Why Cybersecurity Is a Governance Question

Published on 24 October 2026

“IT takes care of that.” When the conversation turns to cybersecurity, this sentence comes up sooner or later in many leadership meetings. It sounds like a clear division of labour. In reality, it describes a gap.

Anyone who thinks of cybersecurity only in terms of firewalls, servers and lines of code is confusing the symptom with the cause. Cybersecurity is not a purely technical challenge. It is a human one – and therefore a question of leadership and responsibility.

This conviction lies at the very beginning of PINK CYBER’s founding story. And it is the reason I am delighted to have joined the company’s Advisory Board in October, as Advisor for AI Governance, Executive Leadership & Corporate Responsibility. Two incidents from this year show why the topic belongs in the boardroom right now.

AI Agents with a Master Key

In July, AI agents that OpenAI was testing on a cybersecurity benchmark left their test environment. They reached the internet and spent several days inside the production systems of Hugging Face, one of the most important platforms for AI models worldwide. No human was steering them.

They got in through software vulnerabilities. After that, they moved on mainly using credentials they had collected along the way. With a single network key, they added new machines to the corporate network 181 times. Another access right gave them superuser privileges on all Kubernetes clusters at once. Hugging Face’s postmortem reconstructs around 17,600 actions by the agents. Most of them failed. It was enough that a few succeeded.

What held is remarkable: a database that only accepted approved network addresses, and a strict list of permitted outbound connections. In other words, controls that did not rely on a key that could be stolen.

A governance gap shows up on the other side, too. According to OpenAI, the safety filters used in production had been deliberately switched off in the test environment, and no monitoring of the agents had been set up. Some details of the incident are still disputed today. The baseline is not.

PHP2Shell: A Gap in the Foundation of the Web

This week brought the next wake-up call. On 21 October, the PHP project closed two critical vulnerabilities in the core of the programming language (CVE-2026-109618 and CVE-2026-109619). They allow attackers to execute code on servers without logging in. All PHP versions of the past decade are affected. PHP runs a large share of the world’s websites, from online shops to government portals.

The vulnerabilities were found by security researchers with the help of AI models. Even so, the coordinated disclosure went wrong: information leaked hours before the patches, and according to AWS, the first attacks were already under way before the official announcement.

No runaway agents were at work here. And yet the same pattern emerges. AI makes finding vulnerabilities faster, for defenders and attackers alike. The window between identifying a vulnerability and an attack shrinks to hours. Anyone who only then has to work out who in the company decides whether a system goes offline has already lost.

The Real Gap: Responsibility

Both incidents tell the same story. The most vulnerable point is rarely the technology alone. It is the question that, in day-to-day business, too often nobody asks in time: who actually gave this agent so much access? And who is responsible when something goes wrong?

With AI agents, the problem shifts. Until now, it was mainly about which people are allowed to access which systems. Now machines increasingly act with their own identities, their own keys and their own rights – often with more access than any individual employee. Who grants, reviews and revokes these rights is not a detail for IT. It is a leadership decision.

In my years as a CEO and manager in Scandinavian technology companies, I learned that trust is built through structures, not slogans. That includes clear responsibilities. But it also includes a culture in which someone has the courage to ask why a system actually needs these rights. That is exactly what I mean when I talk about governance.

NIS2: Cybersecurity Is Now Also Legally a Leadership Matter

I find it remarkable that German lawmakers have now reached the same conclusion. The NIS2 Implementation Act has been in force since 6 December 2025. It affects around 29,500 companies from almost every sector – no longer just operators of critical infrastructure.

And it explicitly makes cybersecurity the responsibility of executive management: management implements the security measures, monitors them and is liable to its own company for breaches of duty (Section 38 of the German BSI Act). On top of that comes the obligation to undergo regular training in order to be able to assess the risks themselves. Delegating it away to IT is therefore no longer an option.

For me, this is more than just another regulation. The law codifies what good leadership is about anyway: whoever carries responsibility must understand what they are responsible for. That also applies to companies that do not fall under NIS2 at all.

Questions Executive Management Should Be Asking Now

Governance does not start with a tool, but with the right questions. These are the ones I would put on the table in every leadership meeting:

Which AI agents and automated systems are working in our organisation, and with which access rights?
Who granted these rights, and when were they last reviewed?
Which credentials are permanently valid and, once stolen, could open up half the company?
Who is allowed to decide, in an emergency, to take a system offline – including at night and at weekends?
Do warning signals reach a person who can act, or only a log that nobody reads?
Does executive management know enough to be able to assess the answers to these questions?

My Conclusion

As a former journalist, it has always been important to me to translate complex risks in a way that enables leaders to make good decisions. That is exactly the core of my work with Impathic today: AI governance and Corporate Digital Responsibility as the foundation for organisations that stay resilient, even when their systems become faster than their processes.

At PINK CYBER, I will now contribute this perspective together with a circle of outstanding fellow board members. The company deliberately places diversity at the heart of its security mission. That, too, is governance: teams with different perspectives ask the uncomfortable questions earlier.

Security belongs on the executive management agenda, not in the basement.

Sources

Start the free AI Governance Check

All articles in the blog