What the Latest Mega Breaches Teach Us About Cybersecurity Board Reporting
Kovrr, Tuesday, November 3rd, 2026
Kovrr says the M&S and Qantas breaches were governance failures and explains what effective, data-driven cyber board reporting looks like.
The Marks and Spencer ransomware attack and the Qantas breach were widely described by security professionals as failures of governance rather than purely technical breakdowns.
Commentators pointed to weak accountability, unclear escalation paths, slow acknowledgement and poor executive visibility into cyber risk, along with third-party exposure in the M&S case.
Kovrr argues that cybersecurity cannot operate in isolation from the business, and that board-level engagement must rest on consistent, data-driven reporting that gives directors context on material risk.
Without that foundation, even well-resourced security programs remain exposed.