Special Episode - From the Server Room to the Boardroom: AI, Identity and the Cyber Risks Directors Can’t Ignore

Presented by Okta

 

Cyber security has become a core governance issue, not just an IT problem. In this episode, Mathew Graham, Chief Security Officer for Asia–Pac at Okta, explains why identity is now the front line of security — and what that means for directors. He outlines how cyber risk has shifted from firewalls to cloud systems, remote work and interconnected supply chains, where most breaches now begin with compromised credentials.

 

Mathew clarifies the board’s role in setting risk appetite, shaping a culture of security, and holding management accountable through clear, risk‑focused reporting. He challenges common misconceptions (“compliant = secure”) and highlights the danger of relying on a single tech provider.

 

He also explores AI’s dual edge — accelerating attacks and strengthening defence — and why non‑human identities like bots and AI agents must be secured. Finally, Mathew shares practical steps: stronger MFA, regular simulations and one big question every board should ask — who has access to our most critical data?

 

Key Takeaways:

 

·       From tech issue to business risk — why cyber has moved from the server room to the boardroom, with identity now the critical perimeter.

·       Board vs management roles — the board sets the “what” and “why” (risk appetite, culture of security); management owns the “how”.

·       Good cyber reporting — concise, risk-focused dashboards over jargon-heavy reports; red flags when leaders can’t answer “who has access to what?”.

·       SMEs and NFPs — how resource-constrained organisations can use ACSC guidance, baseline controls and targeted investment to lift their posture.

·       AI as accelerator — attackers using AI for better phishing, faster vulnerability discovery and malware, while defenders use AI for anomaly detection.

·       Non-human identities & supply chain risk — bots and AI agents as new identities to secure, and why many major breaches now start with a third party.