What Should Boards Do?

AI is unlikely to create a wholly new category of cyber risk in the near term. It is more likely to reduce the time, cost or expertise required for some existing attacks, while creating new exposure through the organisation’s own use of AI. The board issue is therefore resilience: can critical services continue when controls fail, material third parties are disrupted or decisions must be made with incomplete information?

Why AI changes the speed and accessibility of some cyber activity; not its fundamentals

Defining the risk

A cyber catastrophe would be an extreme form of severe cyber disruption: a large-scale attack, or cascade of connected incidents, causing sustained economic, physical or societal harm. No incident has yet matched the most extreme scenarios. The board concern is whether interconnected systems, concentrated third-party dependencies and weak recovery arrangements could allow disruption to extend beyond the organisation’s existing response and recovery capacity. The scenarios below translate that concern into operational consequences and evidence requirements.

AI can make reconnaissance, social engineering, data analysis and elements of intrusion faster or more accessible; it can also improve defensive detection and response. The board should therefore focus on three questions: can attackers exploit weaknesses faster, does organisational use of AI create unmanaged exposure, and is governance keeping pace? Past incidents provide a practical basis for assessing how existing weaknesses and dependencies could shape those effects.

What past incidents tell the board; and what they do not

Past incidents do not establish the likelihood of disruption at a global or systemic scale. They show how cyber disruption can cross organisational boundaries, interrupt essential services and impose costs beyond the initially compromised system. The five examples below illustrate operational lessons that the board can use when assessing AI-enabled risk.

NotPetya (2017)

Threat source: Russia’s GRU (Sandworm)

Initial target: Ukrainian organisations; the malware spread globally

What happened: Attackers released destructive malware against organisations in Ukraine. Its indiscriminate design allowed it to spread further, disrupting businesses elsewhere in Europe and Russia. Affected organisations experienced destructive system failures, operational interruption and substantial recovery costs.

Impact: Global operational disruption, destructive data loss and substantial financial damage across multiple sectors.

Why it matters: NotPetya demonstrated that a destructive attack aimed at one country could propagate through shared technology and commercial networks, causing global operational and financial damage. The incident does not show that comparable effects would occur in every sector, but it illustrates how shared dependencies can turn a cyber incident into a wider business-continuity issue.

SolarWinds compromise (2020)

Threat source: Russia’s SVR (APT29)

Target: Government agencies and private-sector organisations using compromised software

What happened: Attackers inserted malicious code into the SolarWinds Orion software build process, and the compromised software was distributed through a normal update. This created an initial route into approximately 18,000 public- and private-sector customers, although only a much smaller number were selected for follow-on compromise(Cybersecurity and Infrastructure Security Agency, n.d.). The US Government assessed the campaign as an intelligence-gathering effort. For affected organisations, identifying the scope of compromise and removing the attackers required a complex investigation (Federal Bureau of Investigation et al., 2021).

Impact: Prolonged, difficult-to-detect access across a widely trusted software supply chain.

Why it matters: SolarWinds showed that a trusted software supply chain could provide prolonged access to government and private-sector environments. The operation was primarily an intelligence-gathering campaign, not a destructive attack; its relevance lies in the breadth of access achieved and the difficulty of detecting compromise across dependent organisations.

Colonial Pipeline ransomware attack (2021)

Threat source: DarkSide ransomware group

Target: A major US fuel pipeline operator

What happened: DarkSide ransomware was deployed against Colonial Pipeline’s information-technology network. CISA and the FBI reported no indication that the operational-technology network was directly affected (Cybersecurity and Infrastructure Security Agency, 2021). Colonial Pipeline nevertheless halted operations while responding to the incident. The interruption affected fuel availability and prompted a coordinated government and industry response before pipeline operations resumed (Cybersecurity and Infrastructure Security Agency, 2023).

Impact: A multi-day operational shutdown, fuel shortages and wider economic disruption.

Why it matters: Colonial Pipeline demonstrated that disruption to a single operator can affect fuel availability and public behaviour. The resulting government response also showed how an operational cyber incident can become a wider continuity and policy issue.

