NEDs need to play a more active role in holding their board to account on cyber.