Ninety per cent of non-executive directors lack a measure of confidence in cybersecurity value, according to a new survey from Gartner, Inc.

Only 10% of non-executive directors express strong confidence in the value of cybersecurity investments or initiatives, stating they have the right balance of protection and cost.

Yet, non-executive directors’ scepticism in cybersecurity value is a resource for change. Sense-maker CIOs and CISOs, who form the cyber-elite and help their organisations understand and respond to complexity and change have managed to earn their boards’ trust on “just right” levels of protection and cost.

The 2026 Gartner Board of Directors Survey was conducted from April 14 – May 22, 2025 among 330 respondents from North America, Latin America, Europe and Asia/Pacific, who are in a non-executive director role of private or public companies.

“Boards often struggle to connect cybersecurity investments to real business outcomes,” said Kristin Moyer, Distinguished VP Analyst at Gartner.

“Dashboards and compliance updates can confuse rather than reassure, leaving non-executive directors uncertain about whether their organisation is truly more secure. Sense-maker CIOs and CISOs earn board consensus on right levels of protection and cost by translating the complexity of cybersecurity into business value such as revenue, cost and shareholder impact.”

Boards are seeking clear insights into how specific threats translate into real risks for their organisations.

Sense-maker CIOs and CISOs provide transparency on actual exposure levels and readiness for threats, moving beyond general cyber threat trends, to empower non-executive directors with the information needed for informed decisions.

Top External Threats Impacting Shareholder Value

While boards are seeking greater clarity on cyber risks, they also recognise that these risks are part of a broader set of external threats facing organisations today.

Seventy percent of non-executive directors identified geopolitical instability and international conflict as the most significant external threats to shareholder value in the next 12 months. Notably, one in three NEDs viewed cyber-risks, technology disruption and innovation challenges as top external threats to shareholder value in the year ahead.

“Virtually all NEDs have experienced a cybersecurity breach either as executive leaders or during their tenure as board members,” said Tina Nunno, Managing VP at Gartner. “New security regulations have placed this topic front-and-centre on board agendas. At the same time, AI is causing significant business disruption—and has gained considerable attention from boards.”

Recommended reading

• AI Ushering in A “Digital Divide” in Cybersecurity, NCSC Warns
• Report: One in Five Small Firms Have No Cybersecurity Lead
• New Report Reveals AI Trust Divide in Cybersecurity

Technology: A Risk and A Key

Although technology is viewed by non-executive directors as an emerging risk area to shareholder value—including AI’s disruptive potential—it is also seen as an essential lever for navigating volatility ahead.

Sixty-three percent of non-executive directors said investment in technology and innovation is the best way to counter today’s global volatility.

“The majority of non-executive directors not only believe that technology investment is a key strategy in dealing with volatility, but they also believe that the majority of those investments should be in AI,” said Nunno.

“AI was ranked as the number one investment (57% of respondents) expected to have a positive impact on shareholder value in the next two years, ahead of investing in new products and services (56%) and M&A (45%).

“Non-executive directors have taken notice of the vast sums of money being invested in AI startups and large language models (LLMs) and believe over time that at least some of these AI bets will pay off.

“The majority of boards (71%) would like to see their enterprises take more technology risk and are actively encouraging their CEOs and executive teams to demonstrate that they have an AI strategy and are moving quickly enough.”