I spend a fair bit of time these days wondering when I’ll stop being useful on the boards I sit on. Not in a morbid way, more as a discipline. It’s the same question worth asking in any job, any career, any relationship, really: am I still pulling my weight here, or just occupying the chair out of habit?
Two things have got me thinking about this lately. One is the old chestnut of board tenure and succession. The other is how much the world has shifted under our feet, particularly around AI and security. The first is really just a warm-up for the second.
Every decent director eventually asks themselves whether they’re still the right person at the table. Long tenure gives you memory and pattern recognition, sure, but it also breeds a certain smugness, a sense that the way things have always been argued about is the way they should keep being argued about. That’s not a board-specific failing. It’s the same rut that catches the manager still running meetings the way he did in 2015, or the tradesperson who hasn’t picked up a new technique since his apprenticeship. Relevance isn’t a certificate you earn once. You pay for it monthly, and it lapses fast if you stop.
I don’t want to be the guy still in the seat three years after I’ve stopped adding anything. So my question to chairs handling succession is simple: given how fast things move now, do you actually have the right people around this table, or just the people who were right a few years back?
Quick caveat before anyone reads this as a swipe at older directors. It isn’t. I’ve sat with thirty-year-olds who barely understand what a phishing email is, and directors in their seventies who could teach a masterclass on emerging risk. Age isn’t the test. The test is whether you’re actually using AI tools yourself, or just have views on them from a safe distance. Whether you’re watching what’s happening in real time, or waiting for someone to brief you on it once a year. That test applies whether you’re on a board, running a small business, or just trying to stay employable. Digital and security literacy isn’t a nice extra on anyone’s CV anymore. It’s baseline.
Which brings me to the skills matrix, a tool most boards treat as an annual box-ticking chore. Dust it off, everyone marks their own homework generously, file it away, forget about it for a year. Financial acumen, tick. Industry experience, tick. Risk, tick. That’s not a skills matrix; it’s a participation certificate, and about as useful as a performance review where everyone already knew the scores before the meeting started.
A matrix worth the paper needs honest lines for AI literacy, cybersecurity, geopolitical exposure, and genuine evidence of ongoing learning rather than a badge earned in 2019 and never dusted off since. It also needs honest scoring, not the version where every director gives themselves a four out of five because nobody fancies the awkward conversation that follows a two.
Succession should come out of that honest assessment, not habit. Too often a departing director gets replaced by their near clone, same industry, same vintage, same comfortable fit, and the board ends up blind to the same risks generation after generation. Plenty of organisations make the same mistake with staff, replacing people with near copies and wondering why the blind spots never move. Every vacancy deserves a sharper question: what capability actually leaves with this person, and does the replacement fix that gap or just paper over it?
Now, the landscape itself, which has moved a long way even within most directors’ current tenure. I was recently at a private briefing run by a few agencies you’d recognise from their three- and four-letter acronyms, the sort of session where phones stay at the door, and half the room only uses first names. It wasn’t comfortable listening. Espionage against New Zealand organisations is almost certainly happening right now, quietly, foreign states after our infrastructure and our IP. Several states are running interference operations here, and the message was blunt: that shiny new opportunity landing on your desk might not be what it appears. On the cyber side, state-backed actors are scaling up, geopolitics is making everything more adversarial, and the supply chain has become the favoured way in, cheaper and quieter than a direct hit. Your CEO, just by being visible, is now a target in their own right.
So the real question is whether the traditional governance rhythm still holds up. Meetings every six weeks or two months, a fixed agenda, a work plan nobody revisits until next cycle – does that cut it when threats mutate weekly and an AI capability that didn’t exist last quarter might already be reshaping your competitive position or your attack surface? I don’t think it does, and I don’t think most of us applying the same slow cycle to our own skills are doing much better.
What’s needed isn’t more meetings; nobody wants that. It’s shorter touchpoints between them, a low-key way to flag something urgent without waiting for the calendar, real collaboration between board and management on scanning the horizon, and a culture where someone can say “have you seen what just happened with X” without getting shushed back to the agenda. A board that only thinks about this stuff once a year, via directors whose matrix hasn’t been honestly checked since before ChatGPT existed, isn’t being cautious. It’s governing for a world that’s already gone. Worth asking yourself the same, wherever you happen to be sitting.
