June 2026 Newsletter

For corporate boards, the significance is not merely technical. AI-enabled vulnerability discovery may give defenders a temporary tactical advantage, but the real governance question is whether management can convert better visibility, and the ability to see latent risk into prioritized remediation, stronger prevention, and durable cyber resilience.

Anthropic described the stakes this way:

Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely. The fallout—for economies, public safety, and national security—could be severe. Project Glasswing is an urgent attempt to put these capabilities to work for defensive purposes.

Project Glasswing is a curated and strategic collection of launch partners who will work with Mythos Preview as “part of their defensive security work” to focus on “critical software infrastructure so they can use the model to scan and secure both first-party and open-source systems.”

Glasswing addresses a distributed risk challenge in cybersecurity where one company’s weakness can create risk for many other organizations. This problem lacks a collective security model, but the curated and strategic release of  Mythos through  Glasswing helps establish collective remediation cooperation as a step towards the universal hardening of key layers of the digital economy before they can be exploited.

Mythos Preview addresses one of the fastest growing risks in cybersecurity. Verizon’s 2025 Data Breach Investigations Report (DBIR) reported that exploitation of system vulnerabilities as an initial access step for attackers grew by 34% in 2025 and accounted for 20% of breaches, only behind credential abuse at 22% as an access vector for attackers.

Before Mythos, this aspect of cybersecurity was a race between vulnerability discovery and exploitation by the “bad guys” and enterprise remediation pace and capacity by the “good guys.” Closing this gap is such a challenging issue that the U.S Cybersecurity & Infrastructure Security Agency (CISA) maintains a Known Exploited Vulnerability catalog (KEV) as a central repository with a goal of making the market for identifying and remediating these vulnerabilities faster and more efficient for all companies. Mythos is a tool that gives defenders an advantage by enabling them to efficiently identify and fix latent risk in the system, at scale.

However corporate boards should oversee Mythos as a strategic shift, not just a technical enhancement.

Cybersecurity oversight should not be treated as a routine extension of financial control oversight, which frequently occurs where audit committees are assigned responsibility for cybersecurity. Cyber risk is not a general enterprise risk, and it should not be governed with the same capabilities and approach used to govern general enterprise risks.

Cyber risk differs from many enterprise risks because it is adversarial, asymmetric, highly systemic in nature, and it possesses different temporal and scale dynamics. Mythos introduces implications for each of these characteristics in a favorable way for defenders if it can be capitalized on. This makes cybersecurity oversight in the boardroom less about governing and managing a static control environment and more about overseeing a real-time active contest where the rules regularly change, between enterprise resilience and adversarial capability, innovation and persistence.

Cyber risk involves an intelligent and active adversary. Attackers do not merely expose existing weakness, they search for it, test it, exploit it, and adapt as defenses change. Mythos gives defenders a tool and better intelligence about the latent risks within their own systems before adversaries can discover and exploit them.

Mythos and its private release also tilt the scales temporarily in the favor of cybersecurity defenses which balances out some of the asymmetric disadvantages that defenders face. Attackers generally hold a long-term tactical advantage over defenders because they can search patiently for a single point of weakness while defenders have to constantly protect every part of the entire complex and dynamic system. Mythos gives defenders the ability to identify and close many of these vulnerabilities faster than they can be exploited.

In cybersecurity, time matters because risk can manifest and propagate across interconnected systems faster than traditional remediation processes. Boards need confidence that management can operate at the pace and scale required to detect, prioritize, escalate, and respond before a technical exposure or incident becomes a material business event; Mythos and AI vulnerability discovery helps with that.

Mythos is an AI innovation that does not change risk but exposes what was already there. Having greater visibility into latent risk within complex digital business systems is a groundbreaking step forward that is a necessary step before cybersecurity systems can transform into highly resilient systems.

Mythos and similar tools have the potential to catalyze systemic transformation and resiliency in cybersecurity.  However, this will only happen if organizations build the oversight, prioritization, remediation, and prevention systems that can quickly respond, scale, and leverage what better discovery reveals. Better diagnosis becomes transformative when it helps management strengthen the system that creates, detects, prioritizes, and remediates risk.

Healthcare offers a useful analogy. Better diagnostic capabilities in healthcare increased visibility and understanding into latent health risk. When healthcare gained better diagnostic tools, cancer rates and other disease states appeared to rise as this new degree of transparency discovery revealed previously unidentified risk. This ultimately led to many conditions being found earlier, which accelerated treatments that led to more lives being saved.

