposure even after existing controls such as penetration testing, static analysis and red teaming have been applied?
4. Are we structurally prepared for a world in which security is no longer a periodic function of compliance, but a continuous state of machine mediated adversarial pressure that never pauses?
5. If only a small number of actors currently have access to frontier level offensive AI systems, how fragile is our current equilibrium, and what happens when that capability diffuses beyond responsible institutional boundaries?