Pat Niemann is the Audit Committee Forum Leader and a Leader of the Center for Board Matters at EY. This post is based on his EY report.
Public disclosures reveal how leading boards are overseeing AI and cybersecurity
In today’s fast-changing and high‑stakes digital environment, boards are elevating their oversight approach. Voluntary disclosures around AI and cyber are not just more common — they’re also more robust, doubling in scope across several critical areas.
Companies are putting the spotlight on their technology governance, signaling an increasing emphasis on cyber and AI oversight to stakeholders.
In the past year, according to company disclosures, the increased sophistication of cyber threats has prompted companies to enhance their cybersecurity defenses, while adversaries have also advanced their attack methods. Ransomware attacks rose by over a third, and generative AI (GenAI) — rather than traditional AI — is emerging as a key feature of the threats, often in the form of deepfakes, and the company response.
Deepfakes are just one example of threat actors’ using GenAI for malicious purposes and are now the second most common type of cybersecurity incident, behind malware.1 However, some argue that today’s biggest risk is the loss of sensitive company information when employees use unapproved AI services.2
One recent survey of full-time employees across industries and regions in the United States found that 78% of employees report using AI tools in the office and 58% admit to providing sensitive company information to large language models.3 At the same time, organizations are increasingly using GenAI as part of their toolkit to respond to cyber risks.4 Board oversight of these areas is critical to identifying and mitigating risks that may pose a significant threat to the company.
This article explores how technology oversight disclosures and related governance practices are evolving to meet the challenges of this moment. We aim to help boards and management teams understand the disclosure landscape and the underlying governance practices it reflects and identify opportunities to strengthen and better communicate the rigor of their governance approach in an area of stakeholder focus.
READ MORE »
