Confidence in the Face of Weekly Attacks

Cyber attacks are no longer exceptional events. They are operational realities. Ransomware halts systems. Data breaches expose customers. Supply chains stall.

Yet most boards remain confident.

Joseph Hubback, Advisory Partner and CISO at Elixirr, reviewed research across roughly 1,000 companies. Ninety-four percent of boards said they felt comfortable with their security posture.

The statistic sits uneasily alongside the frequency of disruption.

“When the attack happens, the CISO will do all they can,” Joseph says, “but it’s the CEO and the executives that will be in the limelight.”

Cyber security, in that moment, becomes executive.

The issue is not whether frameworks exist. It is whether leadership understands what is truly at risk.

From Industrial Engineering to Cyber Governance

Joseph did not begin in cyber.

He started as an engineer, building chemical factories at ICI Plc. He later moved into commercial and strategic roles before becoming a partner at McKinsey & Company.

Security entered his career through client work in the late 2000s. It remained.

Today, at Elixirr, he advises clients globally while also serving internally as CISO. The combination keeps him close to both governance questions and operational exposure.

The Conversation Has Not Moved On

Executives often repeat that cyber security is no longer just a technical issue. It is a people issue. A leadership issue.

Joseph questions the novelty of that claim.

“Fifteen years ago we were talking about it as a people issue as much as anything else.”

In his view, the language has evolved without changing behaviour. Compliance frameworks have expanded. Certifications are widely pursued. Audit outcomes provide reassurance.

But attackers do not target frameworks. They target value.

The repetition of the insight has not produced structural change.

From Compliance to Asset Protection

Joseph believes education efforts are often misdirected.

Organisations train employees to recognise phishing emails and suspicious links. Attack techniques evolve constantly. The training ages quickly.

He proposes a simpler foundation: define the assets.

In the physical world, people instinctively protect wallets and keys. In the digital world, identity, data, intellectual property and operational systems carry equivalent weight. Yet many leadership teams have not clearly defined what must be protected first.

“If you explain to people what it is that is now important for them to protect,” Joseph says, behaviour changes.

At board level, this means identifying the value streams that generate revenue. Which digital systems enable trading. Which processes, if interrupted, would damage trust or liquidity.

In one client example, business leaders and security teams mapped these value streams together. The dynamic shifted. Security ceased to be viewed as “the department that says no” and became aligned with protecting continuity.

The conversation moved from standards to survival.

Comfort and Exposure

The 94 percent confidence figure remains central.

Boards often equate completed controls with resilience. Certifications and dashboards provide comfort.

Yet when an attack occurs, decisions escalate immediately.

Do we shut systems down.
Who do we inform first.
How do we communicate with customers.
How do we coordinate employees across regions.

“It becomes a collective exercise,” Joseph says. “When an attack happens, you’ll all be involved.”

The exposure is visible. Accountability shifts to the executive team.

Confidence, in that moment, is tested.

From Collaboration to Commitment

Collaboration is frequently cited as the solution.

Industry forums convene. Information is shared. Best practice circulates.

Joseph supports information exchange. He questions whether it goes far enough.

He points to the response following the NotPetya attack on DLA Piper. Clients and competitors provided practical support. Capacity was shared. Documentation was restored. Recovery depended on those relationships.

That cooperation was operational.

Joseph argues that organisations should define such arrangements in advance. Who provides temporary infrastructure. Who safeguards data copies. How supply chains will respond if one party is incapacitated.

Without defined commitments, resilience relies on goodwill.

The distinction is subtle but material. Discussion is not the same as agreement.

Urgency After the Breach

Joseph has observed a pattern.

Following a significant attack, executive attention intensifies. Investment rises. Governance improves. The urgency lasts three to four years.

Then it fades.

Digital transformation, however, continues to expand exposure. Cloud infrastructure grows. Systems integrate further. Ecosystems interconnect.

Risk compounds faster than memory.

Cyber security, Joseph argues, is not primarily a technology problem. It is a governance question.

“When the attack happens,” he says, “it’s the CEO and the executives that will be in the limelight.”

Preparation is quiet. The breach is public.

