As digital transformation accelerates across enterprises, a sobering reality has emerged: more than a quarter of U.S. businesses remain dangerously unprepared to handle AI-related risks, while nearly a third lack sufficient trusted vendors to manage critical threats. These findings, revealed in recent research by next-generation digital risk advisory firm CyXcel, underscore a fundamental shift in how organizations must approach cybersecurity and risk management in an era where AI governance, geopolitical instability, and evolving regulatory frameworks like NIS2 and DORA are converging to create unprecedented complexity.
In response to these challenges, CyXcel has launched its Digital Risk Management (DRM) platform�a unified SaaS solution that moves beyond traditional siloed compliance tools to deliver real-time, intelligence-driven risk insights across seven critical categories: AI Governance, Corporate Responsibility, Cyber, Geopolitics, Regulation, Supply Chain, and Technology. In this exclusive VMblog Q&A, Dr. Megha Kumar, Chief Product Officer and Head of Geopolitical Risk at CyXcel, explains how organizations can transform from reactive, compliance-centered models to proactive risk strategies that turn digital vulnerabilities into competitive advantages, while protecting leadership from mounting legal exposure in an increasingly interconnected threat landscape.
++
VMblog: Let’s start with the big picture-what does CyXcel do, and what sets your approach apart in the cybersecurity and digital risk space?
Dr. Megha Kumar: CyXcel is a next-gen professional digital risk advisory firm with a mission to help businesses transform digital risks into strategic opportunities for growth and resilience. We manage crises, monitor risk, solve challenges and seize opportunities for everyone in the digital world.
We help organizations anticipate, assess, and act on digital risks before they become business disruptions, and act rapidly in times of crisis. Our approach fuses deep technical expertise with legal, geopolitical, and regulatory insight to give clients a 360-degree understanding of their threat landscape. What sets us apart is our cross-functional model: we don’t just tick compliance boxes, we operationalize cyber resilience. Whether we’re conducting digital forensics and threat intelligence, advising on supply chain threats, or embedding AI risk governance, we enable businesses to make informed, defensible decisions at speed.
What sets CyXcel’s approach apart is our holistic integration of cyber, legal, technical, and strategic expertise. Our proactive, interconnected approach allows organizations to align risk management directly to business strategy and operational resilience.
VMblog: Your recent research reveals that more than a quarter of U.S. businesses are still dangerously unprepared to handle AI-related risks. What’s driving this lack of preparedness, and what are the consequences?
Kumar: CyXcel’s research found that over a quarter of U.S. businesses have only just begun addressing AI risk (27%), and almost as many (23%) lack any formal AI governance policy. Drivers of this gap include rapid, uneven AI adoption; lack of in-house expertise; confusion over regulatory changes; and the complexity of emerging threats like AI data poisoning and deepfakes. Many organizations underestimate how easily AI systems can be exploited or manipulated, while others wrestle with strained budgets and competing priorities.
Often there is unclear accountability, a lack of practical AI risk tooling, and an overreliance on legacy compliance models. An abundance of businesses haven’t yet connected the dots between AI innovation and risk governance, particularly when AI decisions affect privacy, IP, bias, environmental footprint or operational control.
The consequences are significant: heightened risk of data breaches, regulatory penalties, reputational harm, strategic missteps and critical disruptions to operations. As AI attacks evolve in sophistication and frequency, companies that are slow to develop governance and controls will find themselves increasingly exposed. Unmanaged AI risk isn’t just a technical issue, it’s a board-level vulnerability.
VMblog: You recently launched the CyXcel Digital Risk Management (DRM) platform. What makes this platform different from traditional risk or compliance tools?
Kumar: The CyXcel DRM platform stands out by unifying digital risk monitoring, compliance management, and threat intelligence into one online SaaS offering. Unlike traditional risk or compliance tools which can be fragmented and static, focusing on narrow problems or siloed reporting, the DRM gives a full-spectrum, real-time view across seven key risk categories: AI Governance, Corporate Responsibility, Cyber, Geopolitics, Regulation, Supply Chain and Technology.
The platform enables companies to audit exposure to risk continually, benchmark controls and mitigations against industry standards and good practice, and allows companies to gain a streamlined view of their enterprise-level risks. It also includes bespoke remediation services, cross-jurisdictional legal support, and guidance on aligning risk practices with regulations like NIS2 and DORA. By serving the needs of risk owners from CISO and legal counsel to the board, CyXcel helps close the operational and strategy gaps that leave businesses vulnerable. Since these different functions speak different languages due to their expertise, the DRM allows different functions to get on the same page. This allows companies to prioritize investment in a cost-effective, cogent and proactive way.
It’s not just about tracking risk; it’s about surfacing the risks that matter, when they matter, and linking them to real-world business impact. The CyXcel DRM brings together threat intelligence, regulatory mapping, supply chain profiling, and AI risk tracking into a single operational view, enabling better decisions, faster.
VMblog: One of the standout findings in the research you had conducted is that a third of organizations don’t have enough trusted vendors to help them manage critical threats. How did we get here, and what role should internal risk visibility play?
Kumar: Many organizations built their supply chains for efficiency and cost effectiveness, not resilience. Now, they’re facing a shortage of qualified, trusted partners who understand both the technical and regulatory sides of risk. Compounding that is limited internal visibility, companies often don’t know which suppliers have access to sensitive data, or how risk flows through the digital supply chain.
