Most large organisations have a cyber lead, a legal team, a security function and an HR department. Very few have a single, shared picture of risk across all of them—and, in 2026, that gap is where the most damaging threats are hiding.

The question I hear most often is: “why didn’t we see this coming?” The answer is almost always the same. The signals were there, but the traditional model of cyber, HR, legal and security, each in their own silo, was designed for a threat landscape that no longer exists.

A cyber incident in August 2025 forced major UK manufacturer Jaguar Land Rover to halt production for five weeks at a cost of £196m—a breach that began not with a broken defence, but with legitimate credentials. A £20m deepfake fraud at global engineering firm Arup did not touch a single internal system. It exploited trust, time pressure and familiarity: the conditions created every day by routine working life.

These are not isolated incidents. They are symptoms of a broader shift in how threats operate. Understanding that shift is the first step towards asking the right questions about it.

Nine threats boards are underestimating

At Clue, we have mapped the various key threat areas to watch. Of these, nine of them share the key element of ‘convergence’—in other words, none of them stay in one function’s lane, and none of them are well-served by siloed reporting.

1. Serious and organised crime. Converts corporate scale into criminal scale through theft, fraud and money laundering, hidden inside routine logistics and supply chains.
2. Fraud. AI-generated deepfakes and voice cloning have shifted fraud from breaking in to talking its way in, targeting payment authorisation and supplier verification.
3. Terrorism and extremism. Lone-actor attacks using low-tech methods represent the most likely risk for most organisations—and Martyn’s Law, which is now in force, places clear duties on those responsible for publicly accessible venues.
4. Cybercrime and information security. Most serious incidents now begin with legitimate credentials, not broken defences—making access governance as important as perimeter security.
5. Insider threat. Most insider harm starts not with malice but with financial pressure, confusion or entitlement.
6. Corporate espionage and hostile state activity. State-backed actors target R&D and deal flow through routine channels—CVs, expert consultations and advisory roles—rather than technical attacks.
7. Sanctions risk and geopolitical exposure. Routine payments can breach sanctions where a designated person ultimately benefits.
8. Protest, activism and physical security. Campaigns mobilise fast online and translate quickly to on-site disruption, often with limited warning and across multiple locations.
9. Safeguarding and exploitation. Modern slavery and labour exploitation persist deep in supply chains, and regulators now expect remedy, not mere policy alone.

With threats converging across all nine of these areas, the traditional board-level conversation about security is no longer adequate. Yet the questions that dominate most board agendas have not kept pace.

Typically, a board focuses on questions such as: Are our cyber defences up to date? Have we completed our annual security audit? Do we have an incident response plan? Are we compliant with our obligations under this regulation?

But these are hygiene checks, not governance. A board that consistently hears good news about security is not well-governed; it is poorly informed.

Four shifts for better understanding

The more useful frame for questions is “do we actually understand our exposure?”. Four shifts make that possible:

1  From function-by-function reporting to a shared picture. “Do our security, cyber, HR, legal and procurement functions share the same threat picture? When did they last compare notes on a live issue?” That absence is a governance problem, and the board is uniquely placed to fix it.
2  From outputs to outcomes. “We completed our insider threat programme” is an output. “We identified three concerning patterns last quarter and resolved two” is an outcome. The absence of patterns usually reflects the reporting culture, not the absence of risk.
3  From reassurance to evidence. “How do we know the control worked? When did we last test it?” Unless an organisation can show how access was gained and closed, patching an incident merely resets the stopwatch.
4  From annual cycles to dynamic awareness. The Home Office Fraud Strategy 2026–2029 places new expectations on boards around fraud governance, and the offence of Failure to Prevent Fraud is now in force, so static annual risk reviews are no longer enough.

Boards do not need security expertise, but they do need two specific tests. First, coherence: if the CISO reports robust access controls but HR reports high contractor churn and procurement cannot say how many vendors have elevated system access, those reports do not tally. Second: don’t ask “do we have a plan?” but “what does the person on the ground do in the first five minutes of an incident?” That answer tells you whether a plan is real.

The governance imperative

The Fraud Strategy is one signal of a broader shift: boards are being held accountable for threats previously delegated to operational functions. Underinvesting in cross-functional intelligence habits, or allowing siloed reporting to persist, is a board-level choice.

The organisations that now fare best are not those with the largest security budgets. They are the ones that connect signals early, make proportionate decisions, and investigate properly when patterns emerge—and creating that culture requires board-level demand.

The questions boards ask shape what their organisations measure and ultimately what they see. Asking better questions is the difference between understanding your real exposure and being sufficiently well-prepared to be surprised.

Matt Horne is director of Intelligence and Investigations at Clue Software and a former deputy director of the National Crime Agency