Welcome to Executive Session from Directors and Boards.
Customers and the communities are feeling the strain in this high interest rate environment and the cost of everyday goods going up. So, from a management and a board perspective, you have to address that issue proactively and be very intentional about your efforts.
Hello and welcome to Executive Session, the official podcast of Directors and Boards. I'm your host Bill Hayes, editor-in-chief of Directors and Boards. We just heard from Calvin Butler, president and CEO of Exelon, on customer affordability. In this episode of Executive Session, we'll also explore cybersecurity and AI with Helmut Ludwig and the unintended consequences of board decision-making with Nina Henderson.
Cyber risk doesn't sit still long enough for a board to master it once and move on. The threat evolves faster than most governance structures were built to handle, and AI is only accelerating that pace. Helmut Ludwig brings a rare vantage point on this challenge. He's chair of Humanetics Group, a director at Mayers Industries, and a director and audit committee chair at Hitachi, giving him a front row seat to how different boards are dealing with AI oversight. He joins us to unpack where boards commonly stumble on cybersecurity, why it demands a different lens than other enterprise risks, and how committee structure, board composition, and director education need to evolve to keep pace.
Helmut, from a board's perspective, what does effective cybersecurity oversight look like at the board level today? And where do boards most often get it wrong?
Cybersecurity traditionally has been a little bit in the technology corner. When we look at it today, it touches really literally every part of the corporation. Touches operations, finance, legal, can have an enormous impact on your reputation. And so, effective and efficient cybersecurity, number one, it needs to start with transparency. Do you know where your company stands? Do you have the right processes in place? And you have indicators that, number one, describe where you're standing absolute or relative to other companies, but also, are you getting continuously better? Or you have to assume you're probably never 100% secure that you cannot be breached. So, you have to be ready for the time where actually a breach happens, meaning where an unfriendly actor is able to enter your system. And then the key question is, have you trained how to act? Is your company ready to confront the situation? And also, is it able to recover? So, the key point here is not only being ready to avoid as much as possible a potential cybersecurity threat, but also to have the resilience to recover adequately. And I think the failure sometimes is really thinking, 'Okay, well, we have some technology guys that will take care of it.' You have to recognize it's really literally a business topic, and because of this, relevant for all board members. And all board members should be able to ask the right questions to management regarding the resilience of the company.
How should boards think about cyber risk differently from other enterprise risks, especially given the speed of change and the impact AI has on the threat landscape.
Yeah, maybe let's start with a similarity. When we look at enterprise risk, we always look at impact and probability. And that simple approach, of course, also is relevant for cybersecurity. You want to make sure you understand which type of assets are most important. You know, where do you have the most critical IP in your company? But where is the difference is the speed of change. You mentioned already in your question. If you just dial the clock back 2 years ago, from detecting a so-called zero-day vulnerability, meaning where somebody encountered and found an issue in software which allows for an actor to take advantage of it. And having this vulnerability exploited, meaning a bad actor uses it and really enters into your system. There was a time difference of 53 days. Today it's hours, and I would expect in the future it will be minutes and maybe less.
We saw this in April when Anthropic was coming out with a new offering, Mytho. And they had to recognize and shortly before actually release date that there, besides being a very powerful generative AI tool, that it also was very powerful in identifying potential threats at companies or opening at companies, vulnerabilities. And they then had to start to not making it generally available, but making it available only to very selected software companies that tested their software first in a frame of a project called Glass Wing where they made sure that the software these threats that could be identified that they could identify them and cover them. This was in April. It took them more than 2 months until a reduced version actually became available. So that already shows the exact enhanced exposure and enhanced risk.
