Private company boards are tracking the right risks — AI, cyber, succession, execution, technology investment — but the risk they’re missing is whether their oversight can move as fast as those risks do. Which of today’s risks do you believe private company boards are underestimating today? And what can they do to ensure they are monitoring that risk closer?
THE GOVERNANCE VELOCITY GAP
Private company boards are focused on the right risks: AI, cyber, talent, succession, regulation, supply chain and technology investment. The bigger question is whether oversight is keeping up.
That gap between the pace of change and the pace of governance is the governance velocity gap.
The underestimated risk is not any single item on the agenda. It’s the board’s ability to see what’s changing, understand the implications and act before the company’s options narrow.
The warning signs are familiar. Materials arrive late. Meetings are spent walking through decks instead of debating hard issues. AI is treated as an IT topic. Annual risk reviews are used for issues that now change monthly. Technology delays are discussed without a decision, deadline or fallback plan. Sometimes the biggest warning sign is what is missing: uncomfortable facts, dissenting views or early warnings filtered before they reach the boardroom. If the board sees only polished updates, it may not be seeing enough.
Private company boards should have an edge: engaged owners, direct access to management and less bureaucracy. That advantage disappears when fast-moving issues get pulled into slow board processes.
The practical cost of slow oversight is clear. By the time a fast-moving issue reaches the board in fully packaged form, the company may have fewer options or a narrower window to act. Earlier board engagement gives management room to adjust course.
The chair can reset the cadence.
Send materials a week in advance and don’t use board time for book reports. Put the hardest issues first. Use committees between meetings for AI, cyber resilience and the technology road map. Ask management to frame materials around what changed, what decision is needed, what trade-offs exist and what gets harder if the board waits.
The chair should also make room for candor. Ask what the board is not hearing. Invite dissenting views. Bring in outside experts where the board needs context. Then look around the table and ask whether the board is fluent enough in AI, data, cyber and technology to challenge management.
Insist on accountability. What is the deadline? Who owns it? What is the cost of delay? What would cause the board to revisit the decision? Have shareholders been educated on why late adoption is also a risk?
Boards do not need to run the company. They do need to govern at the speed the business is changing.
Karen Buck is lead independent director of Edmund Optics, member of the advisory board of ActiveOps, advisor of Executive Leaders for Advisory Boards and senior advisor of Naitiv Partners.
THE DISRUPTION BOARDS DON’T SEE COMING
I believe private company boards are not focused enough on AI’s potential to create disruptive growth, or to enable competitors to disrupt them. It is natural to view AI as an extension of cyber risk or as a high-tech issue with limited relevance to traditional manufacturing businesses. The combination of exaggerated hype around it and limited hands-on experience most directors have with modern AI tools can reinforce the belief that AI is a Silicon Valley concern, rather than a priority for private company boards.
I propose that the risk of disruption may be closer than many directors assume. Today’s technology investments will yield significant advances by 2027 or 2028, while the cost of adoption will plummet. Boards that are not investing in director education, external advisors, tabletop exercises and upgrading AI fluency will be poorly positioned to recognize changes that could prove either transformative or catastrophic.
High-performing private company boards should continually challenge their own level of AI fluency and ask if they are equipped for today’s environment. This requires regular strategic discussion on AI’s potential impact, the firm’s resilience in a rapidly evolving technology landscape and emerging AI-enabled opportunities. Boards that fail to foster this dialogue and encourage director curiosity risk falling behind competitors that are more effective in leveraging these capabilities.
Today’s directors face a unique challenge in that AI is the first truly transformative issue where many boards still lack a clear understanding of its implications — for business models, competitive positioning, cybersecurity, workforce dynamics and customer expectations. In my experience, too many directors are comfortable operating with limited AI fluency and are relying on the assumption that they can respond once disruption becomes visible. This may be the most underestimated risk facing private company boards today.
