08 September Blog

Cyber Governance Is Leadership Governance: What Cyberplanz’s 12-Part Series Teaches Us About Leadership

Over recent months, Cyberplanz has been publishing its 12-Part Cyber Governance Series, examining cybersecurity from the perspective of boards, executives and organisational leaders.

The series has looked beyond firewalls, passwords and technical controls to explore the responsibilities that sit at the leadership table: governance, accountability, culture, people, third-party risk, incident preparedness, AI governance and organisational resilience.

But viewed through the lens of leadership and executive coaching, the series raises an even bigger question.

Is cyber governance really a cybersecurity issue — or is it another test of leadership? 

At Corna Consulting, we believe the answer is increasingly clear.
Cybersecurity may be the context, but many of the challenges highlighted throughout the Cyberplanz series are fundamentally leadership challenges.
They involve how leaders make decisions under uncertainty, communicate expectations, create accountability, build culture, respond to bad news, empower their people and balance opportunity against risk.
And those lessons extend far beyond cybersecurity.

Technology Changes. Leadership Fundamentals Don't. 

Cybersecurity has changed enormously over the past decade. Artificial intelligence is accelerating that change again. Organisations now operate across cloud platforms, remote workplaces, interconnected supply chains, SaaS applications and AI tools. Employees can potentially introduce new technologies into an organisation with little more than a browser and a credit card. The technical environment is becoming more complicated.

Yet the leadership questions remain remarkably familiar:
Who is accountable?
What level of risk are we prepared to accept?
Do our people understand what is expected of them?
Do employees feel comfortable raising concerns?
Are we receiving the information we need to make good decisions?
Are we testing our assumptions — or simply hoping they are correct?
When something goes wrong, how will we respond?
These are not questions that can simply be delegated to IT. They are leadership questions.
 
Lesson One: Accountability Cannot Be Delegated Away
 
One of the strongest themes running through the Cyberplanz Governance Series is accountability. Boards and senior executives can delegate cybersecurity responsibilities, but they cannot simply delegate away their accountability for organisational risk.

The same principle applies throughout leadership. Effective leaders understand the difference between delegation and abdication. A CEO does not need to understand how every cybersecurity technology operates. A board member does not need to know how to configure a firewall.

But they should be able to ask questions such as:

• What are our most significant cyber risks?
• Who owns them?
• What are we doing about them?
• How do we know our controls actually work?
• What happens if those controls fail?
• What would the impact be on our customers, employees, reputation and operations?

Good leadership is rarely about having every answer. It is about knowing which questions need to be asked — and creating an environment where people are comfortable giving honest answers.
 
Lesson Two: Culture Will Beat Policy 

Organisations can have excellent cybersecurity policies and still have poor cybersecurity outcomes. Why is that? Because employees don't experience policies. They experience culture.

If employees believe reporting a mistake will result in blame or embarrassment, they may hesitate before reporting a suspicious email they clicked. If senior executives routinely bypass security processes because they are inconvenient, employees quickly learn what the organisation genuinely values. If managers treat cybersecurity training as a compliance exercise, employees are unlikely to see it as important.

Leadership behaviour becomes organisational behaviour. This is one of the areas where leadership coaching and cyber governance intersect most strongly. Leaders need to consider not only “What have we told our people to do?" but also "What does our behaviour teach our people to do?" The difference can be significant.
 
Lesson Three: Psychological Safety Can Become a Cybersecurity Control
 
Imagine an employee realises they have accidentally entered their credentials into a suspicious website. What happens next? Do they immediately contact IT or the security team? Or do they spend the next 30 minutes wondering whether they can quietly fix the problem themselves because they are worried about looking foolish? From a cybersecurity perspective, those 30 minutes could be extremely important. From a leadership perspective, the issue is psychological safety.

Organisations need employees who are comfortable saying:
"I think I've made a mistake."
"Something doesn't look right."
"I don't understand this."
"I disagree."
"I think we have a problem."

That applies equally to cybersecurity, financial management, customer service, health and safety, operational risk and organisational strategy. A culture where bad news travels slowly to senior management is dangerous. Good leaders create environments where problems can travel upwards quickly and without unnecessary fear.
 
Lesson Four: What Happens Under Pressure Reveals Your Culture 

Another important theme from the Cyberplanz series has been incident preparedness — particularly the first 24 hours following a significant cyber incident. An incident response plan may define responsibilities. But a crisis tests much more than the plan. It tests leadership. Who takes control, who communicates, who makes decisions when the available information is incomplete? Do executives support each other or protect their own areas? Does the organisation communicate openly or become defensive? Can leaders remain calm enough to make rational decisions? Do people know when to escalate?

​And perhaps most importantly:
Has the leadership team built enough trust before the crisis occurs to work effectively when the pressure arrives?

