Cyber risk has been on board agendas for years, but the threat landscape is evolving rapidly. AI is accelerating the speed and scale of attacks, while dependencies on technology and third-party providers can amplify the impact of disruption. These shifts are raising the bar for effective board oversight.

As cyberattacks move toward machine speed, boards should reassess whether traditional approaches to cyber oversight are keeping pace. The challenge is no longer simply determining whether the organization has appropriate controls. Boards increasingly need to understand whether the enterprise can detect and respond at speed, sustain its most critical business services through disruption and make high-consequence decisions under pressure in a trusted environment

Based on the recent EY webcast, Cybersecurity at machine speed: What boards need to know now, three priorities stood out that we believe boards should keep in mind as they engage management on cyber risk.

1. Ask whether the company can respond at the speed of the threat

In our webcast poll, 50 percent of respondents identified AI-enabled attacks as the cyber development most changing their company’s risk posture (above ‘software, supply chain or third-party vulnerabilities’, ‘ransomware or data extortion’ and ‘identity, access, or credential compromise’). Attackers can now use AI-enabled capabilities to identify vulnerabilities and move laterally through environments far faster than ever before.

The fastest observed breakout time—how long it takes an attacker to gain initial access and move laterally within a network—is now just 27 seconds, and benchmarks like this continue to shift as attacks accelerate. On our webcast, we heard that in lab environments, intrusions that once took roughly 2.5 days to gain access, move laterally and exfiltrate data now take about 25 minutes. Threat actors are also moving beyond chatbots to agentic AI that can chain steps of an attack together. The challenge is that attackers can increasingly operate at machine speed while many defense processes still operate at human speed.

This shift should prompt boards to ask whether the organization’s cyber operating model is keeping pace. Speed is not solely a technology issue. Continuous monitoring, faster intelligence and greater automation can accelerate detection, but their value may be limited if escalation paths, governance and decision-making still operate at human speed. Boards should consider whether technology, governance and decision rights collectively enable the organization to act at the speed required.

Edge devices deserve particular attention. Vulnerable and end-of-life devices at the edge of corporate networks are becoming a primary target, and the typical 30-day mean time to patch may no longer be adequate given how quickly attackers can now exploit vulnerabilities. Boards can ask how quickly critical vulnerabilities on internet-facing systems are remediated and whether any unsupported devices remain exposed.

As organizations introduce AI into security operations, boards should understand what actions AI systems are authorized to initiate autonomously. The governance challenge becomes particularly important as organizations move from AI that recommends actions to agentic systems capable of taking them on behalf of management.

2. Shift the conversation from protection to resilience

Boards have historically spent considerable time discussing controls: Are our systems secure? How many incidents have we had? Are vulnerabilities being patched? But today, with the changed threat landscape, the key question has become: Can we continue to operate when disruption occurs?

The EY Center for Board Matters’ Q3 audit committee update emphasizes the importance of connecting emerging risks to strategy and testing resilience rather than assuming it. It’s also vital to identify critical business services a company cannot afford to lose and test how quickly management could make decisions and restore operations following a significant incident. Two-thirds (67 percent) of our webcast respondents said their boards have discussed which critical business services must be sustained during a major cyber disruption, suggesting there is still room for broader adoption of this practice.

Third-party dependencies should be understood by the board, too. A favorable security assessment of a critical provider cannot by itself tell the board whether the business could continue operating if that provider became unavailable. Boards can challenge management to identify their most consequential dependencies and play out what would happen if one failed.

3. Build relationships before the crisis

Companies should establish relationships with law enforcement before an incident occurs. Our webcast discussion benefited greatly from participation by FBI representatives who emphasized that the middle of a cyber incident is not the ideal time to make those connections. A cyber response is ultimately an ecosystem response. Organizations should know how that ecosystem will operate before the crisis begins.

That message reflects the FBI’s recently released cyber strategy—its first public, substantive cyber strategy—which names supporting victims and expanding partnerships with industry among its four pillars, alongside disrupting and imposing costs on malicious actors and enhancing the bureau’s own cyber capabilities, including through AI.

Companies can engage their local FBI field office before an event, including receiving FBI cyber briefings and involving the local field office in incident-response exercises. Engaging with the FBI before an incident can give legal counsel greater clarity about what information may be requested, the protections around information sharing and how engagement would work in practice, helping resolve concerns before decisions need to be made under pressure. As one panelist put it, trust is built before a crisis and spent in a crisis.

For boards, that creates a practical oversight question: Has management practiced the response before it matters? Regular tabletop and simulation exercises can help directors and management work through issues such as decision rights, outside counsel, law-enforcement engagement and continuity of critical services before those decisions have to be made during an incident. They are most helpful when they are scenario-based with key decision points identified, typically first with the CISO’s organization, intended to be more technically focused scenarios, followed by one with board-level participation, appropriate to the organization’s risk profile.

Responding at the speed of the threat, maintaining critical operations through disruption and building trusted relationships before an incident occurs are increasingly important elements of cyber oversight. Audit committees and boards can guide management in moving the conversation beyond protection and toward resilience.

Questions boards should ask

• How quickly can we detect, contain and recover from an attack that moves in seconds rather than days?
• Where in our cyber response process does human decision-making create material delay, and have we established the authority and guardrails necessary to act faster?
• Where is AI being used in our cyber defenses, and how are its outputs validated?
• What cyber decisions can AI make autonomously today, which require human authorization, and how have we established those boundaries?
• How quickly are critical vulnerabilities on internet-facing edge devices remediated, and are any end-of-life devices still exposed?
• Which critical business services must be sustained during a major disruption, and when was that capability last tested?
• Which third-party dependencies would most disrupt operations if they failed, and what is our fallback?
• Has management established a relationship with the local FBI field office before an incident occurs?
• When did directors last participate in a tabletop exercise, and what did it reveal?

The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization. Jennifer Lee is a managing director with the EY Americas Center for Board Matters.