However, this did not happen immediately and by itself. Better detection also produced overdiagnosis, overtreatment, patient anxiety, unnecessary procedures, and overloaded clinical systems. Problems that as they were solved, enabled entire healthcare systems to transform. That is a similar opportunity that Mythos can enable in cybersecurity.

The lesson in healthcare was not that too much diagnosis was bad or to stop diagnosing, it was to make diagnosis more useful by leveraging it as a catalyst for creating a more effective and disciplined system of triage, staging, treatment, surveillance, prevention, and measurable improvement—one that ultimately did improve healthcare.

Better vulnerability diagnosis will create and expose remediation bottlenecks, create focus and urgency, and also direct attention to a heightened risk understanding of what’s important and what’s not from this scale of risk identification. CISOs will be forced to prioritize their actions and develop a much more effective, capable, and efficient risk management system that is aligned to business value.

Corporate boards will need to focus their cybersecurity oversight on the strategic transformation of cybersecurity systems, along with the progress being made to address the tactical bottlenecks created because of greater vulnerability identification.

Directors should ask management to show how newly discovered vulnerabilities are validated, ranked, assigned, remediated, monitored, or formally accepted as exceptions. For CISOs, the key issue is whether the organization can prioritize and rapidly act on vulnerabilities that are exposed, exploitable, and tied to critical business systems from those that are not.

For directors, the tactical governance issue is whether remediation capacity is prioritized appropriately, keeping pace with discovery, and in understanding what this level of latent risk transparency is telling them about systemic resiliency. Strategically, directors will gain a greater understanding of how the individual parts of the cybersecurity system work together to sustain a resilient and adaptive defensive capability.

Mythos is not just an AI innovation that can give defenders a head start in identifying latent risk. It is a strategic development that can lead to the systemic strengthening and resilience of cybersecurity systems and cybersecurity governance if organizations take advantage of the window of opportunity they have been given.

The uncomfortable truth is that AI-enabled vulnerability discovery will expose more of the enterprise’s hidden cyber risk than many organizations or boards are prepared for. That visibility will be disruptive, but valuable.

Corporate boards should respond to the Mythos announcement by doing the following:

1. Ensure management maps and understands latent risk: Review and discuss previously unidentified vulnerabilities and their risk mapping to business value implications and approve prioritized remediation plans and timelines.

2. Review vulnerability remediation capacity, expected bottlenecks and reengineering plans: Ensure remediation throughput can keep pace with discovery and risk prioritization is aligned to process improvement plans.

3. Ensure management’s strategic shift from patching to systemic resilience: Ensure management has plans that focus beyond patching at scale to use better vulnerability diagnosis to build long-term cybersecurity system resiliency and preventative transformation.

The companies that benefit the most from the Mythos release will not be those that merely find and patch the largest number of flaws. They will be those that use better diagnosis into durable cyber resilience. Read More.

Corporate Governance Trends | Top 5 Corporate Governance Priorities Currently

This report outlines the top five governance priorities corporate directors face, based on an analysis of CEO and board-level interviews, proprietary survey data, and emerging market trends.

Today’s corporate boards are confronting a period of unprecedented leadership churn, systemic risk, and technological disruption. This report outlines the top five governance priorities corporate directors face in 2026, based on an analysis of CEO and board-level interviews, proprietary survey data, and emerging market trends.

Top Five Governance Priorities for 2026

1. Fortify CEO succession and leadership pipelines: A demographic wave of CEOs staying in their roles past traditional retirement age, combined with the increasing materiality of leadership quality to value, is creating an impending need for robust planning.
2. Drive strategic board refreshment and composition: A persistent gap between the need for new board skills and the slow pace of director turnover is creating strategic vulnerabilities and attracting activist attention.
3. Build resilience in the context of geopolitical and economic volatility: Escalating geopolitical and economic uncertainty are the paramount risks for boards for the third year in a row, demanding enhanced scenario planning and further increasing the importance of a robust leadership pipeline and new director expertise.
4. Formalize AI governance and strategic oversight: A critical “discussion vs. action” gap in AI oversight is exposing firms to unmanaged risks and hindering their ability to capitalize on AI-driven strategic opportunities.
5. Proactively manage shareholder activism: Sustained, high-level activism is acting as a market-enforced penalty for governance lapses, making proactive board refreshment and strategic alignment the most effective defense.

