Confidence in the Face of Weekly Attacks

Cyber attacks are no longer exceptional events. They are operational realities. Ransomware halts systems. Data breaches expose customers. Supply chains stall.

Yet most boards remain confident.

Joseph Hubback, Advisory Partner and CISO at Elixirr, reviewed research across roughly 1,000 companies. Ninety-four percent of boards said they felt comfortable with their security posture.

The statistic sits uneasily alongside the frequency of disruption.

“When the attack happens, the CISO will do all they can,” Joseph says, “but it’s the CEO and the executives that will be in the limelight.”

Cyber security, in that moment, becomes executive.

The issue is not whether frameworks exist. It is whether leadership understands what is truly at risk.

From Industrial Engineering to Cyber Governance

Joseph did not begin in cyber.

He started as an engineer, building chemical factories at ICI Plc. He later moved into commercial and strategic roles before becoming a partner at McKinsey & Company.

Security entered his career through client work in the late 2000s. It remained.

Today, at Elixirr, he advises clients globally while also serving internally as CISO. The combination keeps him close to both governance questions and operational exposure.

The Conversation Has Not Moved On

Executives often repeat that cyber security is no longer just a technical issue. It is a people issue. A leadership issue.

Joseph questions the novelty of that claim.

“Fifteen years ago we were talking about it as a people issue as much as anything else.”

In his view, the language has evolved without changing behaviour. Compliance frameworks have expanded. Certifications are widely pursued. Audit outcomes provide reassurance.

But attackers do not target frameworks. They target value.

The repetition of the insight has not produced structural change.

From Compliance to Asset Protection

Joseph believes education efforts are often misdirected.

Organisations train employees to recognise phishing emails and suspicious links. Attack techniques evolve constantly. The training ages quickly.

He proposes a simpler foundation: define the assets.

In the physical world, people instinctively protect wallets and keys. In the digital world, identity, data, intellectual property and operational systems carry equivalent weight. Yet many leadership teams have not clearly defined what must be protected first.

“If you explain to people what it is that is now important for them to protect,” Joseph says, behaviour changes.

At board level, this means identifying the value streams that generate revenue. Which digital systems enable trading. Which processes, if interrupted, would damage trust or liquidity.

In one client example, business leaders and security teams mapped these value streams together. The dynamic shifted. Security ceased to be viewed as “the department that says no” and became aligned with protecting continuity.

The conversation moved from standards to survival.

Comfort and Exposure

The 94 percent confidence figure remains central.

Boards often equate completed controls with resilience. Certifications and dashboards provide comfort.

Yet when an attack occurs, decisions escalate immediately.

Do we shut systems down.
Who do we inform first.
How do we communicate with customers.
How do we coordinate employees across regions.

“It becomes a collective exercise,” Joseph says. “When an attack happens, you’ll all be involved.”

The exposure is visible. Accountability shifts to the executive team.

Confidence, in that moment, is tested.

From Collaboration to Commitment

Collaboration is frequently cited as the solution.

Industry forums convene. Information is shared. Best practice circulates.

Joseph supports information exchange. He questions whether it goes far enough.

He points to the response following the NotPetya attack on DLA Piper. Clients and competitors provided practical support. Capacity was shared. Documentation was restored. Recovery depended on those relationships.

That cooperation was operational.

Joseph argues that organisations should define such arrangements in advance. Who provides temporary infrastructure. Who safeguards data copies. How supply chains will respond if one party is incapacitated.

Without defined commitments, resilience relies on goodwill.

The distinction is subtle but material. Discussion is not the same as agreement.

Urgency After the Breach

Joseph has observed a pattern.

Following a significant attack, executive attention intensifies. Investment rises. Governance improves. The urgency lasts three to four years.

Then it fades.

Digital transformation, however, continues to expand exposure. Cloud infrastructure grows. Systems integrate further. Ecosystems interconnect.

Risk compounds faster than memory.

Cyber security, Joseph argues, is not primarily a technology problem. It is a governance question.

“When the attack happens,” he says, “it’s the CEO and the executives that will be in the limelight.”

Preparation is quiet. The breach is public.

The distance between those two moments is leadership.

​Scene and Context

Many organisations are busy without being effective. Projects multiply, initiatives overlap, and leaders spend increasing time maintaining activity rather than assessing whether it still serves a clear aim. The result is rarely failure. More often, it is a slow dilution of attention.

