LCG 02 Cyber Security Workbook (English Edition)

Would you notice if the attacker logged in instead of breaking in?

Cyber is no longer an IT report the board simply notes. Under NIS2 it is a management responsibility, and the threat has moved. According to CrowdStrike, 82% of detections in 2025 involved no malware - attackers used valid logins and trusted integrations. Can your board answer these five?

1. Who notices if a partner with legitimate access to our data is abused?

In Denmark's CPR case in October 2026, outsiders obtained names, addresses and CPR numbers for about 8.8 million people through a small company's legitimate access. It went on for ten days. No wall was breached. According to the Verizon DBIR 2026, 48% of breaches now involve a third party. The workbook shows how to put a ceiling, an alarm and a named owner on every access.

2. How long can we be down before it hits our customers - and our suppliers?

The 2025 attack on Jaguar Land Rover stopped production at every UK plant for around five weeks. The Cyber Monitoring Centre puts the damage at £1.9bn, and more than 5,000 suppliers lost revenue. The workbook helps you decide in advance what has to come back first.

3. What does NIS2 require of the board - personally?

Management must approve and oversee the security measures, take training themselves and can be held liable. Fines go up to €10m or 2% of global turnover for essential entities. The workbook turns the requirements into concrete decisions the board can make and document.

4. Do we have the competence to ask management the right questions?

In a peer-reviewed study (Harel & Carmeli, Journal of Cybersecurity, 2025), 67% of directors admit they lack the expertise to oversee cyber. The workbook gives you the questions and a war game, so you can practise in the boardroom rather than learn during an attack.

5. Are we too small to be interesting?

No. Check Point measured a 43% rise in attacks on Danish companies from January 2025 to January 2026 - more than double the global rise. And Marks & Spencer wasn't hit through its own systems, but through an external IT helpdesk. It cost around £300m in lost profit.

What you get: 10 modules from board to CISO, Danish data from 2025-2026, a board-level war game, cases including Jaguar Land Rover, Marks & Spencer and the CPR case, and a fill-in tool for every board decision that matters.

It is for boards and executive teams in companies covered by NIS2 - or supplying someone who is.

Why not just ask ChatGPT? ChatGPT can explain what NIS2 is. It can't put your board through an exercise where you have to decide under pressure, or help you see which of your own access points is the new back door.

Try it free first: Take the NIS2 Director Readiness test on the website.

Individual Licence: Single User, No AI Rights

This licence grants one named individual a personal, non-transferable right to download and use this workbook for their own professional development and reference.

The licence does not permit uploading, importing, integrating or using the workbook as source material in AI agents, large language models (LLMs), RAG systems or other AI-enabled platforms. Sharing, redistribution and organisational use are not permitted under this individual licence.

Use with AI agents requires a separate, valid LCG corporate AI licence. All intellectual property rights remain with Leadership Capital Group (LCG).

LCG-INDIVIDUAL-LICENCE-TERMS