Ai security reaches the boardroom

Why Ai risk is now a board-level issue

Ai and cyber security are no longer just IT topics. In a speech on 12 Oct 2026, Kanishka Narayan, the UK’s Minister for Artificial Intelligence, said he wants “cybersecurity discussed in every boardroom in Britain, rather than simply delegated to middle management.”

He also set out how government plans to respond as Ai changes the cyber threat, including through the Cyber Security and Resilience Bill. For business owners, operations and finance leaders and public sector buyers, the message is simple: Ai risk is now a leadership issue. Here’s what was said, and what you can do about it now.

What the minister said

The speech covered a lot of ground, but a few points stand out for organisations using Ai day to day:

• Incident reporting. The minister said the Cyber Security and Resilience Bill “gives us an opportunity” to strengthen the rules, including “identifying and reporting on serious incidents and near misses”.
• Agentic Ai. Government will develop ways to respond to incidents involving Ai agents (Ai tools that can take actions on their own), working with the National Cyber Security Centre (NCSC) and the Ai Security Institute.
• A real example. He described an incident in Australia where an OpenAI agent, looking for information about public spending on medicines, gained access to information it was not authorised to have, without being asked to do so.
• A changing threat. He warned that Ai will almost certainly make parts of cyber intrusion more effective and efficient.

Ai is helping defenders too

It wasn’t all warnings. Across two government pilots, frontier Ai helped identify and address more than 1,000 vulnerabilities. A central monitoring service also cut the time taken to fix identified weaknesses from 50 days to just eight.

That second figure is the one to remember. Finding weaknesses is only half the job: what protects you is how quickly they’re fixed. Clear ownership, good visibility and a steady patching routine make the difference.

What this means for your organisation

Many teams are already using Microsoft 365 Copilot, chat assistants or early Ai agents, and adoption can easily outpace policy. These tools can reach emails, files and systems, so the question of who is accountable for them belongs at board level, not just with IT.

The speech didn’t set out exactly how any new reporting rules will work or who they will cover. But the direction is clear. Organisations that already know where Ai is used, who owns the risk and how quickly they fix problems will be in a far better position, whatever the final detail.

Four steps to take now

1. Brief your board

Make cyber security and Ai a standing item on the board or senior leadership agenda, with a named owner. Ask for a short, regular update covering incidents, near misses, patching times and the Ai tools in use. Start recording near misses now, so you have a habit in place if reporting becomes a requirement.

2. Map your Ai tools

List the Ai tools your organisation uses, who uses them and what data they can reach. Include free tools staff may have signed up to themselves. You can’t manage risk you can’t see, and this list is the foundation of a sensible Ai policy.

3. Limit agent access

Ai tools should only reach the data and systems they need. Before rolling out Copilot or Ai agents more widely, review permissions in Microsoft 365 so sensitive files aren’t open to everyone. For agents that can take actions, keep a person in the loop for anything that moves money, shares data or changes systems.

4. Patch faster

Measure how long it takes to fix known weaknesses, then set targets to bring that down, especially for critical updates. Central monitoring helps close the gap, as the government pilots showed, and automated patching takes routine updates off your team’s plate.

How Flotek can help

Flotek work with partners across the UK to keep their IT, cyber security and communications joined up and well run. As a Microsoft Cloud Partner, we can help you review how Ai is being used across your organisation, tighten Microsoft 365 permissions before a Copilot rollout, and put monitoring and patching in place that your board can see and trust.

If Ai and cyber risk are heading for your boardroom, we’d love to help you get ready. Speak to Flotek.

Source: Kanishka Narayan MP, Minister for Artificial Intelligence, “Building a Safer, More Secure Britain in the age of AI”, speech published on GOV.UK, 12 Oct 2026. Read the full speech on GOV.UK.

Further reading

• ICO turns its attention to Ai agents
• Cyber Essentials requirements: the 5 controls
• Scan your domain: free email security report