You cannot manufacture trust during an emergency. It has to exist beforehand. That is why scenario exercises and tabletop simulations can be valuable for more than testing cybersecurity plans. They can expose leadership dynamics.
 
Lesson Five: Good Leaders Welcome Challenge
 
Cyber governance also requires leaders to become comfortable with uncomfortable information. An independent review may identify weaknesses. A penetration test may demonstrate that a system can be compromised. An employee survey may reveal that staff do not understand cybersecurity expectations. A third-party assessment may show that an important supplier represents more risk than previously believed. An AI governance review may uncover tools being used without appropriate oversight.
Strong leaders do not interpret these findings as personal criticism. They see them as information. There is an important leadership distinction between "Who is responsible for this problem?" and "What do we need to learn from this?"

Accountability still matters. But blame and accountability are not the same thing. An organisation that punishes people for identifying weaknesses may eventually stop hearing about weaknesses. The risks, however, do not disappear.
 
Lesson Six: AI Governance Is a Leadership Opportunity 

The emergence of generative AI makes the relationship between leadership and governance even more important. AI creates genuine opportunities to improve productivity, innovation, customer experience and decision-making. It also introduces new questions around privacy, security, intellectual property, data governance, accuracy, accountability and employee behaviour.

A purely defensive leadership response might be "How do we stop employees using AI?" A better governance question may be "How do we enable our people to use AI safely and productively?"
That requires leadership to balance innovation and control. Too little governance can create unnecessary risk. Too much control can suppress experimentation and encourage employees to find ways around the rules. Leadership therefore needs to establish boundaries within which people can innovate confidently. That is not fundamentally a technology challenge. It is a leadership challenge.
 
Lesson Seven: Resilience Starts With People 

Technology is important to cyber resilience. But resilient organisations are ultimately made up of resilient people, teams and leadership systems. A resilient organisation needs people who can: communicate clearly, make decisions, challenge assumptions, adapt when circumstances change, take accountability, support colleagues, learn from mistakes, and continue functioning when the original plan no longer works. These are leadership capabilities. Cybersecurity simply provides a particularly powerful environment in which to test them.

Perhaps the Board Needs a Different Cyber Question

Boards often ask "Are we secure?" It sounds reasonable, but it can be a difficult question to answer meaningfully. Perhaps a more useful question is
"Are we confident that our organisation has the leadership, culture, governance and capability to manage cyber risk and respond effectively when something goes wrong?"
That creates a very different conversation. It moves cybersecurity away from being viewed solely as an IT responsibility and towards what it increasingly represents: enterprise risk and organisational resilience.
 
The Leadership Mirror 

One of the most interesting lessons from Cyberplanz's 12-Part Cyber Governance Series is that cybersecurity can act as a mirror for organisational leadership. Look closely at how an organisation manages cyber risk and you may discover a great deal about how that organisation is led.

Do people understand their responsibilities?
Can employees challenge decisions?
Does bad news reach senior management quickly?
Are responsibilities clear?
Are suppliers genuinely scrutinised?
Does the board understand the organisation's risk?
Are assumptions independently tested?
Do leaders practise for difficult situations before they happen?
Does the organisation learn from near misses?
Can innovation occur within sensible boundaries?
And when something goes wrong, does the organisation look for someone to blame — or something to learn?
Those questions could equally be asked about almost any area of organisational performance.
 
Cyber Governance Is Ultimately About Leadership 

The Cyberplanz 12-Part Cyber Governance Series was designed to help boards and executives think differently about cybersecurity. From a Corna Consulting perspective, however, there is another lesson running throughout the entire series: Strong cyber governance is usually a consequence of strong organisational leadership.

Technology matters. Policies matter. Controls matter. Frameworks matter. But leadership determines whether those things become embedded into the organisation or remain documents, systems and intentions.

That is why conversations about cybersecurity increasingly belong alongside conversations about leadership development, organisational culture, employee engagement, governance and resilience.
Because ultimately, organisations don't become resilient simply by buying better technology. They become resilient by developing leaders and people capable of making good decisions when technology, circumstances and assumptions inevitably change.
 
A Question for Every Leadership Team 

Perhaps the final question arising from the Cyberplanz Governance Series isn't about cybersecurity at all: If a significant cyber incident happened tomorrow, would the greatest strength in your response be your technology — or your people and leadership?
The answer may tell you more about your organisation than any cybersecurity dashboard ever could.


Corna Consulting works with organisations and leaders to strengthen leadership capability, organisational culture, employee engagement and resilience. Through Cyberplanz, we extend those principles into cyber governance, AI governance and organisational cyber resilience — helping organisations recognise that managing modern technology risk is as much about leadership and people as it is about technology.