What do Boards Care About in 2026?

Laura Oertel: Well, hello everyone. Thank you so much for joining us to What Do Boards Care About webinar, which I’m personally really excited about.
So today we’re really trying to get some practical advice for people to take back and know how to improve your relationship with the board and just make everything a bit more efficient.
So maybe we start off with some introductions.
Mary, do you want to kick us off?

Mary Keane-Dawson: Sure.
My name is Mary Keane Dawson.
I have been in leadership roles
For the last 40 years in the advertising, media and technology sector, I’ve built and sold to companies, one to WPP, one to Dentsu, and one to JC Deco.
I am currently the chair of the British Interactive Media Association.
I’m a board advisor to the Trust Alliance Group.
And I also work with a number of funds, VCs and
And PE firms looking at investment opportunities and incubators.
And that’s me.

Laura Oertel: Thank you.
Rory, do you want to go next, telling us about a bit of an introduction and your experience at the boards?

Rory Alsop: Yeah, sure.
So I’ve been in cyber security for about the last 26, 27 years, anything to do with cyber risk.
Cyber security, information security, it’s been core to where I’ve worked.
Done that, looked after a couple of global banks, worked for two of the big four consultancies, set up a couple of my own consultancies with a real focus on detecting cyber risk.
So coming from a very technical background, I build computers, I can do all that kind of thing.
Worked with boards for probably the last 18 or so years.
I still sit on one board and I’ve sat on the National Cyber Resilience Advisory Board for the Scottish Government.
The bits that I’ve done that are technical are of almost no importance to any of those boards.
I’m happily admit it, I’m very interesting to me.
To boards, it’s very, well, in the early days it was very much
This is either terrible and terrifying.
What do we do?
Or it’s too complicated for us.
How do we ignore it?
And thankfully, over the last 18 years, things have come a long way.
And now boards are actually looking at risk.
So where I sit now when I’m talking to boards, it’s very much a case of how do I help identify from a board perspective where they need to make decisions?
It’s not so much to the how is this piece of tech working?
It’s a
Do I have the assurance that my team is putting money where it should go and are we focusing on the things at the highest risk?
So that’s very much the space that I’m working in now is helping the top of house understand where the risk should be, where the investment should go.
It does come down to those two decisions really.

Laura Oertel: Thank you.
Megan, do you want to do an intro as well?

Megan Gull: Yeah, of course, of course.
Hi, Laura.
I know we’ve met a few times before, but I started my career in consultancy, which feels like a bit of a theme around the table here, some consultant backgrounds for sure.
So I started in consultancy and then moved into industry and into banking.
I’ve been managing director at a global bank for the last few years, and I’m actually just moving over to a new organisation at the moment.
Really focused on both transformation and operational roles.
So looking at leading scale operations, but also managing the risk that comes from leading those scale operations as well.
I have quite a lot of experience from those roles in terms of actually presenting to the board and asking the board for decisions.
But I also am involved in quite a lot of board advisory work as well through my own company.
And what I try to do with my advisory company is actually help people make sure they have balanced boardrooms.
So what I mean by balanced boardrooms is actually have the right people with the right background and the diversity of background and thought leadership on their boards as well.
One of the things that I’ve seen many times is that boards can be quite similar in their mindset and as the world continues to change at a really rapid pace and actually the needs of boards are changing as kind of Rory alluded to in his introduction, making sure that actually the boardroom has the right mix of people, the right opinions and also the right experience around there is what I intend to do quite a lot in my advisory space.
And then help people who want to join boards actually think about how they can do that as well.
So I spend some time outside of my day job doing those things.
So hopefully today will be a great conversation about what we see across the boards that we all work on and with.

Laura Oertel: Thank you so much.
We have a whole array of experience here today, also in very different elements of it, which is going to make for a really interesting conversation.
So excited for that.
Just realised that the people that might be looking at the webinar later on don’t make me know who I am.
So even though we’re Redflags, if you sort of decide to embark off the Redflags journey, I’m one of the people that will guide you through that whole process.
So I’m one of the account execs here at Redflags and I come from a psychology background.
So lots of my role is really just making your
As easy as possible to have a good experience with us.
Today, as we are going to be speaking about the board, there are a few different elements.
So we’re going to first touch on just in general how we can manage the risk.
We’re going to speak a bit about how you can actually get bought buy-in because I know that’s quite difficult asking for investment, asking people to follow maybe a different lead and a different idea.
But then also how do you even communicate with them?
Good and bad news.
And of course, AI is sort of everywhere right now.
And you also said on
AI boards.
So we’re going to speak about some of the AI and what boards should really care about.
And of course, we’ll answer some of the good questions in the end that I don’t want to take up front.
So starting off, Megan, I know your experience with AI and obviously, just risk in general, boards are facing a lot of pressure at the moment.
So from your experience, what do you think they care about most when it comes to just managing risk?

