Geopolitical Cyber Risk Executive Briefing: What Boards Need to Know and Ask

State-backed cyber activity no longer stays aimed at governments and defence contractors: it reaches ordinary companies through their suppliers, their networks and the conflicts they happen to sit near. Boards are being asked whether the organisation could be caught up in a nation state campaign, what a conflict in a region where it trades would mean for its operations, and whether paying a ransom could breach sanctions. This briefing gives directors and senior executives a clear view of geopolitical cyber risk: nation state activity, conflict spill over, sanctions and supply chain exposure, with the questions to ask, the warning signs in management answers and a 90-day plan. It is written for boards, risk committees, CEOs and general counsel. The practitioner depth on threat intelligence is in the Threat Intelligence Guide.

The risk in one paragraph

Governments use cyber operations for espionage, for pre-positioning ahead of possible conflict, for disruption during conflict and, in North Korea's case, for revenue. Most organisations are not the intended target, but they are exposed in three ways: as a supplier or customer of a targeted organisation, as collateral damage when a destructive attack spreads beyond its target, and as a victim of criminal groups that operate with state tolerance and may themselves be sanctioned. The board does not need to name threat actors. It needs to know which of its services, suppliers and markets carry geopolitical exposure, whether the organisation could keep running if a key supplier or region were cut off, and whether management has a plan for sanctions and attribution questions during an incident.

Why this is a board-level issue now

• Pre-positioning in critical infrastructure: in February 2024 CISA, the NSA, the FBI and partner agencies from Australia, Canada, New Zealand and the UK assessed with high confidence that the PRC state-sponsored group Volt Typhoon was pre-positioning on IT networks of critical infrastructure organisations, with access in some environments for at least five years, for possible disruptive attacks during a crisis or conflict. Some victims were smaller organisations providing services to larger ones. See the Volt Typhoon Threat Actor Profile.
• Conflict spill over is real: the EU attributed the cyber attack on the KA-SAT satellite network, owned by Viasat, to Russia. It took place one hour before the invasion of Ukraine on 24 February 2022 and, according to the EU declaration of 10 May 2022, affected several EU Member States as well as Ukraine.
• Elections and institutions are targets: on 25 March 2024 the UK NCSC attributed reconnaissance against parliamentarians' email accounts to APT31 and a compromise of the Electoral Commission to a China state-affiliated actor.
• Sanctions reach ransom payments: UK and US sanctions authorities both state that paying a ransom to a designated or sanctioned person can breach sanctions, which turns an incident decision into a legal one for the board.

How state activity reaches ordinary organisations

For the main state actors, see the China State Cyber Operations Guide, the Russia State Cyber Operations Guide, the Iran State Cyber Operations Guide and the North Korea Cyber Operations Guide. On fraudulent remote workers, see the Insider Threat from Fake IT Workers Guide; on politically motivated attacks, the Hacktivism Guide.

What changes with size and footprint

A small business trading only in its home market faces geopolitical risk mainly through its suppliers and through criminal groups, so its priorities are the basics, supplier access controls and a clear ransom decision process. A multinational with operations, staff or data in several regions needs more: country risk reviews, the ability to separate regional networks and identity systems, local legal advice on data access and sanctions, and exercises that include regional leadership. Critical infrastructure operators and their suppliers should assume they are of interest to state actors and plan for long-term, quiet intrusion rather than only for loud attacks.

Sanctions and ransom payments

Sanctions add a legal dimension to incident decisions that many boards have not rehearsed:

• United Kingdom: OFSI guidance on financial sanctions and ransomware, first published on 13 February 2024, states that making funds or economic resources, including cryptoassets, available to a designated person through a ransomware payment breaches an asset freeze. OFSI can impose civil penalties of up to the greater of £1 million or 50% of the value of the breach, says ransomware payments are unlikely to be appropriate for a licence, and treats prompt reporting to OFSI and reporting of the incident through the official cyber incident reporting route as mitigating factors.
• United States: OFAC's updated advisory of 21 September 2021 explains that civil penalties can apply on a strict liability basis even where a person did not know a payment was prohibited. It treats strong cyber security measures, prompt and complete reporting to law enforcement and full cooperation as significant mitigating factors, and reviews licence applications for ransomware payments with a presumption of denial.
• Insurers and advisers: both authorities name facilitators such as insurers, incident response firms and financial institutions as within scope, so the organisation's advisers will ask the same questions.

In the UK, report fraud and cyber crime to Report Fraud (reportfraud.police.uk, 0300 123 2040), or to Police Scotland on 101 in Scotland. The board should agree in advance who decides on any payment, what legal checks are required and how attribution information will be obtained. This guide summarises sanctions guidance and is not legal advice. See the Ransomware Executive Briefing.

Supply chain and concentration exposure

State actors repeatedly reach their targets through trusted suppliers. In the SolarWinds supply chain compromise, which the White House attributed to Russia's Foreign Intelligence Service (SVR) on 15 April 2021 according to CISA advisory AA21-116A, a state actor reached customers through a modified software update. The Volt Typhoon advisory likewise notes that some victims were smaller providers of critical services to larger organisations. Boards should ask three supply chain questions with a geopolitical lens:

• Where are our critical suppliers, and where is our data? Location affects legal access requests, export controls and exposure to regional conflict.
• Which suppliers have privileged or persistent access to our systems? Managed service providers, software update channels and remote support tools are the routes most often used.
• Could we operate if a supplier or region were cut off? Sanctions, conflict or a supplier's own compromise can remove a service overnight.

See the Third-Party and Supply Chain Risk Executive Briefing.

