The director's blind spot: your personal digital life is now a governance risk

During the course of 25 years in the cybersecurity industry I have been asked to look at the personal digital exposure of a number of Australian directors, and of the families around them. The pattern repeats often enough to be worth writing down.

It usually starts in the same place. The director has spent three or four years being told that cyber risk is a board matter rather than an IT matter, and that message has landed. The board papers carry a cyber section now. There is a dashboard. The security team presents quarterly, and the questions coming back at them are better than they were five years ago.

Then I ask where those board papers are actually read, and the uncomfortably frequent answer is a personal laptop or iPad, on a home network that has not been touched since the technician set it up.

That is not a criticism of anyone in particular. It is a structural gap, and it persists because nobody owns it. A company's security team cannot reach into a director's home, and most would prefer not to try - the liability line is unclear and the request is uncomfortable on both sides. The director, meanwhile, assumes it is handled, because everything else in their professional life is handled. Nobody has been negligent. The gap sits there all the same.

What has changed is the level of interest in it.

For a long time the economics did not favour going after an individual. Compromising a company gave access to thousands of records; compromising a person gave access to one. That calculation has inverted. Corporate perimeters have hardened, detection has improved, and the cost of an enterprise intrusion has risen sharply. The perimeter around the person has not moved at all.

Overseas travel as part of a director's corporate life is becoming increasingly common, and with it can come a uniquely hostile environment and threat actors who thrive on their 'home ground advantage' at every possible opportunity.

In one recent engagement, working entirely from public sources and historic breach data, we were able to establish a director's home address, the names of their children, and the school those children attended, in an afternoon. Nothing we used was obtained illegally. Nothing required contact with the family. The exercise was uncomfortable precisely because it was so ordinary.

The response I hear most often, when I raise this with a board, is that the company's security team has it covered.

They do not, and they cannot.

They cannot, because the mandate stops at the company's edge. A CISO who starts hardening a director's home router is working outside their authority, outside their insurance, and inside somebody's house. Most of the ones I know have the sense not to. The few who try find that the conversation is awkward, that it never quite finishes, and that they have quietly acquired a responsibility they cannot discharge. The result is a category of risk that everyone can see and nobody is accountable for.

What the governance question actually is

It is worth being precise about the law here, because the loose version of this argument does it no favours, and a director will spot the difference.

Directors' duties have not changed. Section 180 has always required care and diligence, and nothing has been added to it for cyber. The case usually cited, ASIC v RI Advice Group, was decided under section 912A, which is an obligation on a financial services licensee rather than a duty owed by a director. To my knowledge no Australian court has yet found a director personally liable for a cyber failure.

That is not reassurance, and it is not meant as any. It is a description of where the line currently sits, and lines of this kind have tended to move in one direction. ASIC's expectation that boards actively oversee foreseeable cyber risk is already on the record. What has not been tested is what happens when the failure runs through a director's own accounts rather than the company's.

So the useful question for a board is not whether the law has caught up. It is narrower and more immediate: what does care and diligence look like when a material part of the organisation's exposure sits inside a director's house, and nobody in the organisation has the standing to go and look?

I have not yet sat in a boardroom where somebody had already asked it, which is understandable. It is not a question that arrives on an agenda. It arrives, if it arrives at all, in the middle of an incident.

Why this is not a technology problem

In my experience, once a director accepts the point, the instinct is to go looking for a product. A better router. A password manager. A monitoring service with a reassuring name.

Those things have their place, and none of them addresses the actual problem, which is that no individual person is responsible for the whole picture. A director's exposure is not a device. It is a set of relationships between accounts, family members, habits, service providers and history, most of it accumulated over twenty years without anyone designing it. Buying a component does not give it an owner.

I have come to think of it as closer to engaging counsel or a private physician than to buying software. You are not purchasing a tool. You are appointing someone whose job is to hold the whole picture, tell you the truth about it, and be there when something goes wrong.

What a proportionate response looks like

Not much, and not urgently, but deliberately.

Give it an owner. A single named person, outside the company, whose responsibility is the personal and family side. This is the step I would take first, because it is the one that converts an unowned risk into an owned one.

Start with what is already public. Before deciding what to change, find out what an interested party could assemble about you in an afternoon. In the work I have done it is usually more than the director expected, and occasionally less. Either way, exposure should be measured before it is managed.

Fix the unglamorous things first. Personal email and its recovery path, the accounts that unlock other accounts, the home network, the handful of services that hold everything else. Most of what we do here is configuration and habit rather than technology, and it is usually finished in weeks.

Extend it to the household, with consent. A director's exposure is rarely only their own. Adults participate by their own agreement, children are hardened rather than watched, and everyone is told what is happening before anything begins. A programme that quietly monitors a family is a different thing altogether, and not one I would want any part of.

None of this needs to be public, and none of it needs to be theatrical. The best work I have seen in this area is quiet, and its measure is that nothing happens.

The hardest step is not technical. It is accepting that you personally are now part of the security system you are supposed to be overseeing, and that the assurance you receive quarterly does not extend to you.

The next step is not to go looking for the best VPN. It is a conversation with someone whose work is to look after private clients and their families, and to be accountable for the whole of it.

Craig Searle has spent 25 years in cybersecurity across banking, government, technology and critical infrastructure. He is a founding partner of Praetos, a private protective service for private clients and their families.