Why cyber hygiene must become a core element of business operations and board-level risk management

Let’s turn transparency, explainability, and visibility into risk reduction

In the wake of high-profile attacks that continue to expose systemic gaps across sectors, the role of vendor transparency, explainable and sovereign AI, and supply chain visibility is no longer a ‘nice to have’ - it’s critical.

Many organisations still use static, checklist-style vendor assessments or questionnaires (often driven by their procurement teams) that are filled out once, filed away, and soon become outdated. This creates blind spots in your supply chain, which are ripe for exploitation.

What we’re now seeing is a shift toward the use of trust centres/portals. These are centralised, real-time dashboards providing visibility into compliance and regulatory certifications, patching status, threat intelligence feeds, network access logs and security statements. This model enables clients to access and verify key information independently, transforming traditional due diligence into a continuous assurance process.

For transformation and risk leaders, this means a fundamental shift: vendors should now be considered part of an organisation’s continuous monitoring ecosystem, not a ‘set and forget’ risk, once they are onboarded. This real-time transparency allows organisations to ask the right questions or obtain information at speed. Embedding these portals into third-party risk frameworks can create early warning capabilities rather than relying on annual audits. It also strengthens the business case that higher vendor transparency means fewer unknowns, lower residual risk, and stronger alignment with overall business objectives.

Explainable, governed and sovereign AI - Unlocking innovation without risk

Innovation via AI is pressing ahead at speed, and regulated industries cannot afford to be held back by fear. But the risk is very real: poorly governed AI systems can expose organisations to model vulnerabilities, data sovereignty violations, biased and opaque decision-making - each carrying regulatory and reputational implications.

The answer lies in designing (or investing) in AI systems that are explainable, governed through proper controls, version controls, audit trails, human oversight, and sovereignty, ensuring data remains within agreed jurisdictions and under contractual and technical control. For business and transformation leaders, the opportunity is clear: AI can be an enabler, but only when treated as a risk domain.

From a BISO [Business Information Security Officer] lens, organisations should advocate for:

• Model provenance and documentation (‘Why did this decision come out this way?’).
• Access controls and logging around the AI pipelines.
• Data-supply-chain mapping (what data went in, who has access, and where it is stored).
• Third-party vendor/sub-model transparency, especially when using external AI as a service.
• Sovereignty controls to ensure cross-border data flows don’t undermine your regulatory posture.

Linking cyber hygiene with vendor accountability during Cybersecurity Awareness Month

Traditionally, Cybersecurity Awareness Month has focused on employees. Phishing simulations, risk-awareness posters, and training modules are all vital, but they are no longer enough. Risk and transformation leaders must turn that lens outward and embed vendor accountability, transparency, and third-party trust into the culture of cyber hygiene.

As organisations plan awareness initiatives, they should highlight the role of the vendor ecosystem in managing cyber risk and demonstrate how trust portals are changing third-party oversight. Many business leaders assume that once a vendor is onboarded, the associated risk is static. In reality, vendor cybersecurity directly influences organisational resilience. Embedding this understanding into awareness programmes can help shift the perception that third-party risk ends at onboarding.

Three actions to champion during Cybersecurity Awareness Month and beyond are:

• Communicate to business units and procurement teams that vendor transparency equals controllable risk.
• Showcase how explainable/sovereign AI is part of our future roadmap and that the same scrutiny we apply internally extends to our partners.
• Elevate supplier visibility as a control metric, just like patch rates, MFA adoption, and endpoint health.

Leaders should allocate governance time, executive sponsorship, and budget to third-party visibility initiatives right now. When vendors fail to maintain adequate controls, adversaries will slip in through that gap, and the business is left holding the reputational damage. Strengthening vendor accountability is therefore not just good cyber hygiene - it is essential business risk management.

That’s why these issues - partnering with vendors, challenging AI systems, and elevating supply chain visibility - should be considered as board-level risk priorities.

Whether the next incident is an AI model manipulation, a vendor supply chain breach, or simply undiscovered drift in a partner’s control posture, the result will be the same - business interruption, regulatory scrutiny, and reputational damage. Let’s turn transparency, explainability, and visibility into risk reduction and enable innovation without higher risk exposure.

Holly Foxcroft is Cybersecurity Business Partner at OneAdvanced.