Megan Gull: I think it’s a great question on obviously,
A lot of discussions across boards at the moment, particularly relating to AI.
I think I probably see three key themes across the boards that I work with.
Firstly is operational resilience.
And I think with the real uptake in AI and potentially then the changes in actually how the organisation is structured, the scalability of the organisation and the ability for organisations to grow at a pace that they haven’t known before.
Is really coming to the forefront for a lot of the boards that I work with and actually thinking about how do they set up in a way that is resilient going forward and how do they manage that risk to be able to continue when you are reliant quite a lot of the time on a third party provider for a lot of the infrastructure that’s coming with AI.
So I see that as a real core concern.
I also see a risk with AI coming from accountability and ownership.
So actually in kind of two parts of that.
So the first part being that who is actually accountable when the AI makes decisions?
Who is the person who’s doing the quality assurance?
How does the liability sit between any third parties that are used for AI implementation and AI decisioning as well?
And I see a lot of questions coming from the boards in that space.
And often
That’s where the room goes a bit quiet when someone asks a question about actually who’s accountable for that.
And I think making sure that anything that you’re bringing to a board and that you’re really clear of where that accountability should sit, where that liability should sit, etc.
Is really important.
And I think the final part, which is
Partly from the AI perspective, but also just generally as a whole, is that it does feel risky and it feels unknown.
And I think board leaders are actually quite nervous about making decisions around the integration and adoption of AI because they’re not sure
Actually how much of that is a risk and how that’s going to impact them personally in the future because being a board member does have an element of risk in itself and a liability there as well.
So those are the core themes that I’m seeing in one way or another across the board that I work with at the moment.

Laura Oertel: Yeah, that’s such an important topic as well, just on who owns the risk.
And we’re going to touch on that a little bit later in the webinar as well on when we talk about how you can actually communicate to the board.
So definitely a really important topic and something we’ll hear a bit more about today.
Rory, you obviously come from the security background.
So when it comes to measuring cyber risk, what are some of the risks that you need to measure and some of the ideas on how you can do that?

Rory Alsop: That’s, yeah, it’s very interesting.
I think what Megan said there around resilience is where cyber risk is going.
I mentioned that back in the day, it was very technical.
Now it’s, well, what’s the impact to the business?
And realistically, there’s a number of areas we can look at from how are we defending ourselves?
That is partially measurable.
Are we putting in front, what’s doing the techy stuff?
How are we managing and measuring whether we are doing the appropriate things for the organisation?
And then the assumption that at some point we’ll get hit by an attack.
How do we rebuild?
Now, all of these have very different ways of measuring and cyber risk being fairly new compared to pretty much every other operational risk.
It’s got some of the same problems that Meg mentioned around AI.
How do we model it when we don’t really have as much data as we have with pretty much every other operational risk that exists?
So boards,
Would love to have a value at risk for cyber, like they do for financial risk, like they do for currency liquidity risk.
It’s very difficult to do.
So I’ve worked with a couple of organisations who’ve done it effectively.
It’s very expensive to do, but it can be quite profitable.
A couple of examples, one global bank I worked with really needed to measure their risk.
They had a bit of a risk governance issue.
A few million building a model along with MIT and some consultancies.
But it paid off within the first year because we managed to get a realistic assessment of where is our highest risk, where is our best bang for buck to invest.
Money could be put into those spots.
Risk was reduced by a mostly measurable quantity.
It got better year on year.
When you first start doing this, you’re still pretty much qualitative.
But immediate savings and in the end freed up some over a billion in money that could be reinvested.
So that is a way of producing a return on investment calculation.
In reality, most organisations will not get anywhere near that because it takes a significant investment to do it.
So how do we get from the low, medium or high likelihood, low, medium and high impact to something you can
Manage.
I think it’s starting at little steps.
Can I measure or do I have a view of how, not so much how likely something is because these days that’s much more subjective.
Do I know if I’m going to get attacked?
Depends if someone wants to attack me.
But can I reduce the amount of impact?
Sure, I can do things that will reduce the impact to just the area that was attacked rather than the whole organisation.
Those sorts of things are quantifiable.
So we can say if
Of 10 services, if one is down, we know what that cost is because our customers pay us money for that service.
So it’s partial and we’re still in that early maturity phase, but we can do it.
We can start and boards are going, are we investing in the right areas to reduce the risks where we can?
So even if I’m looking at 10 sets of risk reductions and one or two are quantifiable at this current stage, that’s enough to start that
A bit of assurance that the board sees that we’re on a journey.
Again, as we’ve mentioned, they’re quite conservative, they’re quite averse to making decisions in a vacuum.
So starting with some progress and continuing that progress, it sounds simple and basic, but it does work.

Laura Oertel: It is certainly possible. I like being in a sort of Human risk management space or more the secure behaviour management space where we’re sort of moving into now.
It is possible to measure where you are and where you can be, but I know it is quite difficult to get that first step in sometimes and even to get bought by in for that, but we’ll touch on that in a little bit as well.
Mary, when we spoke in the preparation, you looked at this from a slightly different lens.
So you looked at this from the more strategic and commercial lens as well, which I thought was really refreshing.
So obviously, in your opinion, how do you think that boards can best balance risk, but also innovation?

