Progressive Grounds

Technology risk management: the risk you can't see

Technology risk is one of the biggest risks in your business, and it's growing every month: inside your own systems, your supply chain and your IT providers. Does anybody on your board own it? Get control before it gets out of control.

Book a 20-minute call

What is technology risk management?

Knowing which technology risks the business carries, who owns each one, and what the board has decided to do about them. Not an IT checklist: a board decision.

1. Inside your own systems

Several UK contractors, including a tier-one group, have been hit by ransomware or cyber attacks since 2020; one was fined £4.4m by the ICO.

Nearly half (45%) of UK construction businesses identified a cyber breach or attack in the past year (DSIT, 2026).

The NCSC handled 204 nationally significant cyber incidents in the year to August 2025, up from 89 the year before; the most serious category has risen three years running.

Only about one in four construction firms have anyone on the board who owns cyber (DSIT, Apr 2026). Is that seat filled at your table?

2. Your supply chain and IT providers (third party risk management)

Your subcontractors, cloud services, software and outsourced IT all carry risk into your business. Who checks them, and who signs it off?

Only 15% of UK businesses check the cyber risk of their immediate suppliers, and just 6% look at the wider supply chain (DSIT, 2026).

Almost half (48%) of breaches now involve a third party, up from 30% a year earlier (Verizon DBIR 2026, global, vendor).

3. AI governance

Across the UK economy, most employees now use AI at work, and many do so without their employer's approval: 71% of UK employees have used unapproved AI tools (Microsoft survey, 2025; vendor), and in a 47-country study almost half admitted using AI against company policy (University of Melbourne/KPMG, 2025). Do you know what your people are putting into AI tools?

Three in ten UK businesses now use AI, up from under one in ten in 2023 (ONS).

What is shadow AI, and is it happening in your firm? Shadow AI is staff using AI tools the business hasn't approved. The useful question isn't whether it exists, but whether you know what data is going into those tools.

Who owns it?

In our screen, 104 of 106 UK construction and engineering firms below about £1bn turnover had no dedicated technology director on the board; the other 2 are unconfirmed (Companies House, Oct 2026).

How these two figures differ: the DSIT figure counts anyone on the board with cyber in their remit, across firms of all sizes (mostly small). Our screen counts a dedicated technology director, at mid-sized firms. Both point the same way: cyber is rarely anyone's main job at board level.

You may not need a full-time CIO. You may need a senior owner for the decisions that matter.

How I help

  • Strategy Alignment (£7k): a board-level view of your technology risks and where to start.
  • Fractional CIO: a senior owner for technology risk, part-time.
  • Interim CIO or transformation lead: when a programme or a gap needs full attention now.

I led technology for a national engineering and construction group from October 2021 to March 2026.

Book a 20-minute call Take the scorecard

Sources