AI-enabled cyber threats: lessons for boards

Anthropic’s Mythos announcement this week has prompted understandable alarm about the pace and implications of AI-enabled cyber capability. But the wider lesson for boards is not simply about a new AI model. It is about how organisations govern when uncertainty moves faster than traditional assurance.

Increasingly, the real challenge for boards is not just oversight — but making sense of uncertainty early enough to act well.

For years, boards have been encouraged to govern through better data, stronger assurance and clearer reporting. Those things matter. But they are not always enough.

The Greeks used the word MYTHOS not to mean fantasy, but to describe the underlying story that gives events meaning. In periods of real uncertainty, that matters. Because leaders are not just making decisions on the basis of facts; they are also making sense of weak signals, shifting assumptions and the wider forces shaping what happens next.

That challenge is becoming more acute.

Technology, cyber risk, geopolitics and regulation are no longer separate issues to be managed in parallel. They increasingly interact in ways that can expose hidden dependencies, create second-order consequences and render traditional assurance less reliable than it appears.

Cyber is perhaps the clearest example. For years, cyber governance has often been treated as a technical matter: controls, compliance, incidents, dashboards. Yet the threat landscape has changed. The question is no longer simply whether an organisation has been breached. It is whether it can continue to operate credibly if access, systems or trusted data are degraded — perhaps without warning.

That changes the role of the board.

The most important board questions are often not:

• Are we compliant?

• Are the metrics green?

• Have we had an incident?

They are more likely to be:

• What are the assumptions underpinning our resilience?

• What dependencies matter most?

• What is our minimum viable service in degraded conditions?

• What decisions would we need to make early, before the full picture is clear?

Good governance in this context is not about intervening in management. It is about creating the conditions for sound judgement: clarity about priorities, realism about uncertainty, and confidence about what must still hold true when events do not follow the plan.

In that sense, the challenge for boards today is not just to oversee risk. It is to govern credibly in conditions where the story is still unfolding.