Mary Keane-Dawson: Well, I think it’s fundamental that they are using
These narratives about the, actual what they’re doing as businesses in terms of how they’re managing this complexity and this, multiple unknowns, right, in a strategic way that differentiates them from their competitors.
Because fundamentally, ultimately, boards are
Looking to see growth.
Wherever that growth will come from, that’s what they’re there for.
That’s the business’s success metrics are always going to be based on profitability, on performance, on impact.
And I think that given the economic difficulties that are happening everywhere, we’re not the only place that’s got a cost of living crisis, is that the strategic
Implementation of actually, which is integrated across multiple disciplines within the organisation, I think is actually fundamental in this period of time.
And the reason why I say that is because everybody I’m speaking to, whether it’s a global platform or it’s a retailer in Europe or telco,
They’re all struggling to maintain a kind of a narrative that to the consumer, as well as to their supply chain, that actually retains, is consistent and is on message.
And I think this is a new challenge, a bigger challenge probably now than it was during the pandemic, because there’s so many unknowns and surprises that are coming.
Who knows if the straight home use will be
Close or open tomorrow.
No one does.
This is part of the problem that is affecting us all as consumers, as human beings, but also our businesses and the strategic direction they take.
So communication, I think we’re touching on that later, but communication internally and also personal brand and how you as a board member are coordinating with your other board members is really important.
It can’t just happen in that room during the five hours or however long you’ve got that boardroom occupied for.
You need to have really good sound information being provided by your SLT or whoever is writing the board packs.
You need to know that what the position of the CFO is with regard to investment decisions, what those processes are.
And I think that it’s more pressure on board members now
Than ever to be extremely aware of the whole business, not just the bit that they think that their subject matter experts in, because that’s gone, I think.

Laura Oertel: And that also leads us perfectly into the next point of just, getting the board buy-in because you’ve all managed so, valuable inside, but it’s difficult to then getting the board buy-in to communicate with them because it is, you’ve all sit on different boards.
And Megan, why would you say it’s, how can you elevate your comms to the board to make sure that they know what you want from them, but also make it really efficient so you actually get what you need?
Are you on mute?

Megan Gull: Sorry about that.
So the thing I always say to people around communicating to board is that it is different to communicating to your manager.
It’s different to communicating in your executive role.
So people who are doing their first
Board positions need to recognise that there’s a change in what is required when you’re talking, when you’re on a board, what information you want, but also what information people should be providing you.
And there is a recognition of a change.
And that change is very similar to what Mary was saying is that as a board, you are assuming that the senior leadership team have done the thinking.
That they’ve done the work in the background.
And what you’re really looking for in that communication is a couple of things.
You’re looking for them to lead with what is the outcome.
And what is the answer to driving that outcome?
Yeah.
When I’m in my exec role, I’m asking people to show me what their thinking is, how they’ve got there, what the options they looked at, etc.
Fundamentally, though, what I’m asking someone in a board role when I’m in a board role is I’m asking, what is the outcome that you want to drive?
What is going to change?
And how are you going to get there?
And if you think about all of your communication focused from that point and then down into the detail, it changes the emphasis that you put in that communication.
Okay.
And what I mean by that is you really need to translate what you’re doing from action to outcome and what that outcome is that is relevant to the board.
I think it was you, Mary, who said board’s about making money and growing the business.
Yeah.
So fundamentally, in my experience, yes, one is growth.
Revenue, profitability, shareholder value.
So what you’re doing, how is it going to influence that?
Secondly is around risk.
We opened this conversation talking about risk.
How is what you’re doing going to impact the risk of the organisation as a whole?
Okay.
Then there will be other outcomes that will be, will vary depending on the strategy of the organisation at the time.
But if you start with those two, you’re not going to go too far wrong from where you want to go.
So focus on the outcome.
Focus on what action you’re going to take and come with a recommendation.
Come with a recommended approach.
You might need a decision, you might have different options, but come with a recommendation that shows your thinking and shows that you’ve actually done the work that gets you to that recommendation.
So I think if you think about
Having that conversation in that way, you’re a lot more focused on the things that matter to the board and you’re not more focused on the outcome, which is fundamentally where you need to start.
And I think the other point that Mary made around the kind of syndication outside of that meeting as well, if you really want to communicate well, you need to be communicating outside of board as well, not just in that board meeting.

Laura Oertel: Absolutely.
I think that’s really actionable advice that people can take away after they finish this webinar today on just things you must do before in order to make sure it’s really effective.
But also something that Rory and I touched on our preparation for the webinar was that boards are just reluctant to be the first ones to try something.
And obviously Redflags, we are one of those organisations that’s sort of trying to break the mould of saying phishing simulations maybe aren’t the way.
There is a different way of approaching it and this is what it looks like.
And to get the
The board to buy into a new strategy that nobody, well, often people haven’t heard of before, can be quite difficult.
So Rory, from your experience, what’s some of the advice that you would give to someone who is trying to try a new approach and get leadership buy-in for that?

