When a single compromised supplier brought a major UK manufacturer to its knees, halting production for weeks and rippling through global supply chains, it exposed a truth too long denied: cyber is no longer an IT problem, it’s a governance problem. The 2025 Jaguar Land Rover attack, now dubbed one of the costliest in British history, didn’t start in an isolated network. It was in reality a failure of oversight, risk management and strategic foresight.

In both the EU and the UK, regulators are accelerating this shift. New directives and governance codes explicitly make boards accountable for cyber resilience, not just technical controls. Cybersecurity has evolved from a box-ticking exercise into a barometer of executive competence, shaping strategy, reputation and an organisation’s licence to operate.

When Cyber Risk Becomes Business Risk

It’s time to ditch the outdated notion that cyber risk is just another specialist IT concern. Today it behaves like a hybrid of financial, operational and conduct risk, and it’s fast-moving, systemic and relentless. The 2025 Jaguar Land Rover is a stark example of how a cyber incident becomes a business crisis, not merely an IT outage, with an estimated £1.9 billion impact on the UK economy.

Traditional risk registers, still stuck in likelihood/impact matrices, are struggling to capture this reality. Cyber risk doesn’t wait for quarterly risk reporting cycles, and a weakness in a third-party supplier can cascade into multi-tier disruption before anyone has signed off a risk assessment. Studies of third-party cyber risks underscore that a single breached vendor can halt entire operations or expose sensitive data across countless partners.

UK and EU regulators are explicitly linking cyber resilience to business continuity and executive accountability from NIS2 (NIS2 Directive 2022/2555) and DORA (Digital Operational Resilience Act)  in the EU to the forthcoming UK Cyber Security and Resilience Bill’s supply chain duties.

In this environment, the unification of governance, risk and compliance (GRC) and cybersecurity isn’t a cosmetic tidy-up, it’s a response to how risk actually behaves. Viewing risk through “risk velocity” rather than static likelihood/impact helps boards govern effectively under digital uncertainty.

Beyond Box-Ticking

Too many boards still treat compliance as a defensive tick-box exercise: “We’ve done ISO 27001, we’re fine.” But ticking boxes doesn’t create business advantage, it merely meets minimum expectations. What’s changing in the UK and EU is a shift towards outcomes-based governance where regulators and stakeholders don’t just check controls exist, but they assess how decisions are made, risks are weighed and accountability is demonstrated.

Forward-thinking firms use integrated cyber-GRC to signal trust and agility. A robust cyber posture, aligned with governance and risk processes, can accelerate entry into regulated markets or partnerships because customers and insurers see mature cyber governance as a proxy for management quality. In mergers and acquisitions (M&A), rigorous cyber due diligence, integrated with GRC, prevents unpleasant surprises and can even enhance valuation, as deals collapse or shrink when undisclosed vulnerabilities emerge late in negotiations.

Consider a midsized SaaS provider that built cyber governance into its risk-management fabric. It secured GDPR  (General Data Protection Regulation) and Cyber Essentials certifications early, was able to reassure enterprise buyers quickly, and closed a partnership that required high data standards without costly third-party audits. That’s real return on investment (ROI) beyond compliance. Likewise, buyers now routinely use integrated cyber-GRC assessments to fast-track M&A, reducing negotiation friction and protecting post-deal trust. In short, cyber governance isn’t a brake, it’s a strategic enabler where compliance becomes a market differentiator.

Fixing the Organisational Disconnect

Boards and cyber teams often talk past each other. Security leaders describe vulnerabilities, controls and attack paths whilst directors want to understand exposure, decision-rights and value at risk. That gap is why incidents escalate badly and why cyber rarely shapes strategy.

The missing link is a cyber translation layer mapping technical events to business decisions. When a ransomware alert triggers not just containment, but a pre-agreed governance escalation, boards can decide quickly whether to shut down operations, notify regulators or accept short-term loss for long-term trust.

Real-world examples are emerging. UK financial services firms increasingly align incident-response playbooks with risk-appetite statements, reflecting regulatory expectations on operational resilience. Meanwhile, the UK National Cyber Security Centre observes that organisations with cyber-literate non-executive directors recover faster because decisions are not bottlenecked in technical debate.

This is not about more reporting but better framing. The future belongs to organisations where security leaders articulate trade-offs, risk leaders understand digital operations, and cyber is debated like capital allocation or strategy. That shift turns cyber from a technical cost into an executive discipline.

Designing for Resilience, Not Perfection

Perfect prevention is a comforting myth. Leading organisations now design for assumed breach, accepting that incidents will happen and focusing governance on resilience and recovery. This shift is visible in how cyber appears on board agendas. It is no longer an annual compliance update, but as a standing discussion tied to operational resilience and strategic risk.

Some UK retailers, for example, run cyber crisis simulations alongside financial stress tests, forcing executives to decide under pressure who shuts systems down, who speaks to regulators and who owns customer trust. Others link executive incentives to recovery objectives such as time to restore services or quality of decision-making, rather than an unrealistic promise of zero breaches.

The most advanced organisations are now “governance stress-testing” cyber events. The question is not only whether systems cope, but whether leaders can decide fast enough, escalate appropriately, and document accountability. EU and UK regulators are reinforcing this mindset, with frameworks such as DORA emphasising resilience, recovery and management responsibility over perfect prevention.

Cyber maturity, in this world, is measured by decision quality under pressure. It is not about the absence of attacks, but the confidence to keep moving when they arrive.

A Strategic Imperative Revisited

Integrating GRC and cybersecurity is no longer a hygiene exercise; it is a leadership test. The organisations pulling ahead are not those drowning in policies, but those aligning risk appetite, controls and cyber reality into one coherent operating model. When Maersk rebuilt after NotPetya, cyber decisions moved to the boardroom.  When firms caught in the MOVEit supply-chain breach scrambled, the gaps were governance, not firewalls. The lesson is bluntly that coherence beats compliance. The World Economic Forum has flagged cyber risk as a top business threat, so a challenge for boards is if cyber risk is a serious business risk, why is it often still parked as a technical sidebar?

And what about you…?   

• If a major cyber incident happened tomorrow, could your board clearly articulate who owns the risk, who makes decisions, and how those decisions align with your stated risk appetite?

• When was the last time cyber risk meaningfully influenced a strategic business decision, such as market expansion, M&A, or major technology investment?