Boards Say Cyber Is Strategic. Their Governance Structures Say Otherwise.

New data on S&P 500 disclosures shows cybersecurity oversight increasingly concentrated in audit committees — even as the risk itself has outgrown a compliance framework

Ask any public-company board whether cybersecurity is a strategic priority, and the answer will almost always be yes. Look at how they've actually structured oversight of it, and a different picture emerges. A recent analysis of the most current S&P 500 governance disclosures — 10-Ks, proxy statements, and committee charters as of March 2026 — found that 79% of companies now assign primary cybersecurity oversight to the audit committee, up from roughly two years earlier, while direct full-board oversight has fallen sharply over the same period. Dedicated technology or cybersecurity committees remain the exception, present at only about 6% of companies.

That trend isn't necessarily a mistake — audit committees can and often do handle cyber oversight competently. But it raises a structural question worth sitting with: what happens when a risk that increasingly shapes how a company executes its strategy gets routed primarily through a committee built for controls, compliance, and disclosure?

A Regulatory Backdrop That Raises the Stakes

This governance debate isn't happening in a vacuum. Since the SEC's cybersecurity disclosure rules took effect, public companies have had to describe, in their 10-Ks, exactly how their board oversees cyber risk — which committee is responsible, and how that committee stays informed. Material incidents now require disclosure within four business days of a materiality determination under Form 8-K Item 1.05. And a parallel set of amendments to Regulation S-P, with a compliance deadline of June 2026, extends board accountability further into how financial services firms safeguard customer data and document their incident response.

The practical effect is that "which committee owns this" is no longer just an internal governance choice — it's now a matter of public record, scrutinized by investors, and increasingly by regulators through comment letters and enforcement activity. That makes the audit-committee-by-default pattern more consequential than it might have been a few years ago: it's not just an internal allocation of labor, it's the model of governance the market can now see and evaluate.

The Real Gap: Information Versus Decisions

The deeper issue isn't which committee holds the cyber brief — it's what boards actually do with the time they spend on it. Too many board cyber briefings are still built around dashboards, maturity scores, and technical metrics that leave directors better informed without leaving them better prepared to govern through an actual incident. A board can sit through a thorough update and still have no clearer sense of how a major cyber event would interrupt revenue, which business functions would fail first, how concentrated the company's dependency is on a handful of cloud providers or software vendors, or how quickly operations could realistically recover.

Those aren't security questions in the narrow sense — they're operational and financial questions that happen to originate from a cyber event. Treating them as a specialist technical briefing rather than a board-level strategic decision is where governance structures built for assurance start to fall short of what the risk actually requires.

The more effective model, increasingly used by boards further along in this shift, condenses cyber discussion into a short, decision-oriented format: the handful of risks that matter most to the specific business, a plausible disruption scenario, evidence that preparedness claims have actually been tested, and a clear trade-off that needs the board's judgment — not just its attention.

Proof, Not Assurance

Boards with more mature cyber governance are increasingly demanding evidence rather than reassurance: tabletop exercises, recovery drills, and scenario-based reviews that test whether the organization can keep operating under realistic stress, not just whether its control checklist is complete. Some are going further, treating publicly reported incidents at peer companies as informal case studies — asking what a similar failure would do to their own operations, customer commitments, or business model, rather than treating those events as someone else's problem.

Why AI Is Accelerating the Mismatch

Artificial intelligence sharpens all of this. It's simultaneously expanding the attack surface companies present to adversaries and giving those adversaries faster, more capable tools — frontier models are already being used to surface software vulnerabilities that older tooling missed. At the same time, enterprise AI adoption introduces its own governance questions around data exposure, third-party model access, and increasingly autonomous "agentic" systems acting inside company infrastructure. Employees adopting AI tools on their own, faster than most governance processes can track, adds another layer of exposure that a quarterly compliance update is poorly suited to catch.

The Governance Question That Actually Matters

Where cybersecurity oversight formally sits on an org chart may be a settled question for most boards at this point. How it's governed within that structure is not. The more useful test for any board isn't which committee has the mandate — it's whether that committee's process surfaces real trade-offs instead of status updates, reflects how AI is reshaping both the threat landscape and the company's own exposure, and keeps the full board engaged on the decisions that actually carry business consequence: resilience investment, risk acceptance, and dependency on a shrinking number of critical vendors.

Cybersecurity hasn't stopped being a risk-reduction discipline. But for companies where digital infrastructure is inseparable from how the business runs, it's also become part of how strategy gets executed — or stalls. Boards that continue to treat it as a reporting formality risk being well-briefed on yesterday's threat model while remaining structurally unprepared for a faster, AI-shaped one.

Drawing on Forbes Technology Council reporting on Zscaler's S&P 500 governance analysis, alongside current SEC cybersecurity disclosure and Regulation S-P requirements, as of early July 2026.