From Band-Aids to Immunity: Why Boards Must Rethink Cyber Security

The human immune system is remarkable. It does not prevent every infection but operates through layers of defence, constantly identifying threats, responding when something goes wrong, containing damage and learning from previous encounters. When we are hurt, a Band-Aid may well be enough - but sometimes the human body needs more. Our immune system recognises an enhanced threat, fights infection and helps us recover.

Cybersecurity needs to work in much the same way. For decades, organisations have concentrated on building stronger perimeters, conducting periodic audits and addressing individual vulnerabilities as they emerge. These measures remain important, but they are no longer sufficient. As AI accelerates the discovery and potential exploitation of vulnerabilities, organisations must move from applying cybersecurity ‘Band-Aids’ to building cybersecurity ‘immunity’. This means combining traditional protections with continuous monitoring, testing, assurance and the ability to respond at the speed of AI.

Three incidents, three lessons for boards

October 2026 provided three compelling examples of why this shift is necessary.

1. PHP: Vulnerabilities can become business disruptions overnight

On 21 October, cybersecurity agencies issued urgent warnings about two critical vulnerabilities in PHP, a programming language widely used by websites and business applications. The weaknesses could potentially allow attackers to execute malicious code remotely. Organisations including the Finnish government and Dutch public authorities temporarily took websites offline as a precaution, while services associated with Edinburgh Council and the BBC were also disrupted. The boardroom lesson is that vulnerabilities in widely used technology can create immediate operational consequences, even without a confirmed cyber attack.

2. Google Cloud: Resilience depends on more than your own systems

A significant power-related disruption affecting Google Cloud's London infrastructure highlighted the dependence of financial services, public services and businesses on a relatively small number of technology providers. Companies, including Revolut, Halifax, Lloyds, DPD, the courts and the NHS app, all reported issues accessing the platform.  For directors, the issue extends beyond whether a cloud provider is secure. It concerns concentration risk, operational dependencies and whether the organisation can continue delivering critical services when a major supplier becomes unavailable.

3. eMudhra: Trust can disappear faster than it is built

Indian digital trust provider eMudhra faced a serious security incident after researchers discovered eight certificate-authority keys weakened by an error in their generation process. Major big tech browser providers withdrew trust from the affected certificate hierarchy. Although eMudhra reported no evidence of malicious exploitation, its board subsequently decided to exit the global public TLS certificate business.
 For directors, this illustrates how cybersecurity failures can have consequences extending far beyond technical remediation. Customer confidence, commercial viability and even an organisation's continued participation in a market may be at stake.

Together, these incidents demonstrate that vulnerabilities need not originate within an organisation to create significant business risk.

AI is changing the economics of cybersecurity

Cybersecurity vulnerabilities have always existed. What is changing is the speed and scale at which they can be discovered and potentially exploited. Advanced AI systems (such as Anthropic’s Mythos) can analyse software, identify weaknesses and assist in developing exploitation techniques at a pace that challenges traditional approaches to vulnerability management. The implications are two-sided. AI provides defenders with powerful new capabilities, but those same capabilities can also benefit attackers.

The European Commission recognised this challenge in its July 2026 plan addressing advanced AI and cybersecurity. It acknowledged both the potential misuse of AI to identify vulnerabilities and automate attacks, and the opportunities to strengthen defensive capabilities.
For boards, the question is no longer simply whether their organisation has appropriate cybersecurity controls. It is whether those controls, and the assurance supporting them, can keep pace with a rapidly changing threat environment.

Why NIS2 and the CRA matter

The EU's evolving cybersecurity framework provides important foundations for organisational immunity. The NIS2 Directive strengthens requirements concerning cybersecurity governance, supply-chain security, vulnerability management, incident response and business continuity. For organisations within scope, management bodies have explicit responsibilities for approving and overseeing cybersecurity risk-management measures. The Cyber Resilience Act complements this approach by introducing cybersecurity requirements for products with digital elements, including secure development, vulnerability handling and security updates throughout their lifecycle.

Together, these frameworks reinforce two connected responsibilities: organisations must manage their digital risks effectively, while technology manufacturers must develop and maintain more secure products.

Five questions every board should ask

Directors do not need to become cybersecurity specialists. They do need confidence that their organisations are developing immunity rather than relying solely on Band-Aids.

1. Do we understand our critical technology dependencies? What would happen if a key supplier or platform became unavailable tomorrow?
2. Can we respond quickly enough? How rapidly can we identify, prioritise and remediate critical vulnerabilities?
3. Are we using AI defensively? Are our cybersecurity capabilities evolving alongside those available to attackers?
4. How resilient is our supply chain? What assurance do we have beyond contractual commitments and periodic assessments?
5. Are we exercising effective governance? Does the board receive meaningful evidence of resilience, rather than simply confirmation that controls exist?

From protection to resilience

The objective of cybersecurity cannot be to prevent every incident. That is neither realistic nor achievable. Instead, organisations must develop the capacity to anticipate threats, withstand disruption, recover effectively and adapt as risks evolve. Band-Aids will always have their place. But in an environment where AI is changing the speed of cyber threats, organisational immunity must become the board's ambition.

This article is the view of the author and does not necessarily reflect IoD Ireland’s policy or position.

About the author

Dr Valerie Lyons is a Company Director and Chief Operating Officer at BH Consulting. She is the author of the best-selling book ‘The Privacy Leader Compass’ and was included in the ‘Top 100 Women in Cybersecurity in Europe’. Valerie presents the IoD Ireland ‘Cyber Security and Data Protection Governance’ workshop. Dr Lyons is an accomplished and driven cybersecurity and privacy leadership expert. Her career spans over 30 years, working in both cybersecurity and privacy teams. She has worked for several global organisations, such as IBM, KPMG and ABB, and was Head of Information Security Risk at KBC Bank for almost 15 years. Dr Lyons has been Chief Operating Officer at BH Consulting since 2015. She has in-depth knowledge of European data protection law and practices and frequently presents at renowned international security and privacy conferences, such as RSA, COSAC, ISACA and CPDP. She has also lectured at Dublin City University on privacy, cybersecurity and digital ethics. In 2022, Dr Lyons was awarded a PhD in Information Privacy for her research into privacy in the ESG suite. She also holds a Master’s in Business Leadership, along with a postgraduate qualification in Executive Coaching and a postgraduate qualification in Cloud Computing Strategy. She has been a certified CISSP for almost 25 years and is also qualified as a CDPSE and CIPP/E. She has been an Honorary Fellow of the Irish Information Security Forum (IISF) since 2004 and is a member of the European Data Protection Board’s pool of experts.