John describes this as a leadership problem rather than a structural one. In his view, organisations now operate in conditions that reward visibility and speed over judgment.

Quarterly cycles, constant commentary, and social media noise all push leaders toward doing more, not deciding better.

What suffers is focus. Projects continue not because they work, but because stopping them feels harder than starting something new.

Early discipline and formation

John’s understanding of leadership did not come from business school. He grew up in rural Shropshire, entered work through retail banking, and then chose to become an infantry officer. For ten years, he served in the army, operating in situations where decisions had immediate consequences for others.

That experience shaped his view of responsibility.

Leadership, he learned, was not about visibility or personal advancement, but about making clear decisions under pressure and being accountable for their outcomes.

Those lessons stayed with him as he moved into work at the intersection of business, government, and civil society, including a decade working with the then Prince of Wales, now King Charles III, on programmes linking business leadership to social and environmental concerns.

Accumulating experience across systems

Over the next three decades, John moved between roles that rarely sit together on a conventional career path. He led non-profit initiatives, built his own advisory business, and later became EMEA managing partner at Omnicom.

Rather than specialising in one sector, he accumulated exposure to how decisions are made across different systems. He worked with large corporations, charities, public bodies, and founders.

Over time, a pattern became clear to him. Activity was often mistaken for progress.

Organisations launched initiatives that looked responsible or innovative but sat alongside incentives that rewarded entirely different behaviour. In those moments, John became increasingly sceptical of programmes that existed at the margins rather than shaping core decisions.

Founding Anthropy

The pandemic sharpened that scepticism. Watching the strain placed on Britain’s social and economic fabric, John became concerned about how leaders were thinking about recovery and long-term direction.

In response, he founded Anthropy. Anthropy was conceived not as a conference business, but as a national leadership gathering focused on Britain’s long-term future. It brings together leaders from business, government, civil society, and younger generations.

The gathering takes place at the Eden Project, with sessions held inside the biomes rather than traditional conference spaces.

The environment is deliberate. It slows the pace and changes how conversations unfold.

Anthropy now involves thousands of participants, hundreds of speakers, and a significant emerging leaders programme for those aged eighteen to thirty. John describes this group as one of the most serious and hopeful aspects of the gathering.

The difficulty of stopping

John is clear that leadership failure rarely comes from backing the wrong idea. It more often comes from not knowing when to stop.

He distinguishes between three types of projects. Some succeed clearly. Some fail visibly.

The hardest are those that sit in the middle, producing just enough activity to justify their continuation without delivering meaningful results.

In his own career, John describes initiatives he allowed to fade once it became clear they would not deliver the collective impact he had hoped for. Ending them was not dramatic. It required detachment rather than urgency.

He notes that organisations routinely apply sell-by dates to products but almost never to internal initiatives. Without agreed endpoints, projects persist through habit and emotional attachment rather than relevance.

Purpose as a practical filter

For John, purpose is not a slogan or a communications device. It is a tool for decision-making.

When an organisation is clear about why it exists, decisions become simpler. Opportunities that sit outside that purpose can be declined without debate. Authority can be delegated because people understand the criteria behind decisions.

He contrasts this with organisations where purpose is displayed everywhere but shapes nothing.

In those cases, slogans coexist with incentives that reward contradictory behaviour. The result is not cynicism, but underperformance.

Employees can work without clarity. They work better with it. Purpose, when taken seriously, reduces distraction and narrows focus.

The unresolved tension

Despite progress in how organisations talk about responsibility, John remains concerned about short-termism. Quarterly reporting, constant media cycles, and performative leadership push decision-making toward immediacy rather than durability.

He believes this is as much a cultural issue as an economic one. Leaders are rewarded for speed, reaction, and visibility.

Maturity and restraint receive less attention.

Yet he remains optimistic. Through Anthropy’s emerging leaders programme, John sees younger leaders already practising a slower, more deliberate form of leadership. They are less interested in performance and more concerned with consequence.

Closing reflection

Modern organisations are not short of ideas. They are short of judgment.

Responsible leadership, in John’s view, requires fewer initiatives, clearer decisions, and the discipline to stop.

In an environment that rewards noise, responsibility may begin with restraint.