The report provides guidance on how companies can report ‘digital security risk’ more effectively, disclosing the risks and opportunities, alongside their broader business strategies.

There was general consensus that current disclosures are not sufficient to meet investor and stakeholder needs. Too often companies provided limited information on digital security, failing to connect to the wider strategic direction of the business.

At the same time, the quality of responses about geopolitical or cyber events remained insufficient, with limited detail on the key issues.