Cybersecurity is no longer a back-office technical concern — it’s a cornerstone of organisational success and resilience. A recent Diligent Institute study of over 4,100 mid-to-large-cap companies across seven countries clarifies that robust cybersecurity governance is directly tied to financial performance. Boards actively engaging in cybersecurity oversight aren’t just protecting their organisations — they’re driving long-term shareholder value.
The evidence is compelling. Companies with advanced cybersecurity ratings deliver 3.8 times more shareholder value than those with weaker ratings. This finding underscores the need for boards to elevate cybersecurity from a cost centre to a strategic investment.
Why board oversight is a game-changer
Strong cybersecurity practices don’t just mitigate risks — they enhance trust, foster innovation, and directly impact the bottom line. Effective board oversight through cybersecurity governance ensures these benefits are realised by embedding cybersecurity into the fabric of an organisation’s strategy. Key oversight practices include:
- Establishing specialised risk committees
- Integrating cybersecurity expertise into governance structures
- Customising approaches based on industry-specific risks and regulatory requirements
Here’s how forward-thinking organisations are strengthening their cybersecurity frameworks:
Specialised risk committees: A foundation for success
Dedicated risk or audit committees with a focus on cybersecurity are becoming essential. These committees enable boards to:
- Focus on the evolving threat landscape.
- Allocate necessary resources.
- Leverage specialised expertise for informed decision-making.
For example, 90% of the Australian companies in the ASX300 have specialised cybersecurity committees. This proactive governance contributes to their superior cybersecurity ratings.
In contrast, Japan’s Nikkei 225 index has room for improvement, with only 3% of companies adopting similar structures. Bridging this gap presents a significant opportunity for Japanese firms to strengthen their defences and governance and shows that organisations in all regions need to make use of cybersecurity governance.
Cybersecurity expertise at the board level: Moving beyond the token expert
Having cybersecurity experts on the board is a start, but it’s the integration of their expertise into decision-making that delivers real impact.
By embedding these specialists into cybersecurity oversight committees, companies ensure that their boards remain well-informed and proactive against emerging threats.
Industry variations: Regulations as a driving force
Regulatory frameworks play a pivotal role in cybersecurity performance. Highly regulated industries — such as finance or healthcare — consistently outperform others, thanks to stringent compliance requirements.
However, even within the same industry, geographic disparities remain:
- Countries like Australia, Canada, the UK, and the US show higher average cyber ratings when specialised committees are in place.
- Japan, despite having such committees, trails in average security performance, suggesting that committee structures alone are insufficient without complementary regulatory rigour and cultural shifts.
This highlights the need for organisations to adopt holistic approaches — combining oversight structures, industry-specific strategies, and robust compliance practices.
Recommendations for enhanced board oversight
To capitalise on these insights and implement effective cybersecurity governance, boards should act decisively:
1. Create specialised risk committees
Assign dedicated committees to oversee cybersecurity. Empower them with the expertise and resources needed to address risks head-on and stay ahead of threats.
2. Incorporate cybersecurity experts into governance
Go beyond having a single expert on the board. Actively involve them in committees where their insights can shape policy and strategy.
3. Benchmark performance regularly
Compare your organisation’s cybersecurity posture against peers and industry standards. Use these benchmarks to identify gaps and refine strategies.