Priority 1: Fortify CEO Succession and Leadership Pipelines

A demographic wave of aging leadership is creating a critical inflection point for corporate boards, with a growing percentage of CEOs staying in their roles past the traditional retirement age. Today, more than 11% of S&P 500 CEOs are in the 65–69 age bracket, a notable increase from just over 7% in 2017. This “bunching of tenures” is partly a result of boards prioritizing continuity during the COVID-19 pandemic and the more recent uncertainty resulting from inflation and geopolitical tensions—a deliberate strategy that delayed a wave of successions that are now becoming urgent. With a record number of leaders in their late 60s, succession planning has shifted from a long-range exercise to an immediate strategic imperative.

The impending wave of retirements creates a significant opportunity for boards to tap into a generation of seasoned leaders currently in their mid-to-late 50s. This cohort has become notably underrepresented at the top; the percentage of S&P 500 CEOs in the 55–59 age bracket fell from over 36% in 2018 to 25% in 2025. Many of these executives, who have been waiting for their turn, possess a unique blend of deep operational experience from navigating multiple economic cycles and the modern strategic skills required to lead in a digital-first world. As boards plan for the future, this pool of overlooked talent represents a prime opportunity to appoint leaders who offer both stability and a forward-looking perspective, mitigating the risks of inexperience while invigorating the C-Suite.

To navigate this environment, leading boards are transforming succession planning into a continuous, disciplined, and strategic function.[1] This involves beginning the succession dialogue immediately after a new CEO is appointed and integrating it into the board’s regular cadence. The goal is not to find a clone of the current CEO but to identify and develop leaders with the skills required to navigate the strategic challenges of the future, with a focus on critical competencies like agility, learning, and resilience. This forward-looking process, which includes giving high-potential candidates board exposure and benchmarking them against external talent, transforms succession planning from a simple replacement exercise into a dynamic tool for building long-term organizational resilience.

Ultimately, effective succession planning is less about predicting a single leadership transition and more about avoiding emergency decision-making. Regular, structured succession discussions help prevent situations where boards are forced to act under time pressure— whether due to unexpected departures, activist pressure, or abrupt strategic shifts. Treating succession as a standing governance discipline rather than a contingency plan allows boards to retain control over timing, options, and narrative.

Recent succession data and boardroom insights suggest that CEO succession is increasingly used as a proactive governance and performance lever, not merely a response to performance breakdowns. As recently reported by The Conference Board, CEO turnover at large-cap companies accelerated in early 2025 even among stronger performers, indicating that boards are acting earlier to realign leadership capabilities with future strategic demands rather than waiting for visible underperformance.[2] In this context, succession is becoming a tool for signaling accountability, adaptability, and strategic intent to investors. This is increasingly important since 61% of CEOs and directors say they expect their CEO succession planning practices to have more influence on valuation five years from now than they do today.[3]

While continuity was deliberately prioritized during the pandemic and subsequent periods of economic and geopolitical uncertainty, many boards now face the consequences of deferred transitions. The result is not only a clustering of CEO tenures but also heightened exposure to activist pressure when succession plans appear opaque or underdeveloped. Boards that lack credible, well-communicated succession pathways are increasingly vulnerable to external narratives calling for leadership change.

At the same time, the data underscore the limits of purely internal pipelines. While internal promotions still dominate, the rising share of external hires in the S&P 500 reflects boards’ willingness to widen the aperture when internal candidates do not fully align with evolving strategic needs.[4] Leading boards therefore pair internal development with regular external benchmarking—not to default to outside candidates but to ensure optionality and informed decision-making. Viewed this way, CEO succession planning is inseparable from broader leadership pipeline strength. Boards that treat succession as an ongoing governance discipline—rather than a contingency plan—retain greater control over timing, reduce reliance on interim leaders, and position the organization to navigate leadership change without destabilizing strategy or stakeholder confidence.

