For a long time, cybersecurity was handled with an unspoken agreement.

The board would approve the budget, the CISO took care of everything else, and once a year, everyone signed off on a slide deck before quickly moving on.

But the times are changing, and the board’s role is changing with them.

Across Europe and increasingly beyond it, regulators have rewritten the terms of boardroom accountability. Oversight is no longer something a director can delegate and forget; it’s something they now own personally, and personally is the key to this change: your name, your finances, and, in the worst case, your future on other boards.

But what reads like a drastic change isn’t as bad as it sounds. The distance between owning that risk and understanding it is smaller than it feels.

 

What the Numbers Now Expect of You.

According to PwC’s 2026 Global Digital Trust Insights survey, 60% of leaders say cyber risk is one of their top three priorities. However, only 24% invest in prevention instead of waiting to respond after a problem happens.

Regulators want to close the gap between what boards say and what they actually fund. In reality, this means board members are now personally accountable, not just the organization.

If a major breach is made public, regulators will look at what each board member knew, asked, and approved before it happened, not just what the company did. Fines that used to affect only the company can now affect individuals as well. Simple questions like “what did you know, and when” can have personal consequences as well as corporate ones.

 

Why Delegation Is No Longer Enough.

Passive oversight only ever caught the most obvious problems, not the ones that can really harm a business, like a risk assessment no one understood or an incident response plan that was never tested in a real situation.

That’s the real reason regulators are done accepting a signature as proof of oversight.

Regulators want boards to get more involved and really engage with risk assessments, not just sign off on them. In more and more places, this now means board members must complete cybersecurity training themselves, not just approve it for others.

Approving a risk assessment is not the same as being able to explain it, and the days of just approving are coming to an end.

 

This Isn’t Punishment. It’s Protection.

So what does all this really mean for you as a board member?

The training requirement isn’t meant to catch you out. It’s there so that a director who truly engages, asks real questions, and shows they understand the answers is in a much better position than someone who just signs off without reading.

This difference gives you protection. It turns personal risk into a decision you can defend and document.

You don’t need to become a cybersecurity expert. What’s needed is more focused: you should be able to ask questions that reveal gaps in a plan and know the difference between “we passed the audit” and “we could survive a real incident.”

This goal is achievable, even for a board that can only spend fifteen minutes on it each quarter.

Board members who build this understanding are doing more than protecting themselves from a headline. They’re evolving. They’re building governance that rests on real understanding, and that’s what genuinely shifts the odds in their favor.

This article was written by Cywareness, a company specializing in cybersecurity awareness.

As part of its mission, Cywareness continues to monitor emerging trends, analyze real-world attacks, and share practical insights to help organizations stay ahead in today’s evolving threat landscape.