Now the question is what can companies do about it? And when I was CIO at Siemens, we introduced a system or process which is called zero trust. And if somebody is more interested in this, NIST has a very good publication about it and NSA just came out this year with a very detailed description of the approach. But in simple term, what it means is you never trust somebody. Meaning if somebody walks into your door, you first check identity and second, you are very clear which type of information in this case an individual is allowed to access. So your salesperson in the UK might have access to the CRM system in the UK but not to your global ERP system or not to the CRM information in let's say North America. Now the what the zero trust means and there it really becomes very interesting. What it means is by identifying certain areas that only are possible for individuals to access, you make sure that you don't get so called lateral movements. What does that mean? Some of you might remember there's a global retail chain which was attacked where somebody came into the air conditioning system. Makes a lot of sense. You want to have your air conditioning being maintained and being maintained from another area, so somebody is able to access your air conditioning system. But they were not only able to access your air conditioning system, they could move laterally into your cash register and access credit card information. And this is something you want to avoid. You want to avoid that somebody is able to move from left to right from maybe something which is not a very critical asset to highly sensitive information. And I would recommend any board member to get acquainted with what zero trust really means and what most modern cyber security tools allow companies to install and protect their critical assets.
As cyber and AI become more strategic, how should boards think about committee structure, board composition, and director education?
Yeah, so today around 80% of boards have delegated the cyber security responsibility to audit committees. Other companies that have so-called risk committees, very often in the finance sector, they have this allocated to the risk committee, another maybe 10%. And the rest is most of those companies have this at board level. My recommendation would be to use one of the committees, the most adequate one, in many companies again the audit committee, as the main driver, but never take the responsibility away from the whole board. As we discussed before, cyber security is really more business resilience topic, and the whole board has to be very transparent on the situation inside the company. Now, this also requires that every board member has some knowledge. Only about 2% of board members do have deep background in IT or in cybersecurity. And honestly, I think that will not change significantly and probably shouldn't because board responsibilities are very broad and we don't want to have specialist for every area. At the end of the day, for critical decisions, the whole board has a fiduciary duty to its shareholders. So, how do board members really become more informed about cybersecurity? Now, the good news is board members are lifelong learners. They're always, I have not met any successful board member who is not consistently learning. And so, my recommendation is always first, you listen to your teams inside your company. So, regular reports from the CIO or your chief information security officer to the board are critical. Where they inform about where is the situation, how is the company improving, but also very transparently if something happened, and making sure that you spend the time to afterwards reflect, what would you do differently? Which are the lessons learned? Secondly, in the boards I'm engaged with, we always have very constructive discussion on cybersecurity with our auditors. They usually do have specialized entities that are more than willing to come in and educate the board on the latest developments. And last but not least, there are many organizations that offer training programs, and I would recommend every board member to at least participate in one of those training programs focused on cybersecurity.
That was Helmut Ludwig. Next up, we'll speak with Calvin Butler. Every board eventually faces the moment when what customers need today and what the business needs for tomorrow start pulling in opposite directions. And there's no formula that resolves it. Calvin Butler, president and CEO of Exelon, oversees one of the largest utility holding companies in the country where affordability pressures and multi-decade infrastructure bets collide in real time, forcing exactly this kind of judgment call. In this segment, he joins us to talk about how directors can hold on to long-term conviction when everyone around the table is watching the next quarter and how to tell the difference between smart preparation for an uncertain future and an expensive bet that never pays off.
Calvin, customer affordability and long-term investment often pull in opposite directions. From a board perspective, how should directors evaluate those trade-offs without sacrificing either near-term trust or future competitiveness?
No, Bill, I love the way you frame the question, but I would tell you you can't sacrifice one of the other because I believe we need to look at them as a board as are they adding value to the customers that we have the privilege and responsibility to serve because from an investment standpoint for us, reliability is foundational. So then the affordability the customers are experiencing it and you can't just negate what they're feeling. So what we have tried to do is express it in terms of the value offering of what the company is bringing to the table and what if you did not do X, that will be the consequence. And then say, can we partner together to come to a mutual conclusion? Because it's not going away anytime. Customers and the communities are feeling the strain in this high interest rate environment and the cost of everyday goods going up. So, from a management and a board perspective, you have to address that issue proactively and be very intentional about your efforts.