Rory Alsop: It’s A chunk is around that confidence piece.
I would absolutely support the outside the board meetings, get the one-to-one meetings in.
So I tend to try and do a
Week before a pre-meet anyway, but there should be continuous communication to help them understand the journey.
The other piece that helps is if I come to a board with just something that I’ve produced, there is a risk that will be seen as my opinion.
And if you’re a board member and you’re sitting there with an element of personal risk,
What do I need to do to convince you?
So things like taking benchmarking data, taking industry data, taking equivalencies from peers or competitors and highlighting where, again, outcome focused, if we do this, will we be in a better position than that competitor?
Or if we don’t do it, are we lagging behind peers in industry?
So there’s opportunity to take industry bodies,
Cross industry data, professional organisations output to support what you’re doing.
Or if you’re working across a group of companies or for private equity owned organisations, they will usually have a view across the group.
So where do we rank within that group?
Are we in a good place?
Do we need to do something different?
Generally, there’s not a hard requirement to be at the head of it.
But if you’ve seen, generally, when you look across business, people go, I want to be the leader, but I want to be in the pack.
And that’s a general safe place for a board.
If a board is being a little bit edgy trying to do something different, they might want to go further ahead.
But very rarely will you get someone who says, oh, I want to be behind the pack.
I’m comfortable with that personal risk.
So
Having that benchmarking data just helps.
It gives you something to fall back on to say, we’re doing this, it matches up what they’re doing, so you’re safe as a board for considering this decision.

Laura Oertel: Thank you.
Yeah, very much about building up that confidence then.
I suppose that’s something for in the board meeting, but also before as well, because we talked about just the interpersonal relationships a little bit during the conversation already.
So Mary, just from
Building that buy-in and getting to know the people.
So when you do get the few minutes in that long day of a board meeting, how can you make sure that people are not having that many questions coming back so you can really use that short time most effectively?

Mary Keane-Dawson: Well, I always advise people to keep the anecdotes at the door and don’t sort of just try and be a nice person because I know that you’re a nice person from the other interactions I have with you.
We’re here for 4 minutes.
You’ve got, that’s what you’ve got my attention for.
Please keep it simple, straightforward and do not write war and peace and expect me to read it because what I want to understand, and this is very important and does both what Megan and Rory have said, is I want to understand this very easily.
Please don’t make it difficult for me.
And I think that is often a mistake that people make when they write this very long, I’ve done the work, I’m showing you I’ve done the work.
That is not what I need to know.
I’m assuming that you’ve done the work.
That’s what you’re being paid for.
I want to understand what it is that we’re dealing with here and where the output, how do we achieve this outcome
Because it is all outcome oriented.
I also find, and this is just when you’re asking for money, right, to Rory’s point, when you’re asking for investment, to Megan’s point, it’s really important that you give the equation, right?
And the bound, and where you think it’s, there is a downside and where there is an upside.
Because that’s the risk profile, essentially, that we’re looking at.
And I do a lot of work in new product development and taking go to market strategies.
And it’s not, we know they’re going to love it.
That isn’t
That isn’t good enough now.
That’s never going to be good again, I don’t think.
It’s all about what is going to give us this advantage in the marketplace, but also understanding how we mitigate any investment that we’re making and that we’re taking an approach that will prove
Be proof of concept, will be proof of market fit.
And you’ve got to be pretty scientific about this stuff.
I don’t think that you can do anything just purely in a qualitative basis any longer.
I don’t think boards will accept it any more.
And in my humble opinion, that’s probably right.

Laura Oertel: Yeah, absolutely.
So very much being a bit more data-driven on that as well.

Mary Keane-Dawson: Much more.
Laura Oertel: I think that’s certainly an advice that I’ve taken back from this because I like to write reports maybe a little bit longer than they should maybe be. So that’s certainly one of the actual points that I’ve written down from this.

Mary Keane-Dawson: I definitely think that you will meet and you come across CEOs and CFOs who really love the detail, but the vast majority of board members are
They are, they know they’ve got a huge amount of work to get through and they’re going to be fully engaged, but they need to be able to make, they need to be able to read stuff that makes sense and that they can make a decision based on it rather than thinking, whoever wrote this is a brilliant writer.
That’s not what they’re there for.

Laura Oertel: Yeah, that’s a really good point.

Rory Alsop: Literally 4 or 5 minutes on a topic.

Mary Keane-Dawson: Yeah.

Laura Oertel:
Absolutely.
And I think that brings us perfectly to the next topic of just how do you communicate to the board and in the good, but also in the bad.
So I know earlier in the conversation, we talk about risk ownership and who owns the risk and what does that look like?
So when it comes to just communicating some of the particularly, maybe not always the greatest news, how would you recommend you do that, Rory?

Rory Alsop: So a good chunk of my roles over the past
15 years or so had been specifically around this.
So a couple of the big banks I work with start off with cyber governance problems.
So my role was to come in, work out how to fix that.
And the core problem that they had was that cyber risk was typically owned by the security team, which is, security teams are typically a cost centre.
You spend money, you make some controls better.
Key outcome was, well, senior leadership should own the risk decisions.
In fact, the board should own the overall appetite for an organisation.
So they can advise on, are we comfortable that you are hitting your risk appetite?
But senior leadership owning the risk decisions around, are we trying to expand so we’ll take a bit more risk?
Are we wanting to consolidate a bit, want a bit lower risk?
Are we regulated heavily?
With security teams typically being tasked with, you make the controls, here’s some budget,
You put in the controls and if you need to make more controls, you need to improve them.
If you need more budget, you come back up to the owners of that risk.
If that’s done correctly, it makes escalation and oversight a much easier decision because board and student leadership don’t need to worry about what the actual controls are.
They don’t worry about the detail, what’s down in the weeds.
They need to know, are we above or below our risk appetite?
Has a trigger event happened that means we have to reconsider our appetite?
Again, are we keeping pace with industry?
Or is part of our business taking too high a risk?
Do we need to do something about that?
So that decision can happen between senior leadership and board.
And typically the outcome is we’re comfortable with it or no,
We’ll approve some more investment in that area.
And I think as Mary was saying, then they assume that the clever people are going to go away and do it.
They don’t need to know the detail.
The assumption is the people in the business will have a handle on that.
So it’s that ownership in the various layers of don’t put the ownership of the risk on more junior folks who are just implementing.
It’s not their place.
They know how to implement a control.
The assumption is that they do, you can measure that.
Keep all ownership at levels where the ownership decision can be made.
And it’s typically at that budget decision level.

