The Cost of Waiting: Why Cyber Risk Belongs in the Board's Capital Allocation Conversation

Mining automation, expanding attack surfaces, inflation, and the governance decisions that cannot wait for the next assessment.

10/23/202615 min read

Boards are navigating difficult capital allocation decisions such as inflation, financing costs, and technological change and that means multiple competing demands on available resources. Meanwhile, industrial operations are becoming more connected, introducing new dependencies that management must understand and govern. The challenge is not simply keeping pace with technology. It is ensuring that investments in automation, operational resilience, and cybersecurity are evaluated together rather than as competing priorities.

Mining and manufacturing operations are changing faster than many people realize. Autonomous equipment, interconnected production systems, cloud platforms, and remote maintenance are introducing new capabilities alongside new operational dependencies. These changes are not confined to technology companies; they are reshaping industrial operations and the way management must evaluate risk.

For boards, the challenge is ensuring that modernization, operational resilience, and cybersecurity are considered together when allocating capital. The objective is not to eliminate cyber risk, but to understand the exposure, its potential business consequences, and the cost of deferring action.

These new technologies create operational opportunities, but they also expand the number of systems, connections, credentials, and third parties that organizations must manage. That might mean more vulnerabilities and therefore, cybersecurity has consequently become more than a technology-budget discussion. It is a question of capital deployment, operational resilience, and governance. Operational resilience is something I come back to again and again also in relation to the backlogs we are seeing and the deficits in some of the commodity prices.

Cyber risk cannot be eliminated, and the exposure changes as technology, suppliers, and operating environments evolve. The important questions is whether management understands where the organization is exposed, what the operational consequences could be, and whether the company is allocating available capital to address those risks before they become more expensive or difficult to resolve. The conversation needs to happen but it also needs to happen with the right people and the right information with business outcomes and not with IT verbiage. That conversation is particularly important when economic conditions are placing pressure on budgets.

Deferring a control improvement may preserve cash in the current period. However, if remediation costs increase, technology becomes unsupported, operational dependencies multiply, or a company later faces greater scrutiny from lenders and capital providers, today's deferred expense can become tomorrow's larger financial obligation. Keep in mind an inflationary environment makes the cost to remediate more expensive too, it isn’t just the loan to get access to funds to deploy but it is the purchasing power. Cybersecurity spending must compete with other legitimate business priorities and the solution is not unlimited spending. Factors that play a role are return on investment and the corporate risk appetite. It is stronger governance over when, where, and why capital is deployed, that matters.

1. The Attack Surface Is Changing and Is Board Oversight Keeping Up?

Industrial automation is not new, we have seen automation from arguably the 1970s onwards. Mining has used remote equipment, industrial control systems, and increasingly automated processes for decades but I want to focus on what has changed and that is the level of connectivity.

Modern operations depend on programmable logic controllers, engineering workstations, historians, distributed control systems, wireless networks, remote access, autonomous equipment, cloud platforms, and software maintained by external providers. A system that once operated within a relatively isolated industrial environment may now exchange data with corporate networks, vendor platforms, and external analytics services.

This connectivity can improve productivity, maintenance, safety, and operational visibility but it can also create additional pathways through which a cybersecurity incident might affect the business. The board does not need to understand the technical configuration of every connection. It should understand what management is doing to identify and control those pathways, particularly where they intersect with critical operations. Consider a mine relying on a specialized vendor for automation support.

Remote access may be essential to keeping equipment operational but then you need to consider:

· Who authorizes that access?

· Who reviews it?

· Does the organization know whether subcontractors can connect?

· Is access removed when the work is complete?

· More importantly, what happens if that trusted connection is compromised?

These are just some operational governance questions.

When cybersecurity, engineering, IT, procurement, and external vendors each manage part of the environment, accountability can become fragmented. The risk is not necessarily that the organization lacks policies. It may be that no single management process brings the technical exposure, operational consequence, and financial decision together. The board's responsibility is to ensure that management has established that process.

2. Advisories Are Not Incidents, but They Are Information the Board Should Understand

The distinction between vulnerability information and confirmed malicious activity is important.

· On October 8, 2026, CISA released six industrial-control-system advisories, including new advisories involving Red Lion Controls, Grid Protection Alliance, and Satel, together with updates involving other products, including Hitachi Energy.

