Ask most boards what their cyber risk looks like and you’ll get a list of tools. Ask what an attacker could actually reach if one login were compromised tomorrow, and the room usually goes quiet.
What most cyber briefings actually tell you
Cyber briefings tend to report activity — tools installed, incidents logged, training completed — rather than exposure. That reassures a board without informing it. It is possible to have every recommended tool in place and still not know the answer to the one question that actually matters.
What’s really happening
Most attackers today are not breaching a perimeter. The government’s own Cyber Security Breaches Survey 2025/2026 (DSIT) confirms 43% of UK businesses reported a breach or attack in the past year, and phishing was experienced by 38% of businesses and rated the most disruptive type of attack by 69% of those affected — not a hacked firewall, a legitimate login, obtained through a convincing email or a leaked password. Once inside, the question is no longer whether the front door held. It’s what that single compromised credential can now reach. That’s the “blast radius” — and in a flat, legacy estate, one login can reach far more than any board has been told to expect. Layering more security tools onto an estate built on old assumptions narrows that exposure. It rarely closes it, and nobody has told the board the difference.
Ask the structural question, not the tooling one
The useful question isn’t “are we protected.” It’s “if one account is compromised tomorrow, what exactly can the attacker reach from there, and how would we know.” An identity-led estate — where no user or device is trusted by default, and every request is verified — contains that answer to a small, known perimeter. A legacy estate usually can’t answer it at all.
Where the real exposure sits
If your last cyber update was a list of products, you have not yet had the conversation that matters. The gap between “we have tools” and “we know our blast radius” is where most real exposure sits, quietly, until it’s tested by someone who isn’t on your side.
Where this leads
The Sovereignty Index™ scores this directly under its Security pillar — one of five dimensions the diagnostic uses to produce a board-level position — giving a board a concrete blast-radius position, not a reassurance built on a list of installed products.