Laura Oertel: Yeah, but I suppose that also sort of gives the question of how do you measure the return on investment?
Because I’ve seen full function of awareness professionals being let go because there was no incident.
Therefore, if nothing happens, it’s always a good sign.
But what do you spend the money on if nothing happens?
So
Yeah, it’s quite difficult in security to communicate and measure that return on investment.
So how do you recommend you do that?
How did QCNOT work best?

Mary Keane-Dawson: So I’m not butting in a hope, but you need a paper trail, right?
And you absolutely have to record what you’re doing.
Because that is what will get you out of the really awkward situation with regulatory compliance.
It’s also a really fundamental part of the role that, we know we’ve done this because we’ve got the evidence.
And unfortunately, whatever your views are regarding the increasing regulation that we’ve all experienced in our careers,
Right now, there are so many actions being taken, it’s our tobacco moment, whatever you want to say when it comes to social media, right?
The consumers are, there’s a lot of distrust amongst consumers and corporates.
And I go back to the point I made earlier.
You need to take this stuff really seriously because it is your point of differentiation as an organisation that you are keeping your customers’ data safe.
You are acting in a responsible way to society.
And as a business, you can show that you have taken
And lowered risk at all points.
And that as a board member is my expectation of the senior leadership team and their teams.
And they need to have those waterfall processes and organisational structures that allow for that to, because it’s not about looking after me, it’s about looking after our organisation, our employees’ jobs and our customers’ futures.
And that is the big picture that I think we all
Into in British businesses, but I particularly feel this is very important in terms of, offering our differentiation and our ethical approach to corporate governance.

Rory Alsop: That area, I think there’s almost the two bits, there’s the how we do that, we are reducing risk appropriately.
There’s also elements where you do get direct return on investment and they really help the message.
Having been through a couple, things like, as you say, regulatory pressure can be annoying to some folks, but it can drive some very good behaviours.
And things like the industry I’m currently in, so I’ve moved from financial through to the energy industry, and SOC2 certification is a door opener for some of our customers.
Without it, they just will not buy.
NIS2 is going to be more like that.
In the not too distant future, even the EU Resilience Act, if you’re not hitting that, are you going to get to those big customers who sales might have a regulatory requirement on it?
So things like that, it’s a door opener.
So sales are very focused on that.
So your budget for it can come out of your sales process, which makes life a lot easier from, this isn’t security, it’s enabling sales.
Great.
One of the pieces of work I did a couple of years back was around phishing testing.
And doing AB testing.
So one group got nudges before the exercise and the other group didn’t.
And we saw about a 40% uptick in.
In response speed and response accuracy.
So as far as our board was concerned, that’s great.
You’re showing 40% better behaviours immediately.
Very quantifiable.
Okay, it’s just one aspect, but it worked very well for us at the time because we know that we want to get our phishing response.
All organisations want to improve the phishing response, right?
If you can respond faster, you reduce your impact, you reduce your risk.
It’s fairly straightforward for boards to understand.
So you have things like that are dotted about organisations where you can say, there’s a direct
Return investment.
Cool, we’ll bank that.
But all the rest, as you were saying, Mary, I think has to come from the we’re doing it to reduce our risk overhead to a position where senior leadership and board and customers are comfortable and regulators and auditors and all those folks as well.

Mary Keane-Dawson: Yeah, because the last thing any CEO or C-suite exec, wants to get involved in is the crosshairs of, a class action or any kind of, scandal.
And that is genuinely a concern because it absolutely impacts on the share price, it impacts on your customers, it impacts on your partners, et cetera, et cetera.
So, it’s really important to understand that narrative needs to be about optimising opportunity, but at the same time ensuring that we are keeping everybody safe.

Laura Oertel: Yeah.
That’s really important.
And I think, from just the what you can bring to measure a return of it or just the success of it, or even to say, actually, this might need some extra support.
From just the board view in general, Megan, I know you said on some very highly regulated boards and have a lot of experience in that area as well.
What are some of the things that you would think a board would really care about from their perspective on is it more risk reduction or is it more the revenue protection or what sort of their focus?