· On October 13, CISA released two additional advisories involving Inductive Automation Ignition software and Swann Communications.

These advisories identify security weaknesses, affected technologies, and recommended mitigations. They do not, by themselves, establish that those vulnerabilities have been exploited against the organizations using them. An increase in published advisories does not automatically mean an increase in attacks. However, an organization should know whether affected products are present in its environment, whether they are exposed, and whether remediation is needed and people need to be able to make reliable decisions quickly.

A separate joint cybersecurity advisory released on October 8 provides a different type of signal.

· In advisory AA26-281A, the FBI, CISA, NSA, and international partners documented Chinese government-linked cyber actors enabled by Integrity Technology Group using automated scanning, botnets, and hands-on intrusion techniques against organizations worldwide, including U.S. critical manufacturing.

The advisory described observed malicious activity rather than merely identifying theoretical vulnerabilities. Five vulnerabilities associated with this activity were also added to CISA's Known Exploited Vulnerabilities catalog.

Those facts should not be conflated. The industrial advisories do not establish that the same actors exploited the listed industrial technologies, nor does the joint advisory demonstrate that a particular mine or manufacturer was compromised but collectively, the publications reinforce the importance of understanding actual exposure and prioritizing controls against credible threats.

The distinction is straightforward:

An ICS advisory identifies a potential vulnerability exposure.
A joint threat advisory can provide evidence of observed malicious activity.
A known exploited vulnerability provides evidence that exploitation has occurred, making relevant exposure a stronger remediation priority.

This gets back to the earlier point - the speed, and the visibility of how this information gets to the board, a board-level cybersecurity dashboard should do more than report vulnerabilities, completed assessments, or control activity. It should translate operational evidence into meaningful management information that identifies critical exposures, accountable owners, outstanding remediation, and the financial or operational consequences of delaying action.

Equally important is the speed and visibility of information moving from the operational environment through management to the boardroom. A risk identified at a mine site may take days or weeks to reach the people authorized to make funding or risk-acceptance decisions. That delay can have consequences, particularly when inflation, financing pressures, and operational constraints may increase the future cost of remediation.

The speed of detection is not the same as the speed of governance. Effective board oversight requires timely, reliable information that enables leadership to prioritize capital, challenge unresolved risks, and make informed decisions before exposure becomes an operational or financial problem.

Also the dashboard isn’t a one size fits all it needs to work with the board and senior management and it has to be easily understood, created and maintained. In my opinion it is worth the effort to get the dashboard right.

3. Inflation Changes the Economics of Deferring Cybersecurity Improvements

Cybersecurity budgets do not exist separately from economic conditions. In September 2026, Federal Reserve officials projected median PCE inflation of 3.7% for 2026 and a median federal funds rate of 4.1% at year-end.

Those figures are projections, not guarantees about future costs or borrowing conditions. However, they illustrate the economic pressures influencing management decisions.

Companies are considering expenditures for physical infrastructure, equipment, software, specialized labor, vendor services, and financing at the same time. When budgets tighten, cybersecurity improvements may be deferred because they do not immediately increase revenue or production. That is understandable but deferral has an economic dimension that needs to be evaluated. Consider an organization that identifies an unsupported industrial control system. Management may decide that replacement is not currently affordable and continue operating with compensating controls.

That decision could be reasonable but the decision should account for more than the initial replacement price. It should consider whether future implementation could require additional engineering, scarce specialist labor, production downtime, changes to connected equipment, or revised vendor contracts. Likewise, a company that postpones network segmentation or vendor-access improvements may later face a larger and more complicated environment as new facilities, software platforms, and automation systems are added.

The organization may then need to remediate several interconnected systems rather than one. Inflation does not guarantee that every cybersecurity project will become more expensive. Keep in mind that technology prices, financing costs, and labor markets can move in different directions. Nevertheless, postponing work can expose a company to future cost escalation, greater technical complexity, and fewer available implementation options. That is why the decision should be visible to finance and executive management rather than remaining exclusively within IT.

4. The CMMC Pause Illustrates a Larger Governance Opportunity

The July 2026 suspension of CMMC Phase 2 provides a timely example of how organizations should distinguish between assessment activity and actual risk reduction. The Department of War suspended the planned transition to Phase 2 requirements, which would have expanded the requirement for third-party Level 2 certification assessments.

