133 – Your Biggest Cyber-Security Risk Already Sits Around Your Board Table

Somewhere in your inbox this morning there was probably an email thanking you for a payment you never made. You spotted it, checked the sender’s address and deleted it without a second thought, which is exactly what I did with the one that arrived in mine thanking me for $700. Yet your other team mates who receives dozens of these a week may not be quite so lucky at four o’clock on a Friday afternoon.

Most leadership teams I meet still file cybersecurity under IT and treat its budget as a cost to be contained. My guest on this week’s Impactful Teamwork, Robbie Tyrie, has spent more than 25 years in the field, and his view is refreshingly blunt. In his words, it is never a technology issue, because technology simply does what people tell it to do.

Cybersecurity Is A Trust Asset Hiding In Your Cost Base

Robbie started in cybersecurity in 1999, working on the Year 2000 problem, and went on to build security functions at JP Morgan and Virgin Money before becoming global head of cyber at FNZ Group, where he grew the team from virtually nothing to more than 100 people. He now runs Torridon Cyber, providing fractional Chief Information Security Officer support to scale-ups.

His central argument is that security is a business enabler rather than a defensive overhead. If you are taking a product to market, your clients need to trust you with their data and your investors need to trust you enough to keep investing. That trust has to be evidenced, usually through a security questionnaire which, in one recent case for the NHS, ran to 20 pages and took Robbie an entire day to complete. A business that cannot answer those questions with confidence rarely gets a second chance, because the contract simply goes to a competitor who can.

The Attackers Have Moved Down The Food Chain

Five years ago, Robbie explained, criminal groups researched individual organisations and targeted them carefully, because one bank might be worth a million pounds. AI has changed those economics completely. Attackers now write a script that hunts for weaknesses at scale, and ten businesses paying £100,000 each are just as attractive as one paying a million, which has made scale-ups and start-ups the preferred target precisely because they are easier to get into.

The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous twelve months, while only 31% have a board member with responsibility for cyber security. The risk is widespread, and yet the ownership still sits somewhere other than the board table.

Your Own People Will Always Be The First Way In

Robbie was emphatic that any organisation’s number one cyber threat is its own staff, and that this has always been true. In his view three basics will take most businesses more than halfway to being well protected:

Multi-factor authentication on every system that supports it.
An asset register, because you cannot protect what you do not know you own, and he is regularly surprised by how many organisations have no idea.
A risk register that the leadership team actually reads.

He is equally clear that the annual training module everybody clicks through for their yearly attestation achieves very little. He recommends training people at least quarterly and then testing whether it has landed with a phishing simulation, because knowledge that is never tested is simply assumed.

In the episode Robbie also shares an anonymised AI horror story that he describes as letting the genie out of the bottle, together with the two ways he now advises clients to control what their AI tools can reach. I also tell him what happened when I discovered that one of my own books had been scraped into a large language model.

Culture Is Set At The Top Or Not At All

When I asked Robbie how you get people to follow through rather than simply nod along, his answer was a leadership one. Security has to be part of the culture from a new joiner’s first day, and it has to come from the top down, because trying to build it from the bottom up is, as he put it, like building a house on sand. Until recently, he told me, most boards only cared about security once it had already become a problem.

His most practical idea costs nothing at all. He appoints security champions across departments and brings them together once a month with the security team and a member of the executive, so that everybody can see the leadership taking it seriously. A salesperson who can explain your security position confidently is, after all, winning business with it.

Retrofitting Security Costs Far More Than Building It In

Robbie’s warning for scaling businesses is that most of them leave this far too late. Scrutiny grows with every new client, vendor, board member and investor, and embedding security three years down the line is considerably harder than putting baseline controls in place on day one. When a business heads towards a sale or an IPO, investors will want an accurate picture of its cyber risk, which is why Robbie believes cyber risk belongs on the board scorecard alongside every other KPI.

He closed our conversation with the story of a small business that had to shut its doors entirely after a single attack, and it is the story I would most like every chief executive to hear.

The Question Worth Taking Into Your Next Leadership Meeting

Is your business paying cybersecurity the attention it genuinely deserves, and would every member of your leadership team give you the same answer if you asked them separately?.

Listen to the full episode of Impactful Teamwork. Then take the Entrenched Leadership Dynamics Diagnostic to see where your leadership team’s blind spots really sit. And if there is one person on your board who still believes cybersecurity is somebody else’s job, please send this episode to them today..

Or join us at our next executive forum, where we work through exactly this question with leaders of scaling businesses and pressure-test what human leadership needs to look like alongside the technology. Register your place here