The distance between those two moments is leadership.

​Scene and Context

Many organisations are busy without being effective. Projects multiply, initiatives overlap, and leaders spend increasing time maintaining activity rather than assessing whether it still serves a clear aim. The result is rarely failure. More often, it is a slow dilution of attention.

John describes this as a leadership problem rather than a structural one. In his view, organisations now operate in conditions that reward visibility and speed over judgment.

Quarterly cycles, constant commentary, and social media noise all push leaders toward doing more, not deciding better.

What suffers is focus. Projects continue not because they work, but because stopping them feels harder than starting something new.

Early discipline and formation

John’s understanding of leadership did not come from business school. He grew up in rural Shropshire, entered work through retail banking, and then chose to become an infantry officer. For ten years, he served in the army, operating in situations where decisions had immediate consequences for others.

That experience shaped his view of responsibility.

Leadership, he learned, was not about visibility or personal advancement, but about making clear decisions under pressure and being accountable for their outcomes.

Those lessons stayed with him as he moved into work at the intersection of business, government, and civil society, including a decade working with the then Prince of Wales, now King Charles III, on programmes linking business leadership to social and environmental concerns.

Accumulating experience across systems

Over the next three decades, John moved between roles that rarely sit together on a conventional career path. He led non-profit initiatives, built his own advisory business, and later became EMEA managing partner at Omnicom.

Rather than specialising in one sector, he accumulated exposure to how decisions are made across different systems. He worked with large corporations, charities, public bodies, and founders.

Over time, a pattern became clear to him. Activity was often mistaken for progress.

Organisations launched initiatives that looked responsible or innovative but sat alongside incentives that rewarded entirely different behaviour. In those moments, John became increasingly sceptical of programmes that existed at the margins rather than shaping core decisions.

Founding Anthropy

The pandemic sharpened that scepticism. Watching the strain placed on Britain’s social and economic fabric, John became concerned about how leaders were thinking about recovery and long-term direction.

In response, he founded Anthropy. Anthropy was conceived not as a conference business, but as a national leadership gathering focused on Britain’s long-term future. It brings together leaders from business, government, civil society, and younger generations.

The gathering takes place at the Eden Project, with sessions held inside the biomes rather than traditional conference spaces.

The environment is deliberate. It slows the pace and changes how conversations unfold.

Anthropy now involves thousands of participants, hundreds of speakers, and a significant emerging leaders programme for those aged eighteen to thirty. John describes this group as one of the most serious and hopeful aspects of the gathering.

The difficulty of stopping

John is clear that leadership failure rarely comes from backing the wrong idea. It more often comes from not knowing when to stop.

He distinguishes between three types of projects. Some succeed clearly. Some fail visibly.

The hardest are those that sit in the middle, producing just enough activity to justify their continuation without delivering meaningful results.

In his own career, John describes initiatives he allowed to fade once it became clear they would not deliver the collective impact he had hoped for. Ending them was not dramatic. It required detachment rather than urgency.

He notes that organisations routinely apply sell-by dates to products but almost never to internal initiatives. Without agreed endpoints, projects persist through habit and emotional attachment rather than relevance.

Purpose as a practical filter

For John, purpose is not a slogan or a communications device. It is a tool for decision-making.

When an organisation is clear about why it exists, decisions become simpler. Opportunities that sit outside that purpose can be declined without debate. Authority can be delegated because people understand the criteria behind decisions.

He contrasts this with organisations where purpose is displayed everywhere but shapes nothing.

In those cases, slogans coexist with incentives that reward contradictory behaviour. The result is not cynicism, but underperformance.

Employees can work without clarity. They work better with it. Purpose, when taken seriously, reduces distraction and narrows focus.

The unresolved tension

Despite progress in how organisations talk about responsibility, John remains concerned about short-termism. Quarterly reporting, constant media cycles, and performative leadership push decision-making toward immediacy rather than durability.

He believes this is as much a cultural issue as an economic one. Leaders are rewarded for speed, reaction, and visibility.

Maturity and restraint receive less attention.