Megan Gull: So I think, Laura, kind of leading very much on from the conversation that Rory and Mary just said, what I expect the board to ask is what’s actually changing.
So rather than just ROI, yeah, it’s actually what’s going to change as a result of what you’re doing.
So that’s what’s going to change from a finance perspective, but also what’s going to change from a risk perspective, what’s going to change from a regulation perspective.
So be prepared in your
Conversations with the board to be really clear on where you are now and how that’s going to change in the future.
So why should they approve this?
What’s the risk of approving this?
What’s the benefit of approving this?
So it’s very tempting to focus and I think potentially historically it was very much focused on
You spend X dollars and I want to get Y dollars back.
Now people are talking a lot more balance.
There’s a lot more balance and lots more risk being taken into account, particularly in regulated industry, which we’ve got a lot of experience from in this call, is that actually the board are not just focusing on the dollars.
Whilst that’s a primary metric, they do want to understand the risk of that, but the broader impact because they’re thinking the longer term impact of
Risk decisions, regulatory breaches, concerns that they have in this space.
So always be prepared on that question of what’s actually going to change for the good and the bad.
And then if something is going to change from bad, what’s the mitigation that is in place to do that, to stop that happening and making sure they have all the right information to make that decision at that point in time.
The test for me, really, when I’m looking at a presentation from a board decision is actually, do I have all of the decision making there in front of me?
Yeah.
So we’ve spoken about data.
Do I have the data?
Can I stand behind the data?
Do I understand the upside, but do I also understand the downside and the risks around it?
And not being too wishy washy with that.
Be very clear, be very specific in that communication.
Someone once told me,
To write a broad paper as though you’re writing it for a 10 year old.
Yeah.
And I don’t think that’s a bad place to start.
A lot of times you read these papers and it’s using some fantastic language that I then need to Google what the words mean.
Yeah.
And there’s a lot of words in there, but fundamentally that’s wonderful and I’m really great.
Someone’s put a lot of time and effort into writing that paper.
But what I really want to do is do I understand it?
Yeah.
So keep it simple, keep it data led.
And keep it focused, as I said before, on those outcomes and balancing the good and the bad in those outcomes.

Laura Oertel: Yeah, that’s really good.
Thank you.
And I suppose that leads into the next question for Mari on just how you can communicate bad news as well because it is the data-driven element of it.
But we talked about it when we had our chat before the webinar on you need to also communicate bad news, but how can you make sure you still have your job after that?

Mary Keane-Dawson: The whole point of being effective is to, is that you’re consistent and, your brand needs to be about how you are not, you’re not here to sell the board something.
You’re here to give them, like the information, the recommendation and the context.
And I think, this last 18 months in particular, I’ve probably used
The expression, the mood music has changed.
Probably every day when I’m talking to clients and to
The C-suite and I’m advising them about what’s going on, because it is, it’s changing all the time.
And I think that actually you can use that as the context.
It’s quite simple.
We are living in a time of great change, huge instability in a lot of geopolitical sense, certainly.
And I think that is the way that you can contextualise.
Everything is about framing it, okay?
And don’t be afraid to frame the reality of the situation.
Because, believe you me, board members do not want to be told something that isn’t true or too optimistic, because that is a tendency, unfortunately, that’s where that transition that Megan mentioned from being, like an exec where you’re leading the team and you’re going, rah, rah, let’s go, go, to actually being in a really senior, responsible, position where you’re directing, you’re part of the team that are directing
In the direction, if that makes sense, of where this organisation is going to land up.
And that brings with it great responsibility, but it also brings a need for absolute clarity about the facts and the recommendation and why that recommendation is being made to you as a board member.
Because it’s not about being sold to, it’s actually about being confident.
And that’s different.

Rory Alsop: I think the boards are supposed to would far rather see a red finding and know there’s a plan to remediate than everything’s green.
It’s the openness and honesty and transparency I think that matches with your personal branding.
You have to be trusted by the board in order to deliver appropriately.

Laura Oertel: Absolutely.
I think that some of the sort of elements that we see with AI at the moment, lots of organisations just go for it, sort of one eye closed, hoping everything goes well.
And certainly from what we see in the market and some of the organisations that often run trials with us, they use AI, they don’t know what people are actually using or doing on it.
AI agents being downloaded, there’s policies in place, but
We can tell people aren’t following them.
So the overconfidence from some organisations when it comes to AI is potentially a bit of a bigger risk.
But now that I have you here from the security lens, but also the AI lens that you guys and from the boards that you’re sitting on, Maury, obviously you being a CISO as well, what are some of the risks when it comes to AI that you think boards should be aware of and what some of the governance that should exist around it?

