Work with me · Director workshop
Your board answers for cyber and AI risk. One day to know what to ask.
In October 2026, attackers switched off the refrigeration in hundreds of French supermarkets through controllers left on the internet with weak passwords. Three weeks later it happened in Belgium. That is equipment that rarely appears on the cyber report a board reads. After 27 years in cybersecurity, this is the day I would want every board I sit with to have had.
The day
Four blocks. The morning trains, the afternoon decides.
- 01
What the board answers for
Which cyber and AI risks sit with the board, and which duties already apply?
Cyber and AI risk in plain English: what is new with AI, what is the same old exposure with a new name, and the duties already on the table. NIS2 Article 20 in the EU, the UK Cyber Governance Code, the SEC disclosure rules in the US, and the EU AI Act where you deploy AI.
- 02
What the board is shown
What does your cyber and AI reporting cover, and what does it leave out?
We map your own board reporting against what you run. Connected equipment that facilities and contractors own, supplier remote access, AI tools bought outside IT. In my experience, most boards learn here that their report is accurate about less than they thought.
- 03
Decisions under pressure
When it happens, who decides, and what does the board ask first?
The board plays decisions from The Governance Game, set in your sector: a peer attacked through equipment you also run, a fix deferred one time too many, a notification clock running, an AI agent acting on a human’s login. Every choice is scored against the frameworks regulators read: NIST CSF 2.0, NIST AI RMF, the CIS Controls, NIS2 and the EU AI Act.
- 04
What changes on Monday
What does the board ask management for before the next meeting?
The questions for your CISO and management, a named owner for each gap the morning found, and the two or three items that go on the next board agenda.
What the board leaves with
The questions. Then the owners.
Each director leaves knowing what to ask after a critical vulnerability, an attack on a peer or an AI incident, and what a good answer sounds like. The two-page CISO board brief is the template, filled in for your company.
The chair leaves with the map: what your reporting covers, what it leaves out, and who owns each gap, with a date. Nobody gets a slide deck of threat statistics.
How it runs
Four steps. The day is fixed at the second.
- 01 20 minutes
The call
You tell me who sits on the board, what you run and what is worrying you. I tell you whether this day is the right tool, and if it is not, what is.
- 02 In writing
The day is fixed
Date, attendees, the sector the scenarios are set in, and the reporting I read beforehand: your latest cyber report to the board and an extract of the risk register. Agreed on paper before anything else happens.
- 03 One day, onsite
The workshop
In your boardroom. Training in the morning, your own company in the afternoon. Directors play the scenarios together, so the argument about who decides happens in the room rather than during the incident.
- 04 Within a week
The written summary
A short summary for the chair: the reporting map, the owners and dates agreed in the room, and the questions the board will put to management. Yours to keep, and to hold management to.
Before you book.
Is this training or advisory?
Both, in that order. The morning trains the directors on what they need to know about cyber and AI risk. The afternoon applies it to your company, with your own reporting on the table, so the training turns into decisions before the day ends.
Who should attend?
The full board, if you can. The CEO, the CISO and the general counsel join for the afternoon, because the scenarios turn on who decides and they are the people the board would turn to. A committee-only day works too.
Does this cover the NIS2 training duty for management bodies?
NIS2 Article 20(2) requires members of the management bodies of in-scope entities to follow training that lets them identify risks and assess cybersecurity risk-management practices. The day is built for that purpose and you get an attendance record. Whether it meets your national authority’s expectations is for your counsel to confirm.
How long does it take, and what does it cost?
One day onsite, plus the call and a week for the summary. The fee is fixed in writing before you commit, and it depends on the size of the board and the travel. There is no hourly meter running.
Can it be shorter, or remote?
The half-day board briefing on the main advisory page is the shorter option, and it runs remotely. This workshop stays onsite and a full day because the afternoon only works with the board in one room.
Start here
Most boards learn this after the incident. Book the call before.
Pick a slot below and it lands in my calendar with a Teams link attached. Nothing to prepare. Tell me about your board and what worries you, and you will leave the call knowing whether this day is the right next step.
Rather write? fredrik@fredriklindstrom.info. I read every message and reply within a few days.