How UK boards and CEOs differ on cyber risk

Shared growth ambitions leave readiness questions open

A board and a CEO can agree that growth comes first yet judge the business’s readiness differently. Eton Bridge Partners’ Board & CEO Insights Report 2026 finds this pattern among UK leaders: shared ambition sits alongside different views of cyber risk, preparedness and the speed of action. These assessments show where leaders’ understanding of the business may differ.

To examine those views, Eton Bridge Partners surveyed UK Chairs, Non-Executive Directors (NEDs) and Chief Executive Officers (CEOs) across listed, private equity-backed and privately owned businesses. Just over half of respondents, 52%, said growth was their organisation’s leading priority, with little variation across the three ownership categories. The objective is widely shared, but delivering it requires decisions about which risks deserve attention and how quickly to respond.

Cyber priorities and confidence in action differ across roles

Cybersecurity shows the largest gap in risk priorities in Eton Bridge Partners’ survey: 38% of NEDs placed it among their top three risks, compared with 8% of CEOs. This ranking reflects how respondents weigh competing concerns. CEOs may regard cyber as serious while placing other risks higher, whereas NEDs may give greater weight to disruption affecting operations, customers and supply chains.

Each role’s responsibilities offer a possible explanation. Directors oversee the business, while executives run it and deliver its plans, so they may assess the same exposure from different positions. Eton Bridge Partners suggests that NEDs’ oversight responsibilities may explain their greater emphasis on cyber. For a board discussing its priorities, the useful question is how those responsibilities shape risk choices and the decisions that follow.

Priority is only part of the discussion, because leaders also differ over whether key risks are being addressed. Almost three-quarters of Chairs said their board was addressing most key risks, while fewer than a third of CEOs agreed, according to Eton Bridge Partners. CEOs were also around five times more likely than Chairs to say action was failing to keep pace with risks. The answers raise separate questions about the response’s breadth and speed.

These response findings concern risks generally, whereas the earlier ranking concerns cybersecurity specifically. The groups differ too: the cyber comparison is between NEDs and CEOs, while the coverage and pace comparisons are between Chairs and CEOs. Keeping these distinctions clear gives each finding a purpose. Leaders have three separate questions to discuss: which risks matter most, whether the response covers them and whether action is fast enough.

Olivia Sharp, Head of Board Practise at Eton Bridge Partners, sees these differences as a concern about how boards and executives pursue shared ambitions. The firm’s Board Practise gives it a commercial stake in demand for board-level expertise and stronger board capability. Sharp explains the firm’s interpretation of its research, including its findings on artificial intelligence (AI):

“While Boards and CEOs share the same ambitions, our research reveals significant differences in how they perceive risk, capability and progress. These gaps matter because when Boards and executive teams disagree on the risks facing the business or the pace of action required, it raises questions about how aligned they really are.

“Cybersecurity is a clear example. Despite the current focus on AI, our research suggests NEDs are more alert to cyber risk than their executive counterparts. Understanding these differences is key to ensuring risks are properly prioritised, understood and managed at the highest level.”

Sharp’s interpretation focuses on how different judgments affect decisions. A board can explore this by asking directors and executives to explain their risk rankings before discussing whether the response is adequate. Coverage and pace need separate attention, because a risk can receive substantial board attention while executives remain concerned about gaps or delays. Differences rooted in oversight and delivery responsibilities still need examining wherever they affect action.

AI raises a separate question about board contribution

The AI findings move the discussion from risk response to the board’s ability to contribute useful judgment. Eton Bridge Partners reports that only 9% of respondents named AI as the single biggest threat, yet 52% identified AI governance as the board’s greatest area of exposure. AI governance means overseeing AI-related decisions and establishing who is accountable for them. The responses therefore address different questions: a threat’s urgency and the board’s ability to oversee it.

Those questions can produce different answers because a respondent may see operational or security risks as more immediate while remaining concerned about AI oversight. The cyber and AI rankings also use different thresholds: cyber was assessed among respondents’ top three risks, while AI was assessed as their single biggest threat. Comparing the percentages directly would mix two measures. The AI governance finding stands on its own as an assessment of where board oversight is vulnerable.

The capability concern becomes more specific in a further finding: only 8% of respondents believed their board currently added meaningful value on AI, according to Eton Bridge Partners. This measures how respondents judge the board’s contribution to decisions. Eton Bridge Partners interprets the combination of perceived exposure and limited perceived value as a concern about oversight and decision-making capability.

For boards examining that concern, the next step is to define a useful contribution. Directors and executives can then discuss how they assess the judgment and oversight provided today. This focuses the conversation on the board’s role in AI decisions while keeping two tasks separate: improving its contribution and deciding where AI belongs in the organisation’s threat ranking.

Succession shows where leaders already share an assessment

The differences over technology risks sit alongside closer agreement on succession planning, or preparing for a change in leadership. Eton Bridge Partners found that Chairs, CEOs and NEDs answered within only a few percentage points of each other on this issue. The groups can therefore assess one governance problem similarly while differing on another, which makes the subject of each disagreement important.

Within that shared assessment, Eton Bridge Partners found that 30% of respondents identified dependence on the current CEO as the main obstacle to effective succession planning. A substantial minority shared this concern, and the similarity across roles offers common ground for discussion. A board can use that agreement to examine how reliance on the incumbent affects its ability to prepare for a leadership change.

Preparing for that change requires leaders to make the dependence specific. Useful questions include which decisions rely on the current CEO, what knowledge would be difficult to transfer and who could assume the relevant responsibilities. These practical prompts follow from the finding and aim to turn a shared concern into decisions about succession preparation.

Key takeaways for leaders

• Separate risk priorities, coverage and pace: Cyber ranks among the top three risks for 38% of NEDs and 8% of CEOs, while Chairs are more confident than CEOs that key risks are being addressed. Boards and executive teams need separate discussions about risk rankings, response coverage and the speed of action.
• Define the board’s contribution to AI: AI governance is the board’s greatest exposure for 52% of respondents, yet only 8% believe their board adds meaningful value on AI. Directors and executives can define the judgment, oversight and accountability they expect from the board, then assess its current contribution.
• Turn succession agreement into preparation: Chairs, CEOs and NEDs broadly agree on succession challenges, with 30% of respondents identifying dependence on the current CEO as the main obstacle. Boards can use that common ground to identify CEO-dependent decisions, knowledge that needs transferring and people who could assume key responsibilities.