Rory Alsop: Yeah, so probably three separate areas around AI.
So externally, AI is used to attack.
So that could be for speed of attack.
It could be attackers looking at compromising our AI, which is a separate fun issue and prompt injection, all that good fun stuff.
So there’s a strong element around the CISO world where we’ve got to protect against attack.
So that kind of goes without saying, but I’ll get onto why it’s a little bit more complex in a second.
Is that what can I do to defend using AI?
So I can ramp up my speed of response, I can ramp up my speed of understanding what vulnerabilities I have.
That leads to some serious resource requirements because we discover more bad things about an organisation.
Those 2 are pretty much in the old school CISO space though.
It’s just an acceleration.
Those aren’t anything new.
The big challenges around AI governance.
So where we’re using AI models, developing our own models or using other people’s,
The regulation is coming.
The EU AI Act is there.
This is new space for everyone, as we’ve mentioned.
So everybody’s learning along the way.
Your Anthropics, Open AIs, and so on.
They’re having their own governance issues.
You’ve seen various breakouts back in June, where they failed to protect them with sandboxes and guardrails, and they went back and attacked other organisations.
So as a user of AI, my company, we’re looking at, well, we don’t want to be in the news for that sort of thing.
So
Yeah, we’re looking at how do we control, how do we enable an AI to make decisions while not letting it run amok.
So almost restricting the number of outcome decisions, specifically what used to be called stored procedures back in the old database days.
Here are some things that can be allowed to do.
So even if it makes really weird decisions, there’s a known set of outputs that could happen.
So you’re minimising your risk there.
The bit that always concerns me is that kind of model creep.
How do we ensure that our model remains, while developing with us as we grow as an organisation, how do we ensure that it’s not biasing inappropriately?
As a supply to the energy industry, we use AI for things like prediction, forecasting from the weather, looking at load balancing across multiple countries and so on.
So
We need to make sure that it’s always going to be traceable.
Now, when AI first started coming through, machine learning to AI, we can audit it.
Now we’re getting more into agentic AI.
How do you audit it from end to end?
How do you know that it’s making a decision which is appropriate?
In a previous organisation, our concern was, is it making decisions about a product given to a vulnerable customer, for example?
That’s a huge no-no.
In my current world, is it going to do something that might turn off power stations?
Are we in that space?
So where the EU AI Act starts to rank by criticality, there are some absolutely prohibited.
And so how do I, within the organisation, look at that?
I need a registry of everything that we’re doing with AI.
How do I know everything we’re doing?
Because we buy products that might now have AI where they didn’t before.
Yeah, you’ve got to be aligned with your procurement team.
You’ve got to be aligned with supply chain management.
You pretty much got to be aligned with every part of the business and keep on top of that whole shadow AI piece.
In the past, you had shadow technology.
Things would be built by teams without you knowing.
Shadow AI creeps in without even the teams using them knowing.
So this is a big concern and it’s a resource hog trying to make sure you’re on top of it.
But it requires structure, it requires ownership, and it requires ownership right at the top.
And you’ve got to be aligned with all other parts of the business.
So I chat with legal counsel probably three times a week at the moment on AI topics, because it’s not just a security issue.
It’s an everything issue.
It could be an existential issue if we get this wrong.
I’m sounding very paranoid and pessimistic that I’m really not.
I’m an optimist.
I think we can do this very well.
But it’s a new challenge and it’s very fast.
So it’s
It’s that eternal battle of have we got enough resources?
Are we scaling up at the correct rate?
And that’s another board discussion.

Mary Keane-Dawson: I’m a chair of an AI business.
And one of the things that my job is about is really about asking very difficult questions around these subjects and these topics in particular.
And I think that’s one of the really important cultural points that companies that are embracing artificial intelligence, even if it’s just at an operational level, but equally when it’s innovative.
New products and services that you’re taking to market.
And that’s increasingly becoming the case with, and as you mentioned, Aerogenic, all of the advertising, media and tech sector, creative tech sector that I’m very involved with, that’s what’s happening right now.
You’re seeing AI being incorporated into all manner of new products and services.
And there’s a, I think there is now more than ever a requirement on
Boards to have an independent director who is asking difficult and questions around AI, not because they’re trying to catch anyone out, because exactly the opposite.
Then making sure that we are doing, as Rory was describing there, we actually, we can’t audit this anymore.
It’s not going to be possible in the way that we originally thought we could.
What we have to do is have means by which we are approaching the adoption of AI, whether it’s in innovation or in processes
Or in cost cutting or whatever it might be that are acceptable with the organisation culturally.
And as I was saying, keep us all safe because you can’t have one rogue like, anthropic or ChatGPT, like, oh yeah, well, I just threw that into the mix and didn’t tell anyone because that’s where the trouble will start.

Laura Oertel: Yeah, absolutely.
And I… please go for it.

Megan Gull: I interrupt you. I was just saying, I completely agree, Mary, and I think what I’m really seeing is organisations, some of them are still treating AI like a tech problem.
Yeah.
And it isn’t a tech problem.
Yeah.
It’s a decision making, governance, compliance, security problem.
And I think
Having that independent person who isn’t so focused about, well, we must have AI because all our competitors are using AI and we must be able to scale more quickly, et cetera.
Having someone who asks those really difficult questions is increasingly important, but it’s not necessarily what we’re seeing across all boards at the moment.
And definitely an area of focus for me in terms of making sure that you do have that independence on people’s boards to really think about that.
I think what worries me with AI is very similar to what you said, Rory, is like the answer to a lot of the questions are, well, we have a framework or we have a policy.
Yeah.
And then what I’m really looking for is someone on that board to ask the really difficult questions about actually how have we tested that?
How have we, what is our ongoing plan to test the resilience, the control, the security?
Yeah.
Will it pass the scrutiny of the regulator?
Yeah.
Not just does it pass our own internal, like really will it
Mentally stand up to the scrutiny and are we keeping it up to date because what’s happening today is not what’s happening tomorrow in the world of AI.
And I think having that independence on that board is so, critical in making that happening and changing it from a tech conversation into that compliance decision making.