However, the suspension did not eliminate existing responsibilities to safeguard covered defense information. Applicable NIST SP 800-171 requirements remain in force through existing contractual obligations, and Level 1 and Level 2 self-assessment requirements continue where applicable.

A change in when a company must obtain a particular certification does not mean the underlying cybersecurity risk has disappeared, nor does it necessarily mean that all previously planned spending should be cancelled.

Instead, management has an opportunity to evaluate the allocation of funds that may no longer be needed for an immediate third-party assessment. For an organization that had reserved money for assessment fees, the board and management could ask whether some of that expenditure would now create greater near-term value by strengthening controls.

· Could the company improve identity and access management?

· Could it resolve outstanding weaknesses in its handling of controlled information?

· Could it improve logging, asset inventories, backup and recovery capabilities, vendor oversight, or the evidence needed to demonstrate that controls operate effectively?

Those improvements can strengthen actual security while also helping prepare the organization for future assessment requirements. The appropriate decision will depend on contractual obligations, assessment readiness, available cash, and the company's risk profile and the underlying governance principle is broader than CMMC:

A regulatory or assessment pause is not automatically a reason to pause investment in risk reduction. Boards should be asking whether compliance expenditure is being confused with cybersecurity effectiveness. An organization may spend heavily preparing documentation for an assessment while postponing control improvements that would reduce operational exposure. Another may have well-designed controls but inadequate evidence that they are working. Both circumstances require management attention.

The objective should be to align expenditure with actual risk, required obligations, and credible evidence of control performance. Certification and assessments can provide valuable assurance but they should not become substitutes for governance.

5. Capital Deployment Should Reflect the Risk the Business Actually Carries

One of the challenges facing boards is that cybersecurity spending is often presented as a technology requirement rather than a capital allocation choice. Management requests additional resources to address vulnerabilities, purchase monitoring services, replace hardware, or meet compliance requirements without a consistent framework, directors may struggle to compare those requests with competing business expenditures.

The answer is not to make every cybersecurity decision a board approval matter but it is to establish clear management authority, risk tolerances, and escalation thresholds for decisions that could have significant operational or financial consequences.

For example, the need to replace an unsupported system supporting a critical production process may have materially different implications from replacing an ordinary office workstation.

Both are cybersecurity issues but they are not equivalent business risks. Similarly, improving vendor remote-access controls may be relatively inexpensive compared with the potential consequences of uncontrolled access to essential operational systems.

A mature capital allocation process should recognize these differences and management should be able to present the operational consequence, current exposure, remediation alternatives, likely costs, and residual risk associated with each significant decision.

That allows executives and directors to evaluate whether expenditure is proportionate to the exposure and it also makes deliberate risk acceptance possible.

Some controls cannot be implemented immediately. A mining operation may need to wait for a scheduled shutdown, while a manufacturer may depend on specialized equipment that cannot safely be patched without vendor approval. In those circumstances, accepting residual risk may be justified but it should be an explicit, time-bound decision with an accountable owner and compensating controls. The risk should remain visible until management has resolved it or formally reconsidered the decision.

6. Today's Cyber Decisions Can Affect Tomorrow's Capital Raise

Companies do not operate in isolation from their financing requirements. Management may need to raise capital for expansion, refinance existing debt, fund infrastructure, complete an acquisition, or support ordinary operations. In those circumstances, governance and operational resilience may become part of external due diligence.

Lenders, insurers, strategic investors, and other capital providers do not all evaluate cybersecurity in the same way. Requirements differ by industry, transaction structure, jurisdiction, and financing arrangement. However, material unresolved cyber exposure can introduce additional questions about operational reliability, contingent expenditure, risk management, and management credibility.

A company seeking financing may be asked to explain its significant operational dependencies, business-continuity arrangements, exposure to third parties, or outstanding technology investments. If management cannot provide reliable information, it may need to undertake additional diligence or prepare a remediation plan before those questions can be satisfactorily resolved. This does not mean weak cybersecurity automatically prevents a company from raising capital or increases its borrowing cost but significant deficiencies, particularly those capable of affecting operations or financial performance, can complicate financing discussions and influence the conditions under which capital providers are willing to proceed.

This creates an important connection between present-day capital allocation and future financing flexibility.

Repeatedly deferring cybersecurity improvements to preserve cash can increase operational exposure and make eventual remediation more costly and complex. When management seeks financing, those deferred costs may compete directly with expansion plans, debt obligations, or other capital priorities, reducing financial flexibility.

