Independent Cybersecurity& AI Security Advisory for Boards

In 2024, a European data protection authority fined a facial recognition technology provider an eight-figure euro amount for building a biometric database from billions of images of EU citizens without a legal basis, in breach of the GDPR.

The regulator also investigated whether the provider's directors could be held personally responsible, noting that personal liability already applies where directors know data protection law is being violated, have the authority to stop it, and consciously choose not to. The case shows that data protection obligations attach to individuals, not just to the corporate entity.

The case is a direct warning for any board deploying AI that processes personal data, including biometric data. Boards should know which AI systems process personal data, on what lawful basis, and who personally accounts for those choices before deployment, not after the regulator arrives.

In June 2017, a destructive attack aimed at a single country spread into a global shipping and logistics group. Terminals and port operations across the world stalled, thousands of servers and tens of thousands of PCs had to be rebuilt, and the company reported costs in the hundreds of millions of dollars.

Recovery nearly failed: every domain controller had been wiped, and the sole clean copy was found by luck on an offline machine in a remote regional office. Academic case studies of the incident show the gap was not a missing technology but governance: no tested scenario where every recovery point could be lost at once, and no crisis structure for decisions across the group.

Resilience is a board question, not an IT metric: does management test recovery against a worst-case, organisation-wide scenario, and does the board know how long it could operate with core systems down. Sector contagion from one supplier shows why third-party exposure belongs on the risk register too.

In May 2021, a large energy and fuel infrastructure operator was hit by ransomware. The attackers got in through a single compromised password for a legacy VPN account that had no multi-factor authentication. Operations were shut down for days and fuel supply across the region was disrupted.

The chief executive later told the US Congress that the password was complex, yet the account had only single-factor authentication. A single control gap on one inactive account stopped a critical network. Recovery decisions, including a ransom payment in the low millions of dollars, were made under public scrutiny afterwards.

Boards cannot accept assurance reports as evidence of resilience. The questions that matter are: where are the single points of failure, which legacy access accounts exist, is multi-factor authentication enforced everywhere, and who holds pre-approved authority when a crisis forces decisions under time pressure.