Priority 2: Drive Strategic Board Refreshment and Composition

Just like the C-Suite, the boardroom is facing intense pressure to evolve. The accelerating pace of business demands a broader range of skills from directors, yet a significant disconnect persists between this need and the slow pace of director turnover. This gap is a source of internal friction—an astonishing 93% of executives believe at least one director on their board should be replaced, according to a recent C-Suite survey,[1] and only 30% of directors say their board regularly replaces directors who are not contributing at an acceptable level or whose skills have become less relevant.[6] This is an open invitation for shareholder activists who exploit board stagnation as a lever for change.[7]

Recent data from The Conference Board on new director elections underscore this challenge. After peaking at 9.6% in 2019 and 2021, the rate of board refreshment in the S&P 500 has noticeably slowed. In 2025, only 8.6% of directors were newly elected, a figure that remains below the pre-pandemic highs and continues a general downward trend from the immediate post-pandemic period.[8] This slowdown in bringing fresh perspectives to the boardroom quantifies the stagnation that increasingly concerns executives and investors. It demonstrates that despite the recognized need for new skills, the actual pace of change is lagging, widening the gap between the board’s current composition and its strategic needs.

Among other factors, the urgent demand for refreshment is driven by a widening gap between traditional board skills and the expertise required to navigate future challenges. Data on new director qualifications reveals that boards are actively trying to close this gap by prioritizing technology-related expertise. In 2025, 46% of new S&P 500 directors possessed technology experience, a dramatic increase from 17% in 2021. This was complemented by a strong and growing focus on human capital (a skill present in 40% of new directors in 2025, up from 26.5% in 2021), cybersecurity (22.7%, up from 18.8%), and environment/climate (10.5%, up from 3.6%).[9] The emphasis on these specific, forward-looking competencies shows a clear effort to equip the board with tools to oversee a more complex and digitally driven business environment.

To close any perceived skill gap, boards must adopt a disciplined and proactive approach, ensuring the pendulum does not swing too far toward new competencies at the expense of foundational ones. Recruitment trends suggest many are striking this balance: while there was a sharp rise in new directors with the above-mentioned technology, cybersecurity, and human capital experience, the data also showed that traditional skills remain paramount. Strategy (50%) and finance (23%) were still among the most sought-after qualifications for new directors, ensuring that institutional legacy knowledge and core business acumen are not lost in the search for new talent.

Importantly, boards are also cautioning against overspecialization. Experience shows that overly “balkanized” boards—where individual directors are seen as owning narrow technical domains—can struggle to function effectively when unforeseen issues arise. Many boards are therefore prioritizing directors who combine broad operating experience with the ability to engage across multiple issues, supplemented by external advisors for deep, technical expertise as needed.

Beyond skills and demographics, leading boards are reframing refreshment as a question of how directors contribute, not simply what they know. As board agendas become denser and more complex, effectiveness increasingly depends on directors’ ability to engage constructively across issues, challenge management without defaulting to operational micromanagement, and collaborate under pressure. As a result, boards are placing greater emphasis on behavioral attributes—such as curiosity, adaptability, and sound judgment in ambiguous situations—when assessing both incumbent directors and new candidates. This shift reflects a recognition that governance failures more often stem from weak dynamics and insufficient challenge than from missing credentials alone.

Boards are also rethinking how refreshment decisions are made and communicated internally. Annual board and committee evaluations are becoming more rigorous and explicitly tied to refreshment outcomes, rather than treated as compliance exercises. High-performing boards are using evaluations to identify emerging gaps, anticipate upcoming retirements, and set expectations well in advance—reducing the stigma around turnover and avoiding abrupt, disruptive change. Importantly, these boards align refreshment decisions with committee leadership succession, ensuring continuity in critical oversight roles such as audit, compensation, and risk while still introducing new perspectives.

Finally, strategic board refreshment is increasingly viewed as a preventive governance tool rather than a reactive response to external pressure. Activist investors and proxy advisors closely scrutinize board tenure, skills alignment, and refreshment cadence as indicators of governance quality. Boards that can demonstrate a credible, ongoing refreshment process—anchored in strategy and documented through transparent disclosures—are better positioned to retain control of the narrative and timing of change. In this sense, refreshment serves not only to strengthen oversight but also to reinforce board legitimacy with shareholders by signaling selfawareness, accountability, and a willingness to evolve alongside the business.

