Cyber attacks have always evolved. What has changed is the speed. IBM’s 2026 Cost of a Data Breach research found that 22% of UK organisations reported experiencing AI-generated attacks, and that the average UK breach cost £3.13 million. Globally, IBM found that AI-driven attacks rose by 56%, adding an average of USD 1 million to the cost of each breach.
For boards, the important question isn’t whether the organisation has the latest security tools. It is whether the organisation has the right leadership to make good decisions quickly, before and after an attack.
What Has Changed
AI is helping attackers in three practical ways. Phishing emails are better written and more personalised. Voice and video impersonation make it easier to pose as a senior executive or supplier. And attackers can find and exploit technical weaknesses faster than before.
October 2026 showed what that looks like. Two critical flaws in PHP, known as PHP2Shell, were patched by the PHP team. PHP runs around 69% of websites whose server-side language is known. Researchers said AI had made long-standing weaknesses like these far easier to exploit, an exploitation attempt was recorded before the flaws were made public, and the UK’s National Cyber Security Centre urged organisations to consider taking offline any system that couldn’t be fixed straight away.
Patches were available quickly. The question for many organisations was whether anyone senior knew which systems were affected, and who would make the call to act.
Five Questions for the Board
- Who owns cyber security at senior level? The government’s Cyber Security Breaches Survey 2026 found that only 31% of UK businesses report board-level responsibility for cyber security.
- How quickly would we know about, and fix, a critical weakness? PHP2Shell is a useful test. If nobody could answer that question within a day, it is worth asking why.
- Has our incident response plan been tested against AI-enabled scenarios? For example, a convincing voice message from the chief executive asking for an urgent payment.
- Do we govern our own use of AI? IBM found that only 40% of organisations use access controls on AI models and data.
- Does the board receive clear, regular reporting on cyber risk? Reporting the board can act on, not technical dashboards it has to decode.
Where an Interim CISO Fits
Many mid-sized organisations don’t have a dedicated Chief Information Security Officer. Security sits with the IT Director alongside everything else, or with an external provider. That can work day to day, but AI-driven threats are raising the bar for leadership, not just for technology.
An interim CISO is an experienced security executive who joins your leadership team for a defined period. They are accountable to your board, and they typically focus on three things:
- A clear view of exposure: which systems, suppliers and processes carry the most risk, and what needs fixing first.
- Stronger response: an incident plan that has been tested, with clear decision-making if an attack happens.
- Board confidence: regular, plain-English reporting, and a plan for the right long-term security leadership.
Some organisations need full-time interim leadership for a period of change. Others are well served by a fractional CISO, working part time on an ongoing basis. Our Interim and Fractional CIO and CISO page explains the differences, including how an executive appointment differs from a virtual CISO service.
Why the Timing Matters
Recruiting a permanent CISO can take months, and the best candidates are rarely available immediately. Attackers are not waiting. An interim appointment gives the organisation experienced leadership now, while the permanent role is defined and filled properly.
If your organisation has already experienced an incident, our article on when to bring in interim security leadership after a cyber incident looks at the weeks that follow.
Novo’s Perspective
We find that most boards don’t lack concern about cyber risk. What they often lack is a named, experienced leader who can turn that concern into clear priorities and decisions. AI-driven attacks make that gap more costly.
Novo finds interim and fractional CIOs and CISOs who have led security through pressure before. They work inside your organisation, report to your board and leave a stronger function behind them.
For a confidential conversation about your organisation’s security leadership, speak to one of our directors or visit our Interim Hub.
