Cyber isn’t an IT problem: Why Cyber risk belongs in the boardroom

A CEO walks into a boardroom. What do they want to know?
Is revenue where it should be? Are our stakeholders happy? Are we on track? Are we delivering against plan?
However, how often does the question become: what happens if we suffer a cyber-attack?
If the internet goes down, the supply chain is disrupted, critical systems are inaccessible and customers cannot be served, the answers to those first questions can change very quickly.
Revenue? Stopped. Operations? Disrupted. The plan? On hold.

Cyber security is no longer simply about protecting servers, networks and data. It is about protecting the ability of a business to operate, trade and deliver on its commitments.
Ireland’s National Cyber Security Centre (NCSC) has recognised this shift, noting that cybersecurity has evolved beyond a technical challenge and is now a boardroom priority. Its guidance places accountability for cybersecurity risk management at the highest levels of executive leadership and emphasises clear organisational oversight. Its guidance also places emphasis on senior-management involvement and clear organisational responsibility for cyber risk¹ .
For brokers, that creates an important opportunity: to move the cyber conversation away from technology and towards business resilience.

What would happen if the business stopped tomorrow?

Consider a business that relies on a cloud-based platform to manage orders, a third-party provider to process payments and a logistics partner to fulfil customer deliveries. None of those organisations necessarily needs to be attacked directly for the business to feel the consequences of a cyber incident. A compromised supplier could disrupt operations, a ransomware attack could make critical systems unavailable, and a successful social-engineering attack could divert a payment. The common denominator is not the technology itself – it is the business interruption.
Ireland’s National Cyber Risk Assessment2  highlights the growing interconnectedness for digital systems and the potential for cyber incidents to create cascading impacts through supply chains and across sectors.
This is why the boardroom conversation matters. A board does not need to understand the technical mechanics of ransomware. It does need to understand what the organisation depends upon, what would happen if those dependencies failed and how quickly the business could recover.

Where does the broker come in?

This is where cyber insurance becomes much more than a policy document. For a broker, the quality of the cyber placement starts with understanding the client’s business.

• What systems are genuinely critical?
• How reliant is the business on third-party providers?
• Where does sensitive data sit?
• How long could the business operate if those systems became unavailable?
• What would a 24-hour interruption cost? What about seven days?

And importantly, does the policy respond to the scenarios that the business is actually worried about?
Cyber policies can address a range of first and third-party exposures, including incident response, business interruption, data restoration, legal costs and certain forms of cyber-crime. But the scope of cover, triggers, exclusions and sub-limits can vary significantly. That makes the broker’s role particularly important.
The objective isn’t simply to establish that a client has cyber insurance. It is to establish whether the insurance programme reflects the way that a business operates.

The Central Bank of Ireland’s operational resilience framework³  provides a useful parallel. Its guidance places responsibility on boards and senior management to understand important business services, identify dependencies and prepare to respond and recover from operational disruption - cyber risk should be viewed through the same lens. When the systems stop, the consequences don’t stay with IT. They reach finance, operations, customers, suppliers and, ultimately, the boardroom.
Ultimately, cyber risk is no longer just a technology issue. It is a business resilience issue. As organisations become more dependent on digital systems, understanding how they would respond to and recover from disruption is increasingly becoming a board-level consideration. For brokers, that may be the most important cyber conversation to have with a client this Cyber Security Awareness Month.

Looking for comprehensive cyber cover?  Talk to DUAL by reaching out to Shane Barry, Head of Cyber– [email protected] 

¹https://it.ie/wp-content/uploads/2026/07/NCSC-Cyber-Governance-Management-Boards.pdf

²https://assets.gov.ie/static/documents/46bd0747/NCSC-2025_National_Cyber_Risk_Assessment.pdf  

³ https://www.centralbank.ie/financial-system/operational-resilience-and-cyber/operational-resilience