Nearly a third of organizations lack enough trusted vendors to help manage critical cyber, technology-related and AI threats. This stems from two main factors: strained relationships with external partners and insufficient internal understanding of digital risks. Many organizations, overwhelmed by the pace and complexity of new threats, have turned to third-party vendors without the in-house capability to properly vet or oversee them. This has led to fragmentation and a fragile risk posture. CyXcel stresses that true resilience starts with clarity: before outsourcing critical tasks, organizations must first achieve robust visibility into what threats they face and how prepared they are.
Without that visibility, it’s impossible to manage exposure effectively. Transparency must come first, only then can you build the right ecosystem of external support.
The DRM platform provides this by allowing tailored, granular risk assessments and insights, empowering better decision-making when engaging vendors.
VMblog: The convergence of cyber threats, AI, and geopolitical instability is forcing companies to rethink their approach to risk. How should organizations be evolving their strategies in response?
Kumar: Risk management can no longer be siloed. The strategies that worked five years ago, compliance-led, IT-owned, and annual-review based, simply don’t reflect today’s operating environment.
With cyber threats, AI risks, and geopolitical instability converging, organizations must shift from reactive, compliance-centered models to proactive, intelligence-led risk management. This means continuously monitoring the entire digital risk landscape; integrating threat intelligence with compliance efforts; preparing for nation-state cyberattacks, supply chain disruption, and AI misuse; and ensuring that all parts of the organization, from IT to the board, are informed and aligned on what matters. Organizations must adopt an integrated model that includes cyber risk, AI ethics, third-party exposure, and geopolitical intelligence.
That means stronger internal governance, increased cross-functional collaboration, and tools that can adapt to change, not just report on it. Dynamic platforms like CyXcel’s DRM enable organizations to benchmark controls, anticipate regulatory changes, model impacts of new threats, and prioritize intervention where it matters most. The need for adaptive, forward-looking strategies has never been more vital.
VMblog: You’ve made a point to emphasize that your DRM platform goes beyond checklists and static dashboards. What does a more dynamic, intelligence-led approach to risk management look like in practice?
Kumar: A dynamic approach means embedding live threat intelligence, contextual business data, and scenario-based analysis into the risk workflow. For example, if a critical supplier in Eastern Europe is affected by sanctions or a cyberattack, the DRM service flags related operational and regulatory exposures and recommends action. This is about proactive risk navigation, not passive compliance reporting.
Furthermore, our DRM exemplifies a move beyond checklists and static dashboards. It employs the latest quantitative and qualitative data, expert analysis, and actionable intelligence to detect changing risks and alert stakeholders in a timely manner. Users can visualize risk exposures, maturity of internal controls, and current performance against industry best practices at a glance. Dynamic remediation advice can be tailored to business unit, geography, or threat type, so companies can act fast, reduce response times, and align strategy to evolving risks rather than reacting after the fact. This approach empowers everyone from the CISO to supply chain managers to anticipate emergent threats, rather than simply record them belatedly.
VMblog: Legal exposure is a growing concern for executives-especially when regulations like NIS2 and DORA start impacting global operations. How does the DRM support compliance and protect leadership from liability?
Kumar: The DRM platform aligns digital risk controls directly with frameworks like NIS2, DORA, GDPR, and sector-specific obligations alongside broader digital risk management. It maps those requirements across business units, suppliers, and systems, making it easier for executives to demonstrate due diligence, justify decisions, and respond to regulatory inquiries with evidence.
Unlike traditional systems where risk and compliance are siloed, the DRM platform streamlines regulatory tracking and compliance, helps automate evidence-gathering, and provides access to dispute resolution and litigation support across multiple jurisdictions. For leaders, this means reduced personal liability risk, stronger assurance on data protection, and less administrative burden during regulatory probes or enforcement actions. The DRM’s regulatory offering is especially crucial for organizations operating in multiple regions and those handling critical infrastructure, where regulatory scrutiny and penalties are increasing rapidly.
In short, it gives leadership confidence that their operations are not just compliant, but robust and resilient.
VMblog: Looking ahead, how do you see the digital risk landscape evolving, and what should business and IT leaders be doing now to stay ahead of emerging threats?
Kumar: Digital risk landscape becoming more interconnected, faster-moving, and consequence-heavy. AI governance, cross-border regulation, and supply chain volatility will define the next decade. Leaders need to invest in visibility, agility, and accountability, building capabilities that let them respond in real time, rather than react after the fact. The organizations that win will be those that treat risk management as a strategic function, not a compliance chore.
The cyber threat ecosystem is intensifying, with AI-driven attacks, geopolitical turbulence, and regulatory changes accelerating in tandem. CyXcel recommends future-ready leaders should:
- Prioritize dynamic, intelligence-driven risk management that ties cyber, legal, and operational strategies together.
- Ensure strong internal risk visibility and ownership before increasing outsourcing.
- Benchmark and continuously update controls against evolving standards and regulations.
- Adopt platforms that provide real-time threat insights, cross-jurisdictional compliance, and agile response capabilities.
- Prepare for increasing board- and C-suite-level scrutiny on resilience, not just compliance.
By taking these proactive steps, supported by tools like CyXcel’s DRM, organizations can stay ahead of emerging threats, reduce liability exposure, and turn risk management into a source of competitive advantage.
##
