Emerging Cyber Risks: Why Reviewing Controls Is Not Enough
Annually, CEOs, Boards of Directors and organisational management review policies to ensure they remain relevant, effective against existing and emerging risks, and compliant with evolving laws and regulations. These reviews are critical to helping organisations achieve strategic objectives, safeguard assets, improve operational efficiency, and maintain regulatory compliance.
Ideally, policy reviews should be conducted in close alignment with the organisation’s risk assessment process, ensuring that both current and emerging risks are reflected in policies, standards, and operating procedures. However, effective control implementation does not end with approval by the Board or Executive Management. Policies must be clearly communicated, embedded, and understood across the organisation so that every employee is aware of what has changed and what is expected of them.
Recent high-profile cybersecurity incidents across globally respected organisations demonstrate that policy reviews alone are insufficient. The failures were not due to a lack of controls, but rather weaknesses in how those controls were designed, governed, communicated, and executed.
Below are three examples that highlight why organisations must go beyond periodic reviews.
1. Military Exposure: The French Charles de Gaulle's location discovered through the Strava Fitness Application
The French Charles De Gaulle is an aircraft carrier, obscurely, due to operational security risk, sailing international waters. It is critical for the movement and deployment of the French Military across the world. It is the only nuclear-powered aircraft carrier in the world except for the US Military.
In March 2026, its location was reportedly exposed after an officer uploaded fitness activity data to the Strava application. Fitness applications routinely publish GPS data linked to user activity, and in this instance, sensitive operational information was inadvertently disclosed.
This event illustrates how consumer technologies, when not explicitly addressed in organisational policies or reinforced through awareness training, can introduce material security, operational, and reputational risks.
2. ‘SignalGate’ – The US War Plans shared on messaging application
In March 2025, senior United States officials created a group chat on the Signal messaging application to discuss planned military operations against the Houthis, before the operations were publicly announced. Due to a simple error, a journalist was mistakenly added to the group.
Although Signal is an encrypted platform, the incident highlighted that secure technology does not compensate for poor governance, inadequate verification processes, or inappropriate use cases. Sensitive information was shared without sufficient control over access or participants.
3. Coupang Leak
Coupang is a South Korean company often referred to as the ‘Amazon of South Korea’. In November 2025, it was discovered that the company had suffered a major data leak. System access for a former employee, who was a Chinese software developer working with authentication of systems, was not retrieved after he left. This meant that, the employee still had access to critical customer data. The employee used his access to download customer data, affecting approximately 33.7 million user records.
This was a classic failure of offboarding controls and access governance, resulting in regulatory scrutiny and significant potential financial and reputational consequences.
These example, may seem too far-off from your current organisation or the stakes may not be so high currently, but there is no way of quantifying what possible future losses for your organisation may be from these common control failures. Across these examples it is clear the failures were not caused by the absence of controls, but by weaknesses in how those controls were designed, governed and executed. The key failures could have been:
- Failure to anticipate emerging risks: Policies and controls did not adequately consider how rapidly evolving consumer technologies, applications and user behaviours introduce new cyber and information security risks.
- Outdated or incomplete policy coverage: Policies were either too high-level, narrowly scoped, or failed to explicitly address modern tools such as mobile applications, cloud platforms and remote access technologies.
- Weak governance and tone at the top: Senior leaders did not consistently model or enforce compliance with approved controls, undermining their effectiveness and creating a culture where convenience outweighs security.
- Lack of clear ownership and accountability for controls: There was no clearly defined responsibility for access management, secure communications or enforcement of policy compliance.
- Inadequate execution of key control processes: Critical operational controls fail in practice, including access revocation during employee offboarding, verification of system and communication participants and enforcement of acceptable-use requirements.
- Insufficient awareness and training: Employees and officials were not adequately trained on how policies apply to everyday tools and behaviours and the real-world consequences of seemingly benign actions.
- Lack of preventive and detective enforcement mechanisms: Organisations relied on policy compliance alone, without technical restrictions, automated monitoring, or timely detection of control breaches.
These failures demonstrate that effective risk management requires more than periodic policy reviews. Controls must be continuously updated for emerging risks, actively governed, and embedded into daily operations through awareness, training and enforcement. Of course, this all means nothing, if there is no operational risk management function.
Bagaka Group supports organisations with development and review of policies, risk assessment or review of the adequacy and effectiveness of risk management functions.
Contact us to learn how we can support your organisation.