Mary Keane-Dawson: Absolutely.
I was very fortunate to be able to take a couple of years off mid-career and I went and did a
A master’s in corporate governance and ethics.
And I never, I was just fascinated in it because I’d done philosophy at university.
So I was kind of just like doing it for, this is interesting.
And now, it’s the application of these types of, as you rightly say, it’s no, this policy of have we got a policy, tick the box, great.
That’s not enough.
No way is that enough in this, because that’s where you will come unstuck.
So if you’ve got a policy, you need to make sure that it’s actually being implemented and you can evidence it.
That’s really important.
I think that’s a piece of advice that I would give any exec, any senior exec, but also the board will ask you those questions.
They need to.

Laura Oertel: I think that’s quite difficult to evidence as well.

Rory Alsop: Yeah, hooking in ownership and accountability at senior levels does get a focus on it.
AI, it cannot be allowed to own a decision at the end of the day.
So where does that decision sit?
Is it with the person who coded it?
Well, that’s too junior.
So there’s got to be a level of seniority.
And as I say, that does help people get focused on it.
Gaining or getting people trained up in AI
In legal, in technology, in the various areas, even in potentially in sales functions or general management, so that they are aware of the types of things.
Because when you mentioned ethics, that’s a huge part of the corporate governance piece around AI, because do we know that it’s going to follow the right ethics?
Because very few of us have built our own AI models.
So what was the training data?
Is it actually going to adhere to what we think, or are we just being lucky at the moment?
So there’s a lot of unknowns, and that’s what I think senior leadership and board need to be aware of so that they can make the decision around how risky is this?

Megan Gull: I had a great comment on board I was in a couple of months ago, which you really reminded me of there.
They asked who was the risk owner and the room went quiet and they said, oh, after about a minute, they said, oh, I think it’s Sandsay.
And this Ned said, if you can’t name the risk owner in 10 seconds,
It’s oversight, not accountability.
Yeah.

Mary Keane-Dawson: Exactly.

Megan Gull: And I thought that is, that’s the kind of expectation I have on board now and what I’m seeing, yeah, is they really want to know who has actually looked at this and who has really seen it, seen it through and who is taking responsibility for it.

Mary Keane-Dawson: You’ve got to, and if you want to make yourself
Friends in high places, then, become, get involved and share papers that you’ve read or, even if it’s or a summary or whatever, this is very important because you’re then seeing yourself and being seen as someone who’s aware of what is going on and they are aware of the risks that the non-execs and the directors
And the board members are, up against.
And I think that’s very important.
It’s not about scaremongering.
It’s just about the reality of the situation that we’re in, because there are so many unknowns.
And I totally agree with Megan, what you said there about if they weren’t able to say immediately who’s responsible or who’s accountable or who’s, who’s actually taking responsibility for this, that would be a really big red flag for me.

Laura Oertel: I think that’s part of it. Just ticking the box isn’t good enough. You need to know in practice what does that look like? What does actually, what are some of the blind spots and what can we do about it?
And I suppose that leads us to really the end of this webinar where we said it before, but if you join other webinars about the board, it’s often speak the board language.
And I think that’s really great advice. But What is this board language?
Well, how do boards speak? And I think today, if there is anything people can take away from the school, then it must be on how they can communicate with their boards.
So in just a few sentences, really, how would you guys say the language of the board?
Megan, do you want to kick us off with that?

Megan Gull: Thank you for let me go first.
It gives me the easy job.
Thank you.
Look, for me, it’s always outcome.
Yeah.
Translate your effort into outcome.
What’s actually happening.
Boards don’t want to talk about activity.
They don’t want to talk about tasks.
They want to talk about the outcome, the risk, the return and the accountability.
So if you focus on that as your starting point, everything else should follow naturally from there.

Laura Oertel: Thank you.
Rory, what about you?

Rory Alsop: Keep it simple.
I’m a techie.
If I use tech language, I’ll immediately turn the board off.
So try and keep words under three syllables is always a good start.
Pitch for a 10 year old, I like that.

Laura Oertel: Thank you.
Mary?

Mary Keane-Dawson: Thank you for leaving me the hard one.
I absolutely agree with what Megan and Rory said.
I think the most important thing is to be seen as someone that your information that you’re providing is balanced and you have looked at things in the round.
You’re not just putting three or four bullet points saying we’ve done really well, we’ve had loads and loads of leads, Jen, and we’ve got lots and lots of opportunity.
You need to be really specific
And also evidence to me that I should support your recommendation.

Laura Oertel: Yeah, thank you all for taking your time today.
I know I’ve mentally jotted down quite a few
Things that I want to take away from today.
So I hope all the audience joining us later on as well is going to feel the same way.
So for me, certainly everything you do before you come to these conversations, so build that personal relationship with them before, make sure they get all their questions out.
And so when you do get that time in front of them, there’s no questions left.
They know what you want from them and what the outcome is going to be and be a bit more data focused on that as well.
So thank you so much for taking your time.
It was a pleasure to host you here today.
And if you have any other questions, there’s going to be more information on that on our redflags.io website, or you can obviously get in touch with us on the get in touch form.
So thank you everyone.
I hope you have a wonderful rest of your day.
Thank you.

Mary Keane-Dawson: Thank you, Laura.

Rory Alsop: Thank you.