Where identity fits

State actors favour valid accounts over malware because legitimate logins are hard to spot. The Volt Typhoon advisory describes living-off-the-land techniques, valid accounts and theft of Active Directory credentials, and recommends phishing-resistant MFA, limiting privileged account exposure and avoiding credentials stored on edge devices. Supply chain campaigns can also abuse non-human identities, such as token-signing certificates and credentials added to application service principals. Boards should expect privileged, third-party and machine identities to be inventoried, owned and monitored. See the Board Briefing: NHI Risk.

Where it sits in the frameworks

Five questions for the board to ask

1. Which of our services, markets and suppliers carry geopolitical exposure? Expect a short map of countries of operation, data location and critical suppliers, with the services that depend on them.
2. If a conflict escalated in a region where we operate, what would we do in the first week? Expect pre-agreed triggers, such as isolating regional networks, raising monitoring and checking supplier status.
3. Could a state actor already be inside, and how would we know? Expect evidence of threat hunting against published advisories, central logging that covers identity and edge devices, and a recent review of privileged and third-party accounts.
4. Who decides on a ransom payment, and how do we check sanctions? Expect a named decision process, legal and sanctions checks, and contacts with authorities and insurers agreed in advance.
5. Can we keep running without a key supplier or region? Expect tested continuity plans, alternative suppliers or manual workarounds for the critical services.

Red flags in management answers

• "We are not a target": the organisation sees itself as too small or too ordinary, despite supplying or connecting to organisations that are.
• Threat intelligence as a newsletter: reports describe actors and headlines but never lead to a change in controls or priorities.
• No plan for regional isolation: networks, identity systems and suppliers in higher-risk regions are fully connected with no way to separate them quickly.
• Ransom decisions left to the moment: no agreed process for sanctions checks, legal advice and authority contact.
• Edge devices and old systems ignored: internet-facing appliances past vendor support, which the Volt Typhoon advisory singles out for replacement planning.
• Attribution treated as the goal: effort spent working out who attacked rather than containing, recovering and reporting.

What good looks like

• A current geopolitical exposure map covering markets, data location and critical suppliers, reviewed at least annually and when events change.
• Threat intelligence that is tied to the organisation's sector and footprint and feeds specific control and hunting decisions.
• Conflict and sanctions scenarios included in incident exercises, with legal, communications and operations involved.
• Strong basics on the routes state actors use: patched and supported edge devices, phishing-resistant MFA, central logging and controlled privileged and third-party access.
• Continuity plans that assume the loss of a supplier, a region or a cloud service.

Where to invest first

1. Edge and remote access: patch or replace internet-facing devices and remove credentials stored on them.
2. Identity: phishing-resistant MFA, fewer standing privileges, and ownership of service accounts and application credentials.
3. Visibility: centrally stored logs from identity systems, edge devices and critical servers, kept long enough to find long-dwelling intruders.
4. Segmentation and isolation: the ability to separate regional networks and operational technology quickly.
5. Supplier assurance: stronger controls and monitoring for suppliers with privileged access.

Metrics to track

A 90-day plan

1. Days 1 to 30: ask management for a geopolitical exposure map (markets, data location, critical suppliers) and the current status of edge devices, MFA and logging on critical systems.
2. Days 31 to 60: commission a threat hunt against recent government advisories relevant to the sector, review privileged and third-party accounts, and agree the ransom decision and sanctions check process with legal counsel.
3. Days 61 to 90: run a board-level exercise on a conflict or sanctions scenario, agree triggers for regional isolation, and set four to six metrics for quarterly reporting.

Common failure patterns

• Geopolitics handled only by the security team: legal, procurement, operations and communications are not involved until an incident.
• Exposure reviewed once: the map is built after a crisis and never updated as markets, suppliers or events change.
• Short log retention: logs kept for weeks when advisories describe intrusions lasting years.
• Supplier assurance by questionnaire alone: no technical limits or monitoring on supplier access.
• Sanctions considered after payment talks begin: legal checks start too late to shape the decision.

Lessons from incidents

• Trusted software can be the route in: the SolarWinds supply chain compromise showed how a state actor can reach many customers through one update channel. Monitor build systems, signing keys and the credentials added to applications.
• Collateral damage crosses borders: the KA-SAT attack attributed to Russia disrupted users in several EU Member States beyond Ukraine. Organisations near a conflict, or reliant on shared infrastructure, need continuity plans that assume that kind of spill over.

Practitioner checklist

• Maintain a geopolitical exposure map of markets, data location and critical suppliers.
• Track relevant government advisories and record the action taken for each.
• Replace or patch internet-facing devices past vendor support and remove stored credentials from them.
• Enforce phishing-resistant MFA on privileged, remote and third-party access.
• Keep identity and edge logs centrally for long enough to support hunting.
• Prepare a regional isolation plan and test it.
• Agree the ransom decision process, including sanctions checks and authority contacts.
• Include conflict and sanctions scenarios in incident exercises at least annually.

Standards and references

• CISA, NSA, FBI and partners: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
• Council of the EU: Declaration on Russian Cyber Operations against Ukraine
• NCSC: China State-Affiliated Actors Target UK Democratic Institutions and Parliamentarians
• OFSI: Financial Sanctions Guidance for Ransomware
• US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
• UK Government: Cyber Governance Code of Practice
• NIST: Cybersecurity Framework 2.0
• MITRE ATT&CK: T1078 Valid Accounts

How NHI Mgmt Group can help

We provide independent identity and non-human identity assessments and board briefings, including reviews of the privileged, third-party and machine identities that state actors and supply chain campaigns abuse. Our NHI Foundation Level Training Course builds the skills to govern machine identities. Contact us to arrange a briefing.

Related NHI Mgmt Group resources: Threat Intelligence Guide · Third-Party and Supply Chain Risk Executive Briefing · Ransomware Executive Briefing · China State Cyber Operations Guide · Russia State Cyber Operations Guide. This guide summarises sanctions guidance and is not legal advice.