Leading boards treat refreshment as a continuous process of strategic reconfiguration, blending new, forward-looking skills with the core competencies required of a governance and oversight body. This balanced approach not only strengthens corporate governance but also serves as one of the most effective defenses against shareholder activism, which frequently targets boards with outdated or misaligned skill sets.[10]

Priority 3: Build Resilience Amid Geopolitical and Economic Volatility

The governance landscape is being reshaped by powerful external forces, with geopolitical and economic volatility moving from peripheral risks to defining governance challenges for corporate boards—the top two most significant issues cited by directors and CEOs three years in a row.[11] Unlike prior periods, volatility today is not confined to isolated shocks. CEOs increasingly describe tariffs, protectionism, regulatory fragmentation, cyber threats, and geopolitical conflict as enduring features of the operating environment rather than temporary anomalies. This reality challenges traditional governance approaches that treat external risk as a periodic review item rather than a standing strategic consideration. For boards, this environment calls for greater discipline in how resilience is built into governance rather than reliance on ad hoc responses to disruption.

From a macroeconomic perspective, boards and governance leaders are entering 2026 against a backdrop of heightened economic fragility. Survey data from The Conference Board® C-Suite Outlook 2026: Uncertainty and Opportunity showed that CEOs identified economic downturn/ recession as the single-most-significant anticipated risk to business performance, cited by more than one-third of respondents globally and in North America.[12] Concerns about uncertainty itself—rather than any single policy or market variable—ranked nearly as high, particularly among CEOs in North America, underscoring how volatility has become a persistent operating condition rather than a cyclical deviation.

This framing matters for boards. Unlike prior periods in which economic risk was tied to a discrete variable such as interest rates, inflation spikes, or currency volatility, today’s environment is characterized by compounding pressures. CEOs are simultaneously weighing slowing growth, tighter financial conditions, fragile supply chains, policy unpredictability, and shifting trade regimes. Tariffs are also creating strategic uncertainty about market access, sourcing, and long-term capital deployment. In this context, boards are placing renewed emphasis on downside preparedness, balance sheet resilience, and management’s ability to operate effectively through prolonged ambiguity.

Geopolitical and security risks are also top of mind for business leaders. Trade policy, energy price volatility, cyber threats, and regional instability are increasingly seen as structural features of the global landscape rather than episodic shocks.[13] Importantly, CEOs are not distinguishing cleanly between “economic” and “geopolitical” risks; instead, they view them as deeply intertwined. Tariffs affect inflation and margins; energy prices shape competitiveness; geopolitical conflict drives regulatory fragmentation and supply-chain redesign. For boards, this convergence complicates oversight by rendering traditional risk categorization less effective.

Leading boards are responding by focusing more explicitly on resilience and agility as core leadership capabilities. Boards are placing greater weight on whether CEOs and senior leadership teams can adapt quickly, process diverse inputs, and recalibrate strategy in response to changing conditions rather than relying on fixed playbooks or linear planning assumptions. In this context, resilience extends beyond operational continuity to include leadership stamina, credibility, a culture that supports performance and collaboration, and the ability to sustain organizational focus through repeated periods of uncertainty.

Several governance implications follow. First, boards are integrating geopolitical and macroeconomic considerations more directly into strategic discussions, rather than siloing them within enterprise risk management processes.[14] Scenario planning is becoming more practical and iterative, testing how multiple stressors—such as trade disruption combined with regulatory change or cyber events—could interact and affect performance. The objective is not prediction but preparedness.

Second, boards are reassessing whether their own composition supports effective oversight in this environment. Directors with experience in global operations, regulated industries, or public sector contexts can help boards better challenge assumptions and evaluate management’s readiness. This does not imply that boards should attempt to forecast geopolitical outcomes but rather that they should be equipped to assess how management is planning for uncertainty.

Third, boards are sharpening expectations around risk ownership and escalation. Effective oversight increasingly requires clear accountability for geopolitical and economic risks; welldefined escalation thresholds; and evidence that resilience planning is operationalized through liquidity management, supply-chain design, cybersecurity preparedness, and leadership succession depth.

Resilience has thus emerged as a test of governance quality. Boards that embed resilience into leadership evaluation, strategic review, and risk oversight are better positioned to navigate sustained volatility while preserving long-term value and strategic flexibility

Priority 4: Formalize AI Governance and Strategic Oversight

AI has rapidly become a central strategic and governance challenge for every corporate board. Boardroom engagement on AI has increased dramatically, yet a critical gap has emerged between discussion and action.[15] While many public company boards now regularly set aside agenda time for AI discussions, most have not yet determined how to integrate it into their formal governance structures. This inaction is creating a landscape of unmanaged risk and preventing companies from realizing the technology’s full strategic potential.

