TL;DR

• Headlines like PHP2Shell make boards pay attention for about a week, then attention fades and budget conversations get hard again. The Cyber Security Breaches Survey 2025/26 found 72% of UK businesses say cyber is a high priority for senior management, but awareness hasn’t yet turned into much action.
• The way through is to use the headline to agree something lasting: a plain-English risk appetite, a standing item on the board agenda, and a small, specific ask. The NCSC’s Cyber Governance Code of Practice gives you a ready structure.
• AI is a big part of the conversation, but whether it is moving board risk thresholds or this is the calm before the storm is still open. We suggest asking the questions with your board, not answering for them. A companion article covers the first-hour response.

The Pattern We All Recognise

A flaw reaches the top of the news. The board wants answers by lunchtime. For a few days, cyber is the most important thing in the building. Then the story moves on, and the budget request you have been trying to land for months goes back to the bottom of the pile.

If that sounds familiar, you are not doing anything wrong. It is how attention works, and almost every security leader we speak to describes the same cycle. The opportunity is to use the moment, calmly, to agree things that last longer than the news does. Our companion article, “Are We Vulnerable?”, covers the first hour. This one is about the weeks after.

What the Data Says About Board Engagement

Source	Finding
Cyber Security Breaches Survey 2025/26 (DSIT)	72% of UK businesses rate cyber as a high priority for senior management, unchanged on last year
Same survey	Board engagement among large businesses rose from 27% to 31%, reversing a long decline
Same survey	Awareness has not yet turned into much change in behaviour, with little growth in insurance or training spend
Same survey	Only 25% of businesses that reported breaches have a formal incident response plan

In plain terms: most boards say cyber matters, and fewer have put structure behind it. That gap is where your conversation sits.

What Boards Are Really Asking

What the board says	What they usually mean	A helpful way to respond
“Are we affected by this?”	Am I exposed, and what do I tell people?	A short, honest update with a time for the next one
“Why can’t we just buy something?”	Can money make this go away quickly?	Explain what a tool covers and what it doesn’t, and what people and process still need
“How much is enough?”	When can I stop worrying?	Move to risk appetite: what level of risk are we willing to carry, and what would we do if it happened?
“Do our competitors spend more?”	Are we behind?	Compare on outcomes, not budgets: readiness, response time, recovery

Risk Appetite in Plain English

Risk appetite sounds abstract. In practice it is a conversation about how much disruption the business can accept before it matters: a day without email, a week without the website, a loss of customer data. A short statement the whole board has agreed gives you something to measure budget requests against.

Scenario	Question for the board	What the answer drives
Critical system down	How long can we cope without it?	Recovery targets, backup and resilience spend
Customer data exposed	What level of exposure is acceptable?	Data protection controls and monitoring
A flaw in the news	How fast must we be able to say “we’re safe” or “we’re fixing it”?	Asset inventory, patching and incident exercises
Supplier breach	How much do we rely on suppliers’ security?	Third-party checks and contract terms

The NCSC’s Cyber Governance Code of Practice, published in April 2025, is a useful frame. Its five principles are risk management, strategy, people, incident planning, and assurance and oversight. It is voluntary, and it gives you shared language for what boards are expected to oversee.

Using a Headline Well

• Respond first, calmly. A clear first-hour update builds trust that carries into the budget conversation.
• Brief within a day. Say what happened, what it means for you and what you are doing, in plain words.
• Link it to something you already know. If the headline exposes a gap you have flagged before, such as an incomplete asset inventory, say so gently and factually.
• Make one small, specific ask. A tabletop exercise, a standing agenda item, or funding for a named gap is easier to say yes to than “more budget”.
• Follow up when the noise has gone. A short note a month later, showing what changed, keeps the conversation alive.

We have written about several of the pressures behind these asks: the cyber skills shortage and why you cannot hire your way out of it, alert fatigue in the SOC, and SOC as a service. Each one can give your board a concrete, evidence-based choice.

Is AI Moving Your Board’s Risk Threshold, or Is This the Calm Before the Storm?

AI features in almost every board conversation now, but what it means for risk is still being worked out. The UK government wrote to boards in April 2026 about AI-related cyber threats, urging regular discussion and a standing item on the agenda. The New Zealand Institute of Directors’ 2025 cyber guide adds AI-driven threats and third-party risk. The evidence on speed is mixed:

Signal	What it suggests
Wiz on PHP2Shell	AI made it far easier to turn decades-old flaws into working attacks
Mandiant M-Trends 2026, as summarised by the Cloud Security Alliance	Exploitation often begins before a patch exists (check the original report before quoting it)
VulnCheck, first half of 2026	Only about 1% of AI-found vulnerabilities have been exploited so far

That leaves some honest questions worth asking your board rather than answering for them:

• Has our appetite for risk changed because attackers may be faster, or are we waiting to see?
• If a headline flaw were exploited here within hours, what would we want to have in place?
• Are we spending to be ready for the storm, or because the weather looks calm today?
• Who owns the question of AI-driven risk at board level?

Budget Conversations That Land

• Start from outcomes the board cares about: uptime, customer trust, regulatory exposure, recovery time.
• Show two or three scenarios with an honest range of impact, not a single scary number.
• Present options at different price points, including what each one leaves uncovered.
• Say what you are not asking for. It builds credibility.
• Avoid fear. Boards are more likely to back a plan that feels calm and costed.

What We’re Seeing in Practice

What we hear most often from security leaders:

• Boards react strongly to the news, then lose momentum before decisions are made.
• Security leaders are asked to prove a negative, to show nothing bad is happening, which is hard to do.
• A short, agreed risk appetite statement makes later budget conversations noticeably easier.

UK & New Zealand Perspective

The board conversation looks similar in both markets, with local resources to lean on:

• UK: the NCSC Cyber Governance Code of Practice, the government’s April 2026 open letter, and a Cyber Security and Resilience Bill moving through Parliament that proposes tighter incident reporting for in-scope organisations.
• NZ: the Institute of Directors’ Cyber Risk: A Practical Guide (2025 edition), and NCSC NZ guidance, give directors a ready-made structure.

ITogether’s Independent Verdict

Boards are not the enemy of good cyber security. They are people who read the same headlines you do, and who want to do the right thing without always knowing what that is. When you give them a calm response in the moment and a clear, small ask afterwards, you move from the person who brings bad news to the person who helps them make decisions.

We are in the same position with our own customers, helping translate headlines into plans. If it would be useful, we can help you shape a risk appetite statement or a board briefing. Our companion article covers the first-hour response when the next headline arrives.

👉 Would a second pair of eyes on your next board briefing help? Get in touch.

📞 UK +44 (0) 113 341 0123

📞 NZ +64 (0)9 802 2444

📧 hello@itogether.com

FAQs

How Do I Get Board Buy-In After a Cyber Headline?

Respond calmly first, brief within a day in plain words, link the headline to a gap you already know about, and make one small, specific ask such as an exercise or a standing agenda item.

What Is Cyber Risk Appetite?

It is how much disruption or loss the business is willing to accept, expressed in terms the board understands, such as how long a system can be down. It gives budget requests something to be measured against.

What Is the NCSC Cyber Governance Code of Practice?

A voluntary code, published in April 2025, with five principles for boards: risk management, strategy, people, incident planning, and assurance and oversight.

Is AI Changing How Boards Should Think About Cyber Risk?

It is a fair question for every board. The evidence on faster attacks is mixed, so we suggest discussing it openly, deciding whether your risk appetite has changed, and revisiting it regularly.