The implications extend beyond financing. Public companies must consider SEC cybersecurity disclosure and governance requirements, while organizations working within the Defense Industrial Base may face contractual obligations to demonstrate compliance with applicable CMMC requirements, including Level 2 self-assessments where required by their contracts.

Cyber risk therefore belongs in capital planning discussions before financing, regulatory, or contractual pressures force the issue. The board's role is to ensure management understands these dependencies, prioritizes available capital, and makes deliberate decisions about remediation rather than allowing deferred risk to become an unplanned financial obligation.

7. Mining Automation Makes the Governance Challenge Visible

Mining provides a particularly useful example because the operational and financial consequences of technology dependencies can be substantial. Autonomous haulage, remote equipment operation, connected processing facilities, and advanced monitoring systems are increasingly important to production. Many of these capabilities depend on systems that were not originally designed to operate within highly interconnected digital environments.

Mining also requires specialized external vendors, engineering teams, maintenance providers, and industrial automation expertise. That makes responsibility for cybersecurity difficult to isolate within one department. As an example, an equipment manufacturer may manage part of the technology, an integrator may maintain the control system and an external provider may monitor infrastructure but internal IT may manage enterprise connectivity, while site engineers retain responsibility for production and safety.

Each function may see part of the risk without management having a consolidated view of the overall exposure. Another example is that an IT team might recommend isolating a compromised industrial system but that action may affect a processing circuit or other equipment that cannot be safely stopped without operational coordination. The decision therefore requires cybersecurity, engineering, operations, maintenance, and safety to work together. It also requires investment in training, documentation, escalation procedures, and recovery planning.

These are governance capabilities, and they cannot be solved simply by purchasing another technology product. A new monitoring tool may help identify abnormal behavior, but it cannot determine on its own who has the authority to interrupt a critical production process and which information is material, how it is escalated, and what management and the board need to see. Likewise, a vendor contract may establish service expectations without adequately addressing responsibility during a cyber incident. These gaps do not always require expensive new technologies to resolve and that is important when we think of the broader inflationary pressure and the increase in costs.

A lot of the problem is around clearer ownership, better reporting, and stronger coordination among the people already responsible for the business. The board should be interested in both the financial and operational dimensions of those improvements.

The objective is not to make mining organizations cybersecurity organizations but it is to ensure they can operate safely and reliably within the level of cyber risk they have agreed to accept.

8. What Should Management Bring to the Board?

Boards should not receive a long list of vulnerabilities without understanding their business significance. Management reporting should connect critical exposure to operational consequences, remediation priorities, accountable executives, and financial requirements. It should also demonstrate how quickly material information moves from identification through management review to an appropriate decision or board escalation. The objective is not simply better reporting, but faster and more informed decisions within the organization's approved risk appetite.

From Detection to Decision: The Speed of Governance

What the board needs to understand

What management should demonstrate

Where is the company exposed?

Critical assets and dependencies, relevant external advisories, known exploited vulnerabilities, and significant third-party access

What is the business consequence?

Potential effects on production, safety, service delivery, contractual obligations, and recovery

What is being done?

Controls in place, evidence of their effectiveness, remediation progress, and outstanding exceptions

Where is capital required?

Prioritized improvements, cost estimates, implementation constraints, and the consequences of deferral

What risks remain accepted?

Accountable owners, compensating controls, review dates, and escalation against approved risk appetite

Could this affect financing or future plans?

Material unbudgeted remediation, operational uncertainty, financing-related diligence requirements, and competing capital needs

How quickly is material risk escalated?

Time from detection to validation, management notification, and escalation against approved thresholds

Are decisions being made promptly?

Age of unresolved decisions, funding approval status, accountable executives, and time spent outside approved risk tolerance

Reporting should make trends visible rather than simply presenting activity counts. For example, it is useful to know whether critical vulnerabilities are being resolved within management's approved time frames, rather than reporting only how many have been fixed. It is also useful to know when remediation is repeatedly delayed because of production constraints or funding decisions. Those metrics can help improve remediation over time, the idea is to get better as the governance matures.

9. The Questions Boards Should Be Asking Now

A board does not need to wait for an incident, regulatory deadline, or financing event to raise these issues. Essentially, five questions can begin the conversation.