Boards therefore face a dual challenge: AI is evolving quickly and becoming embedded in most areas of operations and decision-making, while directors are still building the knowledge needed to ask the right questions and provide effective oversight. In response, boards are investing more heavily in ongoing learning through management briefings, external experts, and targeted education sessions. Importantly, boards are also becoming more selective about the type of expertise they seek. Rather than overspecializing around narrow technical credentials, many boards are prioritizing directors who combine strong operating judgment with the ability to ask informed, cross-cutting questions about technology’s strategic and organizational implications.[16]

Leading boards are also beginning to formalize AI oversight in pragmatic ways. Rather than creating entirely new governance structures, many are embedding AI more explicitly into existing oversight mechanisms—such as risk, audit, or strategy discussions—and clarifying which committees or directors are responsible for monitoring AI-related issues. The emphasis is on clarity of ownership, regular review, and alignment with broader enterprise risk oversight.

Boards are encouraging management to frame AI risks within existing risk management systems. While some AI risks are novel, many—such as bias, data governance, cybersecurity, or regulatory exposure—are extensions of familiar enterprise risks. Integrating AI into established frameworks allows boards to leverage existing controls while identifying where AI introduces new complexities, including automation and increased decision-making autonomy. A recent analysis by The Conference Board of S&P 500 disclosures on AI risks in proxy statements underscores where boards perceive risk to be concentrated, emphasizing reputational, cybersecurity, and legal and regulatory challenges.[17]

Preparedness and accountability are also becoming defining markers of effective AI governance. Beyond policies and principles, leading boards are asking management to define what constitutes an AI-related incident, how issues are escalated, and how response processes are tested. Scenario exercises—once reserved for cyber or financial stress events— are increasingly being applied to AI use cases, reinforcing the expectation that AI risks are operational, not hypothetical.

Only once governance foundations are in place are boards shifting attention to execution, capability, and scale. Survey results reflect this transition: CEOs’ top AI priorities for 2026 focus on building internal expertise (31% globally; 37% in North America), strengthening organizational culture to support adoption (26.8% and 25.6%, respectively), and leveraging the most effective tools via building or buying (24.6% and 23.3%, respectively). Operational priorities—such as integrating data, improving output quality, and identifying proven use cases—also feature prominently, signaling a shift from experimentation toward practical deployment.[18] For directors, the implication is clear: effective oversight increasingly centers on ensuring the capabilities, infrastructure, and governance needed to implement AI at scale and embed it into core business operations.

Ultimately, AI governance is inseparable from strategic oversight. CEOs increasingly view AI as both a major investment priority and a source of execution risk, with growing attention to data quality, organizational readiness, and the ability to deploy AI effectively across the business. Boards therefore play a critical role in ensuring that oversight balances innovation with discipline—providing guardrails that enable responsible adoption while protecting enterprise value.

Priority 5: Proactively Manage Shareholder Activism

Shareholder activism has solidified into a permanent, system-level governance challenge that boards must address proactively rather than reactively. As illustrated by recent data tracked by The Conference Board® and data analytics firm ESGAUGE, activist investors had launched 17 proxy contests against S&P 500 companies and 57 against Russell 3000 companies in 2025 as of October 31, 2025—the highest annual campaign volume recorded since 2018.[19] This surge was especially pronounced in Q3 2025 and spanned multiple industries, with consumer discretionary (10 contests) and health care (12 contests) among the most frequent targets. These figures underscore that shareholder activism has evolved into a critical board-level risk demanding constant vigilance and preparedness.

Activists’ tactics have grown more sophisticated, often bypassing full proxy fights for faster-moving maneuvers. Modern campaigns often use exempt solicitations, “vote-no” campaigns, and other public messaging to sway investor sentiment without the expense and complexity of a formal proxy contest. Activists coordinate these efforts with press releases, open letters, and social media to amplify their impact, leveraging digital storytelling to rally support. In this environment, boards must be adept at rapid response—making modern communication channels and crisis plans indispensable to their defense and ensuring the company’s strategy is clearly communicated in real time to all stakeholders.