Yet he remains optimistic. Through Anthropy’s emerging leaders programme, John sees younger leaders already practising a slower, more deliberate form of leadership. They are less interested in performance and more concerned with consequence.

Closing reflection

Modern organisations are not short of ideas. They are short of judgment.

Responsible leadership, in John’s view, requires fewer initiatives, clearer decisions, and the discipline to stop.

In an environment that rewards noise, responsibility may begin with restraint.

​Scene and Context

Executive search is under pressure.

Clients want speed, certainty, and scale. Artificial intelligence promises all three.

In leadership hiring, the stakes are higher than efficiency. Decisions shape culture, strategy, and long-term outcomes. In sectors like food and agriculture, they also shape health and environmental impact.

As AI tools move quickly into recruitment, the question is no longer whether they will be used. The question is where judgment should still sit with people.

Formation and Origins

Simon Heal did not begin his career in sustainability or food systems. He trained as a computer scientist and spent more than two decades in mainstream executive search, building leadership teams for IT, e-commerce, and fintech businesses. He describes himself as a technologist who moved into people work because he was drawn to detail, pattern, and character rather than sales.

The shift came later. About six years ago, his young son came home from school after watching a documentary on climate change. Simon recalls being asked directly what he was doing to help. The question stayed with him. He began to examine where his skills could have real effect.

“What am I really good at?” he remembers asking himself.

The answer was clear. Building teams. Finding leaders. Understanding potential.

A Turning Point Toward Food Systems

Food and agriculture stood out. Simon grew up in Cheshire, surrounded by farming. His grandfather was a farmer. The industry felt familiar and increasingly urgent. He saw a sector under strain, doing significant harm, but also entering a period of rapid innovation.

Rather than work broadly across the industry, he narrowed his focus. Simon chose to work only with companies aiming to shift outcomes, not simply improve optics. That decision led to the founding of Myco Search, a specialist executive search firm serving food tech, agri-food tech, and food health innovators.

The positioning is deliberate. Candidates know the companies are serious. Founders know the candidates are motivated by impact as well as role.

The Work He Is Doing Now

Myco Search focuses on leadership and specialist hires in emerging food technologies. Many clients are early-stage or scaling businesses. The work involves risk. Technologies are new. Track records are limited. Commercialisation is uncertain.

Heal is explicit about those realities. His approach is open book. Candidates are told early where the risks sit and what could go wrong.

Founders are asked directly about weaknesses, gaps, and pressure points.

The goal is not to remove uncertainty, but to avoid surprises.

AI, Recruitment, and the Risk of Repeating the Past

Simon is a long-time user of technology and an advocate for AI used carefully. He sees clear value in using tools to expand research capacity, reduce administrative load, and surface wider pools of candidates.

Where he draws a firm line is judgment.

AI systems learn from historical data. In leadership hiring, that means past profiles, past success, and past patterns. Simon warns that this can quietly reinforce narrow definitions of leadership and filter out potential that does not yet have a record.

“AI is very good at spotting patterns,” he says. “It cannot spot potential.”

In emerging sectors like food tech, that limitation matters. Innovation often comes from people who do not fit existing templates. Over-reliance on automated screening risks narrowing thinking at the moment it needs to widen.

Simon deliberately includes what he calls a wildcard candidate in many shortlists. Someone who does not look right on paper, but shows conviction, learning capacity, and alignment with the mission. Sometimes they are hired. Sometimes they are not. They almost always sharpen decision-making.

The Tension That Remains

Food businesses remain driven primarily by profit. Simon sees this as the central structural tension. Cheap, damaging food is rewarded. Healthier, lower-impact models struggle for scale.

If he could change one thing, he would reverse the order. Human and planetary health first. Profit second.

He is realistic about constraints. Companies must survive. Investors expect returns. But he believes leadership choices can move systems, especially when capital and talent begin to align with long-term outcomes.

Closing Reflection

AI will continue to reshape executive search. Simon does not resist that shift.

He argues instead for clarity about where tools end and responsibility begins.

In leadership hiring, judgment remains the work. The cost of getting it wrong is not just commercial. In food systems, it reaches into health, land, and trust.

Speed matters. Empathy matters more.