Cyber Attacks Don’t Break Organisations — Leadership Blind Spots Do 

What the Co-op headlines reveal about culture, governance, and surviving a cyber crisis.

Some organisations don’t discover they have a culture problem until the day they need their culture to save them. The recent headlines surrounding alleged cultural concerns inside the Co-op should make every CEO, board director, NED, and founder pause — not to judge from afar, but to reflect inward.

For too long, culture has been treated as a soft topic. An HR discussion. A values exercise delegated to the people function. That mindset is outdated for the world we operate in.

Let me be clear. Culture is a risk function. It’s a governance issue, and increasingly, it’s a determinant of organisational survivability, because leadership teams rarely lose control during a crisis. They discover where control never truly existed.

The Paradox of Competence

What makes the current Co-op narrative so uncomfortable — and so instructive — is the contrast.

During last year’s cyber attack, the organisation delivered what many observers considered a masterclass in crisis leadership.

They acted decisively.
Protected trading operations.
Communicated under extraordinary pressure.
Shared lessons with the wider business community.

Crucially, they recognised the human cost of the incident — providing psychological and wellbeing support to colleagues, many of whom took the attack personally after working tirelessly to keep stores operating.

That is what organisational strength looks like when tested, which raises a difficult — and rarely asked — leadership question:

Is it possible for an organisation to perform brilliantly in a crisis, yet be weakening culturally at the same time?

The answer is yes. And that is precisely where the risk lives, because crisis execution and cultural health are not the same capability.

Many organisations mistake adrenaline for culture. When the stakes are existential, people often rise to the moment regardless of environment. But resilience built on heroics is not sustainable resilience.

Eventually, exhaustion replaces adrenaline.
Silence replaces challenge.
And truth begins to slow.

Culture Behaves Like Structural Integrity

Many executive teams assume culture reveals itself gradually. In reality, culture behaves more like structural integrity — invisible right up until the moment pressure is applied.

A cyber attack.
A regulatory investigation.
A strategic shock.

These are not just operational tests. They are organisational MRI scans and they reveal:

• How truth travels
• How power flows
• Whether challenge is genuinely safe, and
• Whether leadership is hearing reality — or an edited version of it

Because the speed of truth inside an organisation determines the speed of its survival. And filtered truth is not a communication issue. It is a governance failure. And by the time leaders recognise it — culture is no longer supporting resilience. It is shaping the outcome.

When Truth Slows, Risk Accelerates

Culture is not what an organisation says it values.  It is what happens to truth inside the system.

Is it welcomed — or filtered?
Rewarded — or remembered?
Escalated — or quietly buried?

When fear enters an organisation — when people learn to “look at their shoes” rather than speak — something structurally dangerous begins to happen:

Truth loses velocity. And when truth slows:

• Decision quality deteriorates
• Risk compounds silently
• Small problems evolve into strategic threats

In cybersecurity, I often say:

“Culture is how fast truth travels when something goes wrong.”

If senior voices feel unable to speak candidly, you don’t simply have a culture issue. You have a survivability issue.

The Echo Chamber Risk

To be clear — none of us sees the full internal reality of any organisation from the outside. Leadership is complex. Transformation creates friction. Difficult decisions inevitably generate dissent.

But moments like this should trigger reflection in every boardroom:

• Do our people feel genuinely safe challenging leadership?
• Does uncomfortable truth reach the top quickly?
• Or has past success created a leadership echo chamber?

Because success carries its own risk — it can dull a leadership team’s sensitivity to weak signals.

Cultures rarely fracture overnight.

They erode quietly…
then fail suddenly.

Culture Is Moving Into the Boardroom

There is a broader shift underway that many leadership teams have yet to fully internalise:

Culture is migrating from a “people topic” to a governance responsibility.

Boards today are expected to understand not just financial exposure, but behavioural risk — the conditions under which poor decisions go unchallenged.

Why?

Because in modern organisations, culture is not separate from resilience. It is the infrastructure beneath it. Resilience is not built on process alone. It is built on behaviour. And cyber resilience is not built during an incident — it is revealed by it.

The same is true of culture. On your best day, strategy leads. On your worst day — culture decides.

The Leadership Illusion

Many leadership teams believe their organisation is more transparent than it truly is, until pressure tests it. Because crisis does something few dashboards can:

It exposes the gap between the culture leaders believe they have — and the one that actually operates.

The strongest cultures are not those without tension. They’re the ones where truth outruns discomfort – where challenge is interpreted as commitment, not disloyalty. And where leadership curiosity is stronger than leadership ego.

A Leadership Reflection

The ability to mobilise during crisis is a capability and psychological safety is a condition. Wise organisations ensure they have both. So perhaps the question this moment invites every leadership team to consider is not whether another organisation has a culture problem…

but whether the signals of their own are being heard early enough.

Because some risks announce themselves loudly. Cultural risk rarely does — until the day it becomes operational. And by then, leadership is no longer managing culture. Culture is managing the outcome.

Now I want to hear from you…

I’d love to hear your thoughts on this, so head over to LinkedIn and tell me:

• Can strong crisis performance mask deeper cultural strain?
• What early signals tell you a culture may be weakening?
• And how should boards measure the health of truth inside their organisations?

Because one thing is becoming increasingly clear:

The speed of truth inside an organisation determines the speed of its survival.