One notable development is the sharp rise in CEO-focused activism. Between 2018 and 2025, activists launched 127 campaigns explicitly seeking to oust or replace the CEO, of which roughly 38% resulted in a leadership change. The pace of these campaigns accelerated after 2020—only five CEO-targeting campaigns occurred in 2018 and four in 2019 but the first 10 months of 2025 alone saw a record 39 such campaigns. This shift signals a structural change in investor expectations around accountability: increasingly, activists view the chief executive as directly responsible for strategic missteps; environment, social & governance issue controversies; or prolonged underperformance. If boards fail to rigorously evaluate and refresh leadership when necessary, activists may force the issue.

Activist interventions are often symptoms of deeper governance shortcomings, not just isolated attacks.[20] Activism frequently serves as a market-driven response to issues that boards have left unattended—whether a stagnant board composition, a lack of strategic direction, or unresolved succession plans. For example, a board that has not refreshed its mix of skills in line with the company’s strategy may find activists capitalizing on that stagnation as evidence of weak oversight. Likewise, if a company’s strategy is faltering or poorly articulated, activists will invoke “unlocking shareholder value” to push for change. Put simply, activism thrives where governance falters. Directors should view activism not as a random threat but as a predictable consequence when a board falls behind on its core duties. Many activist campaigns can be preempted by identifying and addressing such governance gaps early.

The most effective defense against activism is not a last-minute scramble when a proxy fight looms but an ongoing commitment to strong governance and communication. Boards that regularly engage shareholders and clearly communicate a credible long-term strategy are less vulnerable to activists hijacking the narrative. An equally important element of activist preparedness is the board’s ability to objectively assess the merits of an activist’s requests, rather than reflexively resist them. Several analyses highlight that not all activist proposals are purely adversarial; some reflect legitimate investor concerns around strategy, performance, governance, or leadership accountability. Long-standing governance practice therefore calls on boards to distinguish between opportunistic or short-term campaigns and those that raise substantive, data-driven issues. A disciplined evaluation of both the proposal itself and the activist’s credibility—often informed by engagement with other major shareholders— strengthens board decision-making and reinforces legitimacy. By demonstrating that proposals are assessed on substance rather than posture, boards can narrow activists’ room to gain traction while preserving strategic control and long-term value focus.[21]

Continuous board refreshment is equally critical: by aligning director expertise and tenure with evolving strategic needs, boards improve oversight and deny activists an easy target in the form of “entrenched” directors. Likewise, rigorous performance evaluations—and a willingness to make leadership changes or accelerate succession when merited—signal that the board is actively managing leadership, preempting many activist arguments. Additionally, since many campaigns play out publicly, boards need advanced communication and rapid response plans. Just as activists use media to rally support, companies must proactively tell their story on those same channels to address concerns before they escalate.

Encouragingly, activist investors do not always succeed, especially when boards have strong shareholder support. Under the Security and Exchange Commission’s universal proxy rules, activists may have been emboldened to launch more board challenges but winning seats remains difficult. Of 57 proxy contests tracked in the first 10 months of 2025, only eight went to a vote and companies prevailed in five. This track record shows that diligent boards, backed by institutional investors, can fend off most campaigns.

The lesson is that trust building with shareholders via transparent governance, a credible strategy, and solid performance creates a resilient defense. Shareholder activism is here to stay but boards that stay ahead of the curve can manage it on their own terms rather than react to it. By treating activism as a constant factor in oversight and addressing vulnerabilities proactively, boards can turn a potential disruption into a manageable aspect of governance—ultimately reinforcing accountability and long-term value creation.

Conclusion

Across all five priorities, a common imperative emerges: governance effectiveness in 2026 will be defined less by episodic intervention and more by disciplined, integrated oversight. Boards are operating in an environment characterized by leadership churn, sustained volatility, accelerating technological change, and heightened external scrutiny. In this context, governance practices that were once treated as periodic or reactive—CEO and executive succession planning, board refreshment, risk oversight, AI governance, and shareholder engagement—must now function as continuous, interdependent systems.

The most effective boards are those that establish a clear cadence for exercising these responsibilities, align them explicitly with long-term strategy, and test their readiness before pressure mounts. This requires directors to move beyond compliance-oriented frameworks toward governance that is anticipatory, data informed, and resilient by design. Boards that invest early in leadership depth, skills alignment, transparent communication, and clear

accountability retain greater control over timing, narrative, and strategic flexibility. As the governance environment becomes more demanding, preparedness itself has become a source of competitive advantage and a defining marker of board effectiveness. Read More.