First: What has changed in our operating environment over the past year?

Have automation, cloud adoption, acquisitions, vendor relationships, remote access, or new facilities expanded the organization's attack surface? Has management reassessed the associated risks?

Second: Where are we carrying cyber risk because funding has been deferred?

Which control improvements remain unresolved because of capital constraints, scheduling, or operational priorities? What is the estimated consequence of continuing to defer them?

Third: Are we spending on risk reduction or primarily on demonstrating compliance?

Where do assessments, certifications, audits, documentation, and technical improvements sit within the overall security budget? Are expenditures aligned with the most consequential risks?

Fourth: How might outstanding exposure affect future capital requirements?

Could postponed improvements become larger expenses? Might critical dependencies, recovery limitations, or unbudgeted remediation complicate future financing or business plans?

Fifth: Who makes the decision to accept that risk, and how is it monitored?

Are management responsibilities clear? Are there agreed risk tolerances, thresholds for escalation, and documented procedures for revisiting accepted risk?

The answers should inform the organization's continuing capital planning and risk oversight.

10. Governance Before the Next Capital Commitment

We need to be in a situation where we can ensure that management understands cybersecurity as a business risk and allocates resources accordingly.

· Finance needs visibility into the timing and cost of material remediation.

· Operations needs to understand the consequences of control changes and system interruptions.

· Cybersecurity needs to explain exposure in terms management can act upon.

· Procurement and vendor management need clear expectations for external providers.

· Executive leadership needs to make decisions when competing objectives cannot all be satisfied.

· And the board needs reliable reporting that makes accountability, material exceptions, and capital tradeoffs visible.

None of this requires pursuing cybersecurity maturity without regard to cost but it requires deliberate choices. A company should be able to explain why it funded one control, deferred another, accepted a particular risk, or chose to align remediation with a scheduled operational shutdown. It should also be able to explain what would cause management to revisit that decision. The strongest governance arrangements make these decisions while the organization still has choices.

Conclusion: The Most Expensive Cyber Decision May Be the One Nobody Made

Cybersecurity is often discussed as a cost to be controlled but that is an incomplete view. Cyber risk is also an exposure to be governed, an operational dependency to be understood, and a potential future financial obligation to be managed. The expansion of connected industrial systems means organizations must continually reassess the risk created by automation, remote access, suppliers, and technology dependencies.

· External advisories provide information about vulnerabilities.

· Threat intelligence provides evidence of malicious activity.

· Compliance frameworks establish obligations and assurance expectations.

· But none of those sources can make the organization's capital allocation decisions.

Management must determine which risks matter, what controls are proportionate, what remediation can be funded, and what exposure remains acceptable.

Deferring expenditure may be prudent when risk is understood, compensating controls are effective, and the timing is deliberate but a deferred budget without a documented risk decision is not the same thing as responsible capital management.

Deferring cybersecurity expenditure may be prudent when management understands the risk, appropriate compensating controls are operating, and the timing is deliberate but a deferred budget without a documented risk decision is not responsible capital management. Boards need assurance that management understands the organization's exposure, can demonstrate that critical controls are operating, and has made informed decisions about allocating capital within an agreed risk appetite.

The cost of waiting is not always visible in today's budget. It may emerge later through more complex remediation, operational disruption, increased capital requirements, or difficult financing discussions but by then, management may have fewer options and less flexibility over what those options cost.

References

Sturnella advises defense contractors, mining, energy, and critical infrastructure companies on CMMC readiness, SEC cybersecurity disclosure, and board-level cyber governance.

contact@sturnellahq.com | sturnellahq.com | news.sturnellahq.com

Disclaimer: This article appeared on the Sturnella website at sturnellahq.com and is provided for informational purposes only. It does not constitute investment advice, financial advice, legal advice, or a solicitation to buy or sell any security or financial instrument. The information contained herein is based on publicly available sources and is believed to be accurate at the time of publication but is not guaranteed. Sturnella LLC is a capital markets cybersecurity and governance advisory firm and is not a registered investment adviser, broker-dealer, or financial institution. Always consult a qualified financial, legal, or investment professional before making any investment decision.

Contact

Reach out for discreet advisory support

Email

contact@sturnellahq.com

Independence
Governance Precision
Discretion
Capital Markets Alignment
Accountability

Our Values

Disclaimer

Terms

Policies