What the Iran cyberattacks can teach boards about cyber warfare

COMMENTARY: Cyber warfare looks a lot different today than it did a few years ago. In the past, we all generally viewed kinetic warfare and cyber warfare as separate entities that were linked together, but today, these two areas have become much more tightly interwoven.Additionally, in the past, geopolitical conflict was viewed as a distant risk that happened in other regions of the world, occasionally affecting U.S. stock market prices or a delayed shipment of goods.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]The rules of engagement on geopolitical and military actions have blurred the lines of conflict and corporate impact. For example, the cyber response to the recent U.S., Israel, and Iran conflict should shed light on how much has changed. In June 2025, when the U.S. and Israel conducted bombing raids and kinetic strikes on Iran's nuclear facilities, the Iranian response occurred within hours as 120 pro-Iranian third-party cyber proxy groups became active, launching Distributed-Denial-of-Service (DDoS) attacks on Israel and other Western targets, as well as attacks on financial systems.The following January, there was an increase in cyber activities as military forces flooded the Strait of Hormuz, and in February 2026, during operation Epic Fury, the largest cyberattack in history tied to a pre-war conflict occurred when 96% of the Iranian internet went down. Boards today spend a lot of time discussing business disruption and financially-motivated cybercrime. However, the Iranian conflict revealed that geopolitically motivated cyber warfare now follows different rules and moves faster than ever, especially with the help of generative AI. The geopolitical motives are not always about money, it can include creating chaos, destruction and disruption. So, what are the steps that executive teams should take to protect their companies?Here are the top five defensive posturing strategies I recommend, based on knowledge acquired from attending more than 115 board meetings during my career:Most incident response plans are built around ransomware because of its prevalence in the threat landscape. However, the attack on medical technology manufacturer Stryker was different. Attackers used a trusted device management platform to push a wipe command to more than 200,000 devices worldwide. Because of this, EMS crews lost the ability to transmit real-time cardiac data to hospitals and had to fall back on radios and handwritten notes. Boards need to ask whether their organization's playbooks account for these types of incidents, and whether technology tools most broadly used across their companies are being monitored as closely as the perimeter. When drone strikes took down cloud infrastructure in the Gulf, organizations with no connection to the conflict lost access to services because their data was stored in or in-transit to that region. As such, boards should ask management whether critical systems depend on a single provider or a single geography. If the answer is yes, they should also ask what a “cloud second” strategy would look like for the handful of systems the business cannot operate without – and make sure that strategy gets thoroughly tested.Companies usually ask about third-party vendors, but that’s no longer enough. Boards need to ask about fourth and even fifth party exposure – the vendors of our vendors – because they need the same level of scrutiny. Data residency also matters here, as boards need to know which regions their data transits, not just where it's stored. A company doesn’t need Middle East operations to have Middle East exposure because if any part of its supply chain transits to an unstable region, risk travels with it regardless of where the company’s facilities lie. Boards need to think about what strategic governance actions they should take as a result.Nation-state and wartime cyber losses have been increasingly excluded from cyber insurance policies. Consequentially, it’s critically important to confirm what is and isn’t covered under a policy before an incident occurs. Boards should know their company’s policy and plan for any gaps that these exclusions may create.Test and review incident response plans not only the technical level, but also at the executive level, and again at the board level. Make sure the plan accounts for contingencies, including what happens if the incident isn’t covered by cyber insurance. Publicly-traded companies carry SEC disclosure obligations once an incident becomes material and that clock starts running long before the board typically gets involved. Practicing the escalation path matters just as much (if not more) as practicing the technical response.Today, boards need to accept that kinetic and cyber warfare are one in the same, and that proxies and AI have all but erased the advantage of geographical distance. In addition, governance built for yesterday’s cybercrime will most certainly not hold up against tomorrow’s AI-enhanced cyber warfare tactics.The next geopolitically motivated attack can happen any day now – and it won’t wait for corporate governance to catch up. Companies and boards need to build-in these strategies now to safely secure their organizations.James Turgal, vice president, global cyber risk and board relations, OptivSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial. - Harden the company’s environment for destruction, not just for ransomware attacks. - Reduce cloud concentration risk and have a Plan B. - Map data and diversify supply chains. - Understand what the company’s cyber insurance covers. - Test incident response at every level, not just IT.