18 April 2026 · 5 min read
Boards in emerging markets have made real progress on cyber risk awareness. Most board packs now include a cybersecurity update; most audit committees now ask about incident response. The gap we consistently see is not awareness, it's translation. Awareness has not yet become governance.
A governance structure that can act on cyber risk looks different from one that merely discusses it. It has a defined risk appetite statement specific to cyber exposure, not folded into generic operational risk. It has clear escalation thresholds that trigger board-level involvement before an incident, not only after one becomes public. And it has an incident response plan that has actually been tested, not one that exists only as a document.
The institutions we see perform best under pressure are the ones that treated cyber governance as an ongoing capability to build, not a compliance exercise to complete. That distinction, capability versus compliance, is the one boards in emerging markets most need to internalise over the next several years.