Who Owns the Risk?

By Zacharias · Principal

Physical, Cyber, and Insider Threats Converged Into One Surface. Accountability for It Did Not. The Case for a Single Owner of Integrated Risk.

ISSUED 19 JUNE 2026 · GOVERNANCE DESK · ZACHARIAS, PRINCIPAL · AUDITED AGAINST AEGEAN-OS

THE DOCUMENT

NumberAIG-GOV-26-003

FormerlyPMR-2026-0619-GLBL-006

ProductAssessment

Issued2026-06-19

Pages14

DistributionPublic release

TimelinessDURABLE (6 TO 18 MONTHS)

DOWNLOAD

FULL REPORT (PDF)

14 PAGES · 421 KB · FREE

HOW TO CITE

Aegean Intelligence Group, “Who Owns the Risk?,” AIG-GOV-26-003, The Aegean Register, 19 June 2026.

Abstract

A cyber breach forces a physical shutdown; a phone call defeats a technical control; an insider is one person with a badge and a login. Risk has merged into a single surface, but accountability for it is split across a cyber chief, a physical-security head, and a general counsel, and in most family offices no one owns it at all. This brief argues the binding constraint is no longer spend or tooling. It is ownership.

Key judgments

KJ-1HIGH

Risk has converged into one surface but organizations have not: formal physical-cyber convergence sits near its 2019 baseline of about 24 percent even as 73 percent of organizations suffered an intrusion affecting operational technology in 2024.

KJ-2HIGH

Regulation and case law have made security a board-level and personal matter: the 2023 SEC rules force board-oversight disclosure and four-day incident reporting, and a security chief has been criminally convicted over a breach response.

KJ-3HIGH

The exposure is most concentrated and least owned in family offices: 43 percent suffered a cyberattack, 63 percent carry no cyber insurance, and only a minority have any formal risk leadership.

KJ-4MODERATE

Boards are not equipped to own the risk: about 79 percent of the S&P 500 park cyber oversight in the audit committee, and only around 4 percent of directors express confidence overseeing cyber and AI risk.

Key stats

Source registry31 entries

Judgments4

Confidence3 HIGH / 1 MOD

Pages14

Issued 2026-06-19Public releaseDURABLE (6 TO 18 MONTHS)AIG-GOV-26-003

Cover

FORWARD CLAIMS · DATED TO PUBLICATION · SCORED ON THE SCORECARD →

ID	Statement	p	Made on	Resolves by	Status	Outcome
CLM-2026-178	Baseline, rising spend against divided ownership, is the most probable path.	0.65	2026-06-19	2027-06-19	Locked

A claim is entered in the brief's own words and carries its publication date and the day it entered the ledger: the register's briefs on 8 September 2026, when the standard was first applied; the forward benchmark on the day it was locked. It resolves only against a dated public source. The scoring rule is on the Methodology page.

SOURCES & METHOD

The evidence base combines vendor- and recruiter-commissioned surveys from publishers such as the ASIS Foundation, Deloitte, PwC, and Verizon with primary legal and regulatory sources including the SEC final rule, DOJ prosecutions, and CISA advisories, plus market-sizing reports presented as ranges. Claims are structured as six key judgments with explicit confidence levels and per-section assessments carrying confidence grades and rationale, keyed by numbered citations to a source registry.

Limitations: Most prevalence figures are drawn from vendor- or recruiter-commissioned surveys and flagged as such, the headline 24 percent convergence figure is a dated 2019 baseline, and the absence of a current independent census of converged security leadership is itself a finding.

SOURCE REGISTRY: 31 ENTRIES14 PAGESTIMELINESS: DURABLE (6 TO 18 MONTHS)

Estimative language in this report follows the firm’s published standard: judgments carry HIGH, MODERATE, or LOW confidence, and each carries its rationale in the full report. The framework, source tiers, and anti-fabrication perimeter are public on the methodology page. Corrections issue as numbered addenda.