Digital risk is capital risk: what one of our judges wants boards to see

Ask a board how exposed the organisation is to a digital attack and the answer usually arrives as a list. Firewalls, an endpoint platform, last year's audit, a maturity score that went up. Every item on it is true. None of it tells the directors what they actually need to know, which is how much of the company's value is sitting on assumptions nobody has tested.

That is the argument Naveen Vasudeva set out in December 2025, in a piece carried on USA Today's press-release pages under the title Digital Risk Has Become a Capital Risk, Leaders Need a Modern Remodel. Vasudeva is a risk strategist who has advised global banks, FTSE 100 companies, Fortune 500 boards, sovereign institutions and private equity investors for some thirty years. He is also one of the 30 judges who read every nomination for the Cyber Security Awards.

His case is short, and uncomfortable for anyone who reports upwards.

What does "digital risk is capital risk" mean?

It means a weakness in systems, people or suppliers now shows up in the numbers that owners and investors care about: valuation, insurability, regulatory scrutiny and confidence. Vasudeva's view is that digital risk is becoming one of the main drivers of all four. A breach no longer stays in the IT budget. It reaches the share price, the insurance renewal, the regulator's letter and the next funding round.

If that is right, the people who measure digital risk are measuring something that belongs on the balance sheet. Most organisations still measure it as a technical problem, with technical instruments, reported through technical channels.

The problem he names is visibility

Vasudeva's central claim is that leaders are rarely short of capability. They are short of sight. In his framing the core issue is "not capability but visibility": what reaches the board has been shaped on the way up by reporting lines, optimistic assumptions, internal politics and incomplete data. Decisions that look risk-based, he argues, are often assumption-based.

Anyone who has written a quarterly security report will recognise the mechanics. The analyst sees the unpatched legacy server. The team lead softens the wording. The director rolls it into an amber line. By the time it reaches the board, it reads as "managed".

Nobody lied. The risk simply did not survive the journey.

Three kinds of exposure that rarely meet

Vasudeva sorts the exposures leaders miss into three groups. The useful part is less the list than the observation that each one is usually owned by a different department, and nobody adds them up.

• Digital. Assets nobody has catalogued, cloud configurations that have drifted, suppliers with access nobody manages, legacy systems, and weaknesses inherited through acquisitions. These decide how likely and how large a disruption could be.
• Behavioural. The habits that bend information before it reaches a decision: reports that never get filed, escalation that comes late, overconfidence, softened messages, accountability that sits in the wrong place. He notes these exist in every major organisation and are almost never measured.
• Geopolitical. Dependence on outside forces: conflicting jurisdictions, regulation that pulls in different directions, state-linked cyber activity, and too much reliance on a handful of vendors. Conventional security frameworks, he argues, cannot put a number on these at all.

His own answer, which he calls Strategic Capital Risk Intelligence, combines the three into one view and reports it as business consequence rather than control maturity. Whether or not a reader adopts the model, the principle travels well. A security posture that is excellent in one column and blind in the other two is a partial picture, and partial pictures are what boards tend to sign off.

Who needs to hear it

Vasudeva addresses the argument to a wider audience than security teams usually write for. Chief executives, he suggests, need to see the blind spots that could interrupt the business or erode its value. Board chairs need to see where the governance framework and the real exposure have drifted apart. Founders should look for inherited weaknesses that could cut their exit value, and private equity and venture investors for the risks standard due diligence does not test.

It is a deliberate reframe. Security leaders have spent years asking for a seat at the board table. His argument suggests the seat is only worth having if they arrive speaking the board's language, which is capital.

What the panel reads for

This matters to the programme for a plain reason. Vasudeva is one of the people who will read the 2027 nominations, and the published criteria for the Cyber Security Leader category ask for evidence of the ability to engage teams, stakeholders and board members, and to communicate with technical and non-technical audiences alike.

A nomination that lists the tools a leader bought tells the panel very little. One that shows a leader who got an unwelcome finding to the board intact, who put a number on an exposure the organisation had been calling "managed", or who built a team where analysts escalate early because they know it will not be held against them, tells the panel a great deal. That is the visibility Vasudeva is writing about, made concrete in one person's work.

He has carried the same message beyond the boardroom. In late 2025 he was announced as a voice on cyber and governance at Cambodia's Digital Government Forum, one of the programme's conference partners.

Somewhere in most organisations there is an analyst who wrote the uncomfortable sentence first, and a leader who made sure it reached the people who could act on it. If you work with either of them, nominations for the 2027 Awards open on 1 December.

Sources

• Naveen Vasudeva, Digital Risk Has Become a Capital Risk, Leaders Need a Modern Remodel, press release, 4 December 2025: USA Today · FinancialContent
• Announcement of Naveen Vasudeva at Cambodia's Digital Government Forum, December 2025: Barchart
• Cyber Security Awards, Cyber Security Leader criteria and judging panel