Ukraine power-grid attacks (2015 and 2022)

Threat source: State-linked actors associated with Russia

Target: Ukrainian energy infrastructure

What happened: In December 2015, external cyber attackers caused unscheduled outages affecting a large number of Ukrainian electricity customers. The attackers remotely operated distribution-management systems, and the affected companies used manual operations to restore service. In April 2022, Ukrainian authorities detected malicious software intended to shut down electrical substations and damage supporting systems; the planned disruption was prevented before customers lost power.

Impact: Electricity disruption affecting communities during periods of heightened geopolitical tension; a further attempted attack on Ukraine’s energy infrastructure was prevented in 2022.

Why it matters: The Ukraine incidents showed that cyber operations can interrupt electricity supply and can accompany a period of wider geopolitical and military conflict. The board should therefore test resilience against targeted regional disruption rather than assume that the impact will remain confined to the original victim.

Disruption to NHS services

Threat source: Ransomware activity affecting a critical healthcare supplier

Target: NHS services dependent on compromised systems

What happened: On 3 June 2024, a ransomware attack disrupted Synnovis, a pathology provider serving NHS organisations. The incident significantly reduced its capacity to process tests, particularly in south-east London, and led to delayed or cancelled appointments and procedures while NHS organisations prioritised urgent care and used mutual-aid arrangements. The attackers also stole and later published data, creating a separate investigation, notification and regulatory response.

Impact: Delayed and cancelled care, operational disruption and compromised patient data.

Why it matters: The Synnovis incident illustrates the connection between digital resilience and service delivery: NHS England recorded delayed and cancelled care, reduced testing capacity and stolen data. In healthcare, disruption of this kind can create operational, regulatory and patient-safety consequences.

Translate threat into exposure

Test severe but credible scenarios

Scenario planning should test how disruption develops across critical services, technology, operations and material third parties. Exercises should combine operational, legal, financial and communications pressure, including uncertainty about trusted data or AI-enabled processes, rather than assess each risk in isolation.

The board can use five questions to test readiness: Which services must continue? Which dependencies could fail together? Who holds authority for operational, financial, legal and communications decisions under pressure? How long can the organisation operate using trusted alternatives? What independent evidence shows that recovery works at the required scale? The answers should determine the decisions and assurance requirements that follow.

Move from assessment to action

Five decisions for the board, supported by executive management

1. Set risk appetite for critical services

Define the maximum tolerable period of disruption for each critical service, using the organisation’s operational-resilience method, and specify the conditions under which operations must be reduced, suspended or restored.

Require investment and control priorities to follow those tolerances, rather than generic maturity scores or technology trends.

2. Make dependency risk visible

Identify the technology, data, operational and third-party dependencies whose failure could interrupt multiple critical services at once.

For material dependencies, consider concentration limits, credible exit or substitution plans and a named executive owner, proportionate to the organisation’s exposure.

3. Test decisions, not just technology

Exercise scenarios that interrupt critical services across technology, operations and material third parties. Test decision rights, manual workarounds, communications, liquidity, legal obligations and recovery priorities. Record failed assumptions, assign owners and fund corrective action.

Maintain protected, recoverable copies of critical data and systems, and test restoration against the maximum tolerable period of disruption approved by the board.

4. Govern AI as both a tool and an exposure

Use AI-enabled security only where it improves a defined control outcome. Require evidence of control effectiveness in the organisation’s environment, clear accountability for automated decisions, protection of sensitive data and a safe fallback when the technology is unavailable or produces an incorrect result.

5. Require assurance over material third parties and recovery

Contractual commitments, questionnaires and software inventories are evidence inputs, not assurance. Require independent evidence that material third parties can detect, contain and recover from severe cyber disruption.

Track closure of exercise findings, unresolved recovery gaps and accepted exceptions through a named executive and board committee.

Test the consequences that inform board decisions

The consequences of severe cyber disruption depend on its duration, geographic reach, the services affected and the ability of organisations and governments to sustain essential operations. The board should use the principal exposures below to test whether risk appetite, continuity arrangements and recovery investment reflect the potential business impact.

