By Erika Eliasson-Norris, CEO, Beyond Governance
Organisations have never had more information about the threats around them. The problem is that information does not make decisions. People do.
A threat can be detected by a security team, appear on a dashboard, sit within a risk report and even be discussed by management, yet still fail to trigger meaningful action.
That creates a governance question that deserves more attention.
It is not simply whether an organisation has good threat intelligence. It is whether its governance allows that intelligence to reach the right people, in the right form and early enough for them to act.
Because knowing about a threat and being ready for it are two very different things.
The Translation Gap
Boards do not need to become cyber security specialists.
They do, however, need information that allows them to understand the significance of a threat and exercise judgement.
This is where translation matters.
A technically detailed report may be entirely accurate while still being of limited use to a board. Directors need to understand what a threat means for the organisation.
How exposed are we? How quickly could the situation develop? What could the operational, financial, regulatory or reputational consequences be? What decisions might be required and when?
Good threat intelligence at board level is therefore not necessarily about providing more information. Often, it is about providing less information with greater clarity.
The test should be simple: does this information help somebody make a better decision?
The Escalation Gap
There is another question organisations should be able to answer clearly: who decides when a threat becomes significant enough to escalate?
Many governance systems work well when events fit neatly within predetermined categories. The difficulty comes when the information is incomplete, the potential impact is uncertain and nobody yet knows whether an emerging issue will become material.
That is precisely when escalation matters most.
If thresholds are too rigid, important information can remain below them until certainty arrives. By then, the organisation may have lost valuable time.
Effective governance needs space for judgement. People should know not only when they must escalate, but when they are empowered to do so because something does not feel right.
The Behavioural Gap
Perhaps the most underestimated weakness in threat intelligence is human behaviour.
Governance frameworks often assume information moves rationally through an organisation. In reality, it moves through people.
People filter information. They prioritise it. They interpret it through previous experience. They worry about overreacting. They may hesitate to escalate something they cannot yet prove.
Information can also become softened as it travels upwards.
A significant concern at operational level becomes a manageable issue by the time it reaches senior management and a line on a dashboard by the time it reaches the board.
None of this necessarily involves bad intent.
It is simply what happens when hierarchy, optimism, competing priorities and human judgement interact.
That means psychological safety is not separate from threat intelligence. It is part of the infrastructure that makes threat intelligence effective.
If people do not feel able to say, "We don't fully understand this yet, but I think you need to know", the organisation has a vulnerability that no dashboard will solve.
The Ownership Gap
Modern threats rarely respect organisational structures.
A cyber incident might begin within technology but quickly become an operational, regulatory, financial and reputational issue. It may affect customers, employees, suppliers and investors simultaneously.
Yet organisations can still govern risk through functional silos.
Technology owns one element. Risk owns another. Legal and compliance become involved elsewhere. Communications arrives later. The board receives information through several different routes.
Each individual function may be doing its job well while nobody is seeing the whole picture.
Governance should create the connections between those perspectives.
The question is not simply, "Who owns this risk?" It is also, "Who is joining the dots?"
The Decision Gap
Ultimately, the success of threat intelligence should not be measured by how much intelligence an organisation collects or how sophisticated its reporting becomes.
It should be measured by what happens next.
· Did somebody recognise the significance of the signal?
· Did they understand who needed to know?
· Was the information communicated clearly?
· Was it challenged?
· Did somebody have the authority to act?
· And did they act early enough?
This is where boards can play an important role. Rather than simply asking whether appropriate cyber controls or threat monitoring systems exist, they can test the pathway between detection and decision.
If a significant threat emerged tomorrow, how would the organisation know?
Who would decide whether it should reach the executive team or board?
How quickly would that happen?
What would directors be told?
Could hierarchy, culture or organisational silos slow the information down?
And, crucially, who would have authority to act before all the facts were known?
These are governance questions as much as security questions.
Because the most dangerous failure in threat intelligence may not be failing to detect the threat.
It may be detecting it, discussing it, reporting it and still failing to turn that knowledge into a decision before it is too late.
Erika Eliasson-Norris
CEO of Beyond Governance, Podcast host of Grit in the Boardroom and Author of The Secret Diary of a Company Secretary
Latest News
