Before You Take the Seat: Cyber Diligence for the Incoming Non-Executive

There is a moment, usually somewhere between the second and third interview, when a non-executive appointment starts to feel like a compliment. That is precisely the moment to slow down. A board seat is not an honour conferred; it is a legal office carrying duties that a share certificate does not. In 2026, the quickest way to discover that a company's resilience is thinner than its brand is to be sitting in the room when it fails.

Buyers commissioning a structural survey on a house accept the cost without argument. The logic is obvious: the survey is cheap relative to the mistake. The same arithmetic applies to a board appointment, and yet cyber rarely features in a candidate's diligence. What follows sets out what to ask, whom to ask, and where the line sits between a fixable gap and a reason to withdraw.

The interview runs in the wrong direction

Standard non-executive recruitment assesses the candidate. The nominee's own diligence — the questions you put to the chair, the audit committee and the chief information security officer — is usually treated as a formality, a courtesy call dressed up as scrutiny. Insist otherwise. Ask for time with the security lead without the chief executive present, and for sight of the last two board packs covering technology and resilience. A board that resists either request has told you something before you have read a single document.

Start with the incident file

Request a list of material cyber incidents over the past four years: what happened, when it was detected, how long containment took, what recovery cost, and what changed afterwards. You are not looking for a clean record — few medium and large UK organisations have one — but for pattern. Repeated ransomware events with no corresponding architectural change suggest a board that treats incidents as bad weather. A single serious event followed by visible investment, revised reporting and a renegotiated supplier contract is a mature response.

Probe the gap between detection and disclosure. How long did the company take to understand what had happened? Did it notify the Information Commissioner's Office within the statutory window where required, and on what basis did it reach that decision? Ask for the post-incident review itself. The quality of that document will tell you more about the organisation than any certification on the wall.

Reading the board pack for what is absent

Once the papers arrive, read them as an outsider. Does the technology report run to half a page of green indicators, or does it carry a narrative a lay director can interrogate? Are there named owners for the principal risks? Is there any measure of whether controls actually work, or only of whether they have been purchased?

Look for the questions the pack fails to answer. Which systems would halt revenue if they stopped tomorrow? What is the organisation's tolerance for downtime on those systems, and who decided it? Has the board tested its own crisis decision-making, or only the technical team's playbooks? A pack without a stated risk appetite is a pack that cannot support an informed decision.

Following the third-party thread

Most modern outages arrive through a supplier. Ask for the register of critical technology providers, the concentration risk within it, and the contractual position on breach notification and audit rights. Then ask the harder question: when did the board last receive assurance about a supplier's security that was not written by that supplier? Self-attestation has its place, but a board relying wholly upon it is outsourcing its judgement along with its infrastructure.

For regulated firms, add the outsourcing and operational resilience expectations that apply to your sector, and ask how the firm evidences compliance rather than asserting it. Supervisors increasingly want the evidence trail, not a statement of intent.

The personal liability question

Directors' duties under the Companies Act 2006 apply to non-executives as much as to executives. The duty of skill and care is not a passive standard; it expects the diligence a reasonably diligent person would bring, informed by the role and by the knowledge you hold once in post. If a board has ignored warning signs and the company suffers, 'I was not told' is a thinner defence than incoming directors assume, particularly where the minutes show the subject was raised and parked.

Ask directly about directors' and officers' cover: limit, exclusions, whether regulatory investigation costs are included, and whether cover survives the failure of the company. In regulated sectors, satisfy yourself about how senior manager responsibilities are allocated and where the boundaries fall between executive and non-executive accountability. If the company is trading in difficulty, take advice on the insolvency-adjacent duties that can attach to directors in particular circumstances. None of this is a reason to refuse every seat; all of it is a reason to ask before rather than after.

Setting the walk-away threshold

Judgement, not perfection, is the standard. A board with an acknowledged gap, a funded remediation plan and honest reporting is a board you can help. A board that fails any of the following is one to decline.

• No coherent view of which systems are critical, or what downtime would cost the business.
• No evidence of a tested incident response capability within the past eighteen months.
• Incident history showing repeat events with no corresponding change in controls.
• Reporting that presents only assurance and never residual risk.
• No practical mechanism for the board to challenge technology claims.
• Reluctance to grant a nominee direct access to security leadership.
• A refusal to discuss directors' and officers' cover and its exclusions.

Nine months into a tenure, none of these can be fixed from the non-executive bench without a crisis as the catalyst. Asking now is not scepticism. It is the diligence the role requires, performed before you owe it.