Andrea Perez-Sobers
Senior Reporter
andrea.perez-sobers@guardian.co.tt29Businesses must treat cybersecurity as a boardroom risk rather than an IT department responsibility, as failures involving critical suppliers, artificial intelligence and essential infrastructure can disrupt operations, damage reputations and expose companies to financial and regulatory consequences.
Cybersecurity and digital trust leader Niel Harper delivered the warning yesterday at the American Chamber of Commerce of Trinidad and Tobago’s (AMCHAM T&T) HSSE Conference 2026 at the Hyatt Regency Trinidad, urging companies to strengthen their resilience and prepare for disruptions before they occur.
Harper, an adviser to the International Telecommunication Union (ITU) and ISACA, warned that businesses could suffer serious consequences even when a disruption originates with an external technology provider.
A failure involving a cloud service, website integration or critical supplier could affect multiple businesses simultaneously, leaving companies unable to meet customer obligations despite having little direct control over the original incident.
“It’s your name on that service, it’s your reputation,” Harper said.
He warned that such disruptions could affect regulatory compliance, market competitiveness and investor confidence, as customers and other stakeholders reconsider their relationships with affected organisations.
Harper urged boards and executive teams to understand which services their businesses could afford to lose, how quickly they could recover and who had the authority to make critical decisions during an incident.
Harper argued that companies must move beyond measuring cybersecurity through technical indicators, including system alerts, closed vulnerabilities and security tools.
Instead, boards must understand how cyber incidents could affect revenue, operations, legal obligations and the organisation’s ability to serve customers.
“Security is also an opportunity,” he said, explaining that companies could use strong cybersecurity practices as a competitive advantage by demonstrating resilience and building confidence among customers and investors.
He identified five critical questions for boards: which services could the business afford to lose; which services directly generate revenue; how much control did the company have over the systems on which it depended; had recovery plans been tested; and who would make decisions during the first hour of a crisis?
Harper warned that having business continuity and disaster recovery plans was not enough if companies had never tested them under realistic conditions.
In an actual disruption, untested procedures could fail when businesses needed them most.
He also stressed that cybersecurity leadership must extend beyond chief information officers and chief information security officers to chief executive officers and board members, who must understand the commercial implications of technology risks.
Harper highlighted the growing exposure of essential services, including energy, water, transport and food distribution, to cyberattacks and other forms of disruption.
He pointed to the convergence of information technology and operational technology, particularly in the energy sector, where digital systems increasingly monitor and control physical infrastructure.
The distinction is important because an attack on operational technology can affect the delivery of essential services, creating consequences that extend beyond lost data or financial damage to public safety and the environment.
Harper cited the 2021 Colonial Pipeline cyberattack in the United States as an example of the potential consequences of disruptions to critical infrastructure.
He also referred to the 2024 CrowdStrike incident, in which a faulty software update disrupted millions of computer systems worldwide, affecting sectors including aviation, healthcare and retail.
The incident demonstrated how a failure involving a single technology provider could spread across industries and interrupt services on which businesses and individuals depend.
Harper also highlighted the risks associated with artificial intelligence, which can help attackers develop phishing campaigns and attack strategies at greater scale, including by people with limited technical expertise.
He urged businesses to establish clear responsibility for AI-related risks as the technology becomes more deeply embedded in everyday operations.
Harper stressed that organisations must prepare for the first 72 hours of a disruptive event, including the need to identify incidents, activate crisis teams, isolate compromised systems and communicate with affected stakeholders.