Andy Gilicinski is a director of Wyo-Ben Inc. and Master Fluid Solutions, ICEO senior advisor of LHH and managing director of CPG Advisor LLC.
THE EXECUTION BLIND SPOT
The challenge is making sure the board is focused on the risks that most directly affect the company’s long-term success and value.
One of the most underestimated risks is simply the ability of the organization to execute consistently. Boards often spend time reviewing financial results, but less time looking at the day-to-day processes that drive those results. Issues like inaccurate data, inefficient processes or inconsistent practices can seem like management concerns, but over time, they can affect profitability, growth and decision-making. Boards should pay closer attention to whether the company has reliable information, strong processes and the discipline needed to execute its strategy successfully.
Another area that deserves greater focus is cybersecurity and AI. Most boards discuss these topics regularly, but the conversations can sometimes stay at a high level. Cyber threats continue to become more sophisticated, and AI is creating both opportunities and risks for businesses. These risks can include data privacy concerns, legal issues, reputational damage and unintended consequences from how AI tools are used. Boards do not need to be technology experts, but they do need to ask thoughtful questions and make sure management has clear plans for managing these risks.
A third risk is dependence on a small number of key people. In many private companies, a relatively small group of leaders or top performers drives a significant portion of the company’s success. If one or more of those individuals leaves unexpectedly, the impact can be substantial. While many organizations have succession plans, boards should regularly review whether there is enough leadership depth throughout the company and whether future leaders are being developed.
For employee-owned companies, particularly ESOPs, another important risk is planning for future share repurchases. This is often viewed as a finance issue, but it is really a strategic issue as well. If not planned carefully, future obligations to buy back employee shares can reduce cash available for growth, investment and other priorities. Boards should regularly review these obligations and evaluate how different business scenarios could affect the company’s financial flexibility.
The strongest boards are shifting toward a more forward-looking approach. They focus on a handful of key indicators, discuss emerging risks regularly and make sure risk oversight is closely connected to strategy.
Ultimately, the most effective boards are those that look beyond the final results and pay attention to the factors driving those results. By focusing on the early warning signs and the fundamentals of business performance, boards can better protect the company and create long-term value.
Michael J. Statz is chair and chief operations officer of MSA Professional Services Inc.
THE AI-CYBER CONVERGENCE
Private company boards are underestimating two distinct but deeply interrelated risks: the governance gap around AI and the evolving nature of cybersecurity threats. Together, they represent the risk I believe deserves far more board attention today.
On the AI side, nearly every private company is deploying AI somewhere in the business, yet most boards still treat it as a management-level IT initiative rather than an enterprise risk requiring direct board oversight. Few boards have a real mechanism for tracking where AI is being used, what decisions it is influencing or where it could go wrong.
On the cyber side, threats have moved well beyond the traditional picture of firewalls and patch cycles. Too many boards still treat cybersecurity as a technical topic delegated entirely to the chief information officer (CIO), rather than a strategic risk with direct financial and reputational consequences.
What makes this urgent now is how AI is accelerating cyber risk itself. Deepfake-driven fraud, highly convincing phishing campaigns and fake credential attacks are no longer hypothetical. They are showing up in real incidents, and AI is making them faster, cheaper and harder to detect. Private companies are more exposed, since they lack the scrutiny and reporting infrastructure public companies face.
To close this gap, boards should require a combined AI and cybersecurity risk dashboard at every meeting and ensure at least one director has genuine technology fluency. My board has real experts: an ex-CIO and an ex-head of data analytics, yet I am pursuing AI certification myself as a sitting board member, on the view that directors should hold themselves to the same standard they expect of management. Boards that treat this as a standing discipline, not a periodic briefing, will be far better positioned than those still waiting for a wake-up call.
Christopher Thomas is chairman of the compensation committee of U.S. Venture, managing director of Strategy and Innovation Acceleration LLC, and co-founder of Propulsion Innovations LLC.