Longer-term strategic effects

Repeated severe disruption could affect digital-market access, confidence in online services and government approaches to security and regulation. These are plausible monitoring questions rather than evidence-based forecasts; the board should consider them only where they could alter the organisation’s operating model, regulatory exposure or stakeholder confidence.

What can the board conclude despite uncertainty?

What assurance should the board require?

The sources and examples in this article indicate recurring weaknesses in accountability, dependency management, legacy technology and enterprise-scale recovery testing. The board should therefore assess preparedness through demonstrated capability rather than declared maturity.

What evidence should the board seek?

The board should seek evidence that accountability is clear, material dependencies are visible, unsupported technology is being retired, specialist capacity is sufficient and recovery arrangements have been tested at enterprise scale. Compliance evidence should support that assessment, not substitute for it.

What can strengthen resilience

AI and automation can improve detection, investigation and response when supported by reliable data, integration, oversight and tested procedures. Information sharing, public-private coordination and the replacement of unsupported or high-risk technology can also reduce exposure, but none substitutes for clear accountability and proven recovery capability.

The board judgement should remain proportionate. Severe cyber disruption may never reach a global or systemic scale. A useful board planning assumption is that a sequence of disruptions could exceed existing decision-making and recovery capacity. The board should require evidence that critical services can withstand disruption, decision rights are clear and recovery works under realistic conditions.

Investment should align with critical services, credible scenarios and the maximum tolerable period of disruption approved for each service. This keeps expenditure tied to the business outcomes and recovery standards the board has chosen.

References

• Cybersecurity and Infrastructure Security Agency. (2016). Cyber-attack against Ukrainian critical infrastructure(ICS Alert IR-ALERT-H-16-056-01).
• Cybersecurity and Infrastructure Security Agency. (2021). DarkSide ransomware: Best practices for preventing business disruption from ransomware attacks (Cybersecurity Advisory AA21-131A).
• Cybersecurity and Infrastructure Security Agency. SolarWinds compromise. Eviction Strategies Tool.
• Cybersecurity and Infrastructure Security Agency. (2023). The attack on Colonial Pipeline: What we’ve learned & what we’ve done over the past two years.
• Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, Office of the Director of National Intelligence, & National Security Agency. (2021). Joint statement on the SolarWinds compromise.
• Foreign, Commonwealth & Development Office. (2018). Foreign Office minister condemns Russia for NotPetya attacks.
• Information Commissioner’s Office. Personal data breaches: A guide.
• National Cyber Security Centre. Cyber security toolkit for boards.
• National Cyber Security Centre. (2025a). Cyber security toolkit for boards [PDF].
• National Cyber Security Centre. (2025c). Impact of AI on cyber threat from now to 2027.
• National Cyber Security Centre. (2025d). Mapping your supply chain.
• National Cyber Security Centre. (2024a). NCSC statement following reports of a Synnovis data breach.
• National Cyber Security Centre. Obsolete products. Device Security Guidance.
• National Cyber Security Centre. Planning your response to cyber incidents. Cyber Security Toolkit for Boards.
• National Cyber Security Centre. Prepare: Technical recovery. Disruptive Cyber Attacks Guidance.
• National Cyber Security Centre. Questions for the board to ask about cyber security [PDF].
• National Cyber Security Centre. Ransomware.
• National Cyber Security Centre. (2021). SolarWinds. NCSC Annual Review 2021.
• National Cyber Security Centre. (2025b). The cyber threat to the UK. NCSC Annual Review 2025.
• National Cyber Security Centre. (2024b). The near-term impact of AI on the cyber threat.
• National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1).
• National Institute of Standards and Technology. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST Special Publication 800-61 Rev. 3).
• NHS England. (2025). Synnovis cyber incident.
• State Service of Special Communications and Information Protection of Ukraine. (2022). Heavy cyberattack on Ukraine’s energy sector prevented.
• United Kingdom Government. (2021). Russia: UK exposes Russian involvement in SolarWinds cyber compromise.
• United States Department of Justice. (2021). Department of Justice seizes $2.3 million in cryptocurrency paid to the ransomware extortionists DarkSide.