Cyber incidents are now a board-level issue for organisations of every size. The government’s Cyber Security Breaches Survey 2026 found that 43% of UK businesses had experienced a breach or attack in the previous twelve months, rising to 65% of medium businesses and 69% of large ones.
The first hours and days after an incident belong to the response team: containing the attack, restoring systems and working with specialist advisers. The weeks that follow are different. Your board needs to understand what happened, rebuild confidence with customers, regulators and staff, and fix the gaps the incident exposed. That needs leadership, and many organisations find they don’t have it in place.
When the Pressure Moves to Leadership
The cyber attack on Marks & Spencer in April 2025 showed how far the impact can reach. Online orders were suspended for weeks, and the company forecast that the attack would cost it about £300 million in operating profit. Months later, its chief digital and technology officer left the business.
Most organisations won’t face an incident on that scale. But the pattern is common. Once systems are restored, attention turns to accountability, investment and the leadership of technology and security.
Why Incidents Expose Leadership Gaps
Many mid-sized organisations don’t have a dedicated CISO. Security sits with the IT Director or CIO alongside everything else, or is handled by an external provider. Only 31% of businesses in the same survey reported board-level responsibility for cyber security.
That can work well day to day. After an incident, it often doesn’t. The IT team is focused on recovery. The board needs clear, regular updates it can act on. Regulators, insurers and customers want answers. Someone needs to own security leadership, and it needs to be someone with the experience to do it under pressure.
In other cases, the organisation does have a CISO, but the incident has changed what the role needs, or the CISO leaves in the aftermath.
When to Bring in an Interim CISO
Common signs that an organisation needs interim security leadership include:
- No one has clear ownership of security at senior level
- The board isn’t getting the information it needs to make decisions
- The IT team is stretched between recovery and day-to-day operations
- A regulator, auditor or insurer has raised concerns
- The existing CISO or IT Director has left
- The board needs an independent view of what went wrong
Timing matters. The response itself is usually led by specialist incident response providers. An interim CISO is most valuable once the immediate crisis is contained and the organisation moves into recovery and remediation.
What a Good Interim CISO Does First
Gives the Board a Clear Picture
What happened, what’s still at risk and what needs to happen next, set out in terms the board can act on.
Agrees Priorities
Not everything can be fixed at once. A good interim CISO agrees with the board what must be done first and what can follow.
Stabilises the Team
IT and security teams are often exhausted after an incident. Clear direction and realistic priorities help them recover and keep going.
Rebuilds Confidence
Customers, regulators, insurers and staff all need to see that the organisation is in control. The interim CISO is often the person who provides that reassurance.
Fixes the Gaps
Once the immediate pressure eases, the focus moves to the weaknesses the incident exposed, from controls and processes to suppliers and skills.
Interim CISO or Virtual CISO Service?
A virtual CISO is often provided as part of a wider managed service, where the individual can change. An interim CISO is an executive who joins your leadership team and is accountable to your board. We explain the difference in more detail on our interim and fractional CIO and CISO page.
After the Interim Assignment
An interim CISO can also help the board decide what comes next. Some organisations appoint a permanent CISO. Others decide a fractional CISO is the right long-term answer, giving senior security leadership part time, supported by internal staff and specialist providers. The same choice applies across the leadership team, as our interim and fractional leadership page explains.
Novo’s Perspective
After an incident, boards often focus on technology: what failed and what needs replacing. In our experience, the harder question is who leads the recovery and who owns security from here.
At Novo Executive, we believe that question deserves the same care as any other board appointment, even when time is short. We find interim and fractional CIOs and CISOs for organisations that need that leadership quickly, and permanent technology leaders through our CIO and IT Director recruitment service. Meet our interim and fractional specialists.
Jon Hollier
Founding Director
