Cyber risk for CEOs: 6 hard lessons from our masterclass

Cyber risk for CEOs is a leadership issue, not just an IT one. A serious attack does not stay in the server room. Yet in many mid-sized businesses, nobody is clearly in charge of cyber security. The CEO assumes the IT provider has it covered, the IT provider only looks after the systems, and finance sees it as someone else’s problem.

We directly address these issues in our recent CEO masterclass. Our own co-founder and CEO Graeme Freeman is joined by three of our technology leaders, Shannon Roy, Nigel Hodges and Simon Ratcliffe, and by cyber insurance adviser John Clarke of Partners&. Drawing on what they see inside businesses, the panel explains where mid-sized organisations are most exposed, who should own cyber risk, why backups and insurance are not a safety net on their own, and what it really takes to be ready when an attack happens.

Below are the six lessons every CEO should take from the session, with timestamps so you can go straight to each part of the video.

1. The C-suite must model good cyber behaviour (01:36)

The panel’s biggest concern starts at the top: CEOs and chairs who switch off multi-factor authentication (MFA) because the extra login is irritating. Senior executives are the people attackers target most, so this is where controls matter most. When leaders are seen not to care, they undo everyone else’s hard work.

People remain the weakest link. One insurer reports that around three quarters of its cyber claims are triggered by human error, such as an employee acting on a convincing but fake payment request.

2. Look inward, not just at the threat horizon (04:47)

Tracking the latest attacks matters less than understanding how your own business has changed. Acquisitions, new software, remote access, staff using AI and reliance on SaaS suppliers all shift your exposure. Ask what would happen if a key supplier were hit. Could it stop you trading?

Attackers now work at scale, testing businesses the way a thief tries car door handles. Being attacked rarely means you were singled out.

3. Cyber security is a business risk, not just an IT problem (16:40)

A ransomware attack quickly becomes a sales, customer service, cash flow, and reputational issue, so the whole leadership team must own it. Everyone involved must report to someone with the authority to act and the competence to know what ‘good’ looks like. That could be the CEO, the CFO, or a senior technology leader, but it cannot be left to the IT team alone. You can outsource services, but you cannot outsource accountability.

4. Why backups and cyber insurance are not silver bullets (32:16)

‘We’ve got backups’ and ‘we’ve got cyber insurance’ are the reassuring phrases that should make a CEO most nervous. A backup is not proven until it has been restored, and because attackers often sit inside systems for months before striking, recent backups may be compromised too.

Insurers now ask when backups were last tested and how quickly the business can recover. An inaccurate proposal form can put a claim at risk. Two questions to ask your broker: what support comes with the policy during an incident, and when would a claim be refused?

5. Being crisis ready through practical testing and incident response planning (46:37)

Incidents start with confusion, not a clear alert, and detailed plans rarely survive the first hours. The panel recommends:

• Running tabletop exercises with the leadership team
• Keeping a hard copy of the incident response plan in an agreed, secure location
• Setting up backup communication channels, such as an emergency messaging group, in advance
• Agreeing who can approve emergency spending and who can disconnect systems, including during weekends

The incident is not over until normal operations resume. Some of the worst decisions are made in the wrap-up.

6. One leadership act to start this week (54:37)

• Work towards Cyber Essentials Plus, whose questions closely mirror what insurers ask
• Run a 30-minute scenario review with the leadership team, focused on business impact rather than technology
• Pick your most critical service and ask how long it would take to trade again, and when you last proved you could restore it
• Lead by example

Who should own cyber risk in a mid-market business?

Many mid-market businesses cannot justify a full-time Chief Information Security Officer but still need that level of judgement. A fractional CISO gives the leadership team senior security expertise on a part-time basis: assessing real exposure, testing backups and response plans, preparing for insurance renewals and reporting to the board in business terms. Where cyber sits within a wider technology agenda, a fractional CIO or fractional IT Director can build it into IT strategy and supplier decisions.

---