10 Cybersecurity Questions Every Board Should Ask in 2026
Boards do not need to read packet captures. They need to ask the questions that expose whether cyber and AI risk is actually being governed and to keep asking until the answers are specific, evidenced and honest.
These ten questions are written for the boardroom in 2026. Use them with the CEO, the CISO and the head of risk. The right answer is rarely "we are fine"; the right answer is a clear position, a named owner and a date.
1. What is our cyber and AI risk appetite, and who approved it?
If the board has not set and documented a risk appetite, the organisation has no consistent way to decide what risks to accept, transfer or mitigate. Ask to see the statement, who signed it, and when it was last reviewed.
2. Which regulatory obligations apply to us, and where do we stand?
NIS2, DORA, the EU AI Act and GDPR each carry board-level duties. Ask for a single page that maps each regime to the organisation's status compliant, in progress, or exposed with the date by which any gap closes.
3. Who is accountable for cyber risk, and is that accountability documented?
Accountability that lives in a committee is not accountability. Ask for the named individual on the management body responsible for cyber risk, and the charter that makes that responsibility enforceable.
4. What would a serious incident cost us, and have we tested our response?
Ask for an estimate of the operational, financial and reputational cost of a major incident, and the date of the last tabletop or simulation that exercised the board's role in the response.
5. What is our most likely attack scenario this year?
A vague "phishing" answer is not useful. Ask for the top three plausible scenarios for your organisation based on sector, geography and recent threat reporting and what has been done to reduce each.
6. How are we governing AI use, including third-party and agentic AI?
AI risk is not only the models you build; it is the models embedded in your vendors and the autonomous agents now acting on your data. Ask where AI is in use, who approved it, and what guardrails apply to agentic systems.
7. Where is our single biggest concentration of risk?
Most organisations have one: a dominant supplier, a critical system, a single site. Ask which concentration would cause the most damage if it failed, and what reduces the dependence.
8. How do we know our security controls actually work?
Control lists are not assurance. Ask for the independent testing behind the claim penetration tests, red-team exercises, audits and what the most recent one found that has not yet been fixed.
9. What did our last incident teach us, and what changed because of it?
If the answer is "we did not have a serious incident," ask about near-misses. An organisation that learns nothing from incidents is usually one that is not detecting them.
10. What do you need from the board to do your job?
This is the question most boards forget. It exposes whether the executive has the authority, budget and clarity to govern cyber risk effectively and whether the board is actually enabling oversight or merely receiving it.
A board that works through these questions every quarter, with independent advice where needed, is doing the part of cyber governance only the board can do. For a structured way to run that conversation, see our virtual cyber board advisor engagement.