Why Cybersecurity Is Now a Boardroom Priority, Not Just IT

Jan de Vries · 2026-10-13

By Michele Centemero Whether I'm speaking to a retailer in Italy, a fintech founder in London or a bank in Germany, I often hear different versions of the same question: How can we continue to innovate and move faster without exposing our organisations and customers to greater risk? It's an understandable concern. Across Europe, businesses are investing in new technologies, embracing AI and finding new ways to serve customers, while navigating changing regulation, rising expectations and more sophisticated threats. The ambition is there. What's harder to find is the confidence to act. ### Cybersecurity Is No Longer Just an IT Issue For a long time, cybersecurity was seen primarily as the responsibility of the IT department. That view no longer reflects reality. A cyber incident can bring operations to a halt, disrupt customer relationships and damage trust built over many years. Today, cybersecurity is discussed not only in server rooms, but increasingly in boardrooms. Recent Mastercard research found that 93% of European organisations have experienced fraud or attempted cyberattacks within the past year, with a third (32%) saying that such attempts are becoming more frequent. But these figures tell only part of the story. What stays with me is the uncertainty behind them. Leaders know they need to act, but it's not always clear where to begin, which risks demand immediate attention or whether their investments are making a meaningful difference. Seven in ten (69%) business leaders say measuring the success of cybersecurity investments is challenging. Similar numbers report difficulties integrating security measures with legacy systems and managing AI-enabled attacks. > "The goal cannot be to eliminate every risk. No organisation can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption and knowing how to respond when something goes wrong." ### Rethinking How We Talk About Cybersecurity This is why we need to rethink the way we talk about cybersecurity. The goal cannot be to eliminate every risk. No organisation can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption and knowing how to respond when something goes wrong. What I find encouraging is that many organisations are already changing the way they approach cybersecurity. One in three European business leaders say that, as their organisations increase their use of technology, they are broadening their cybersecurity priorities. These include real-time monitoring and incident response, supplier risk management and compliance with evolving AI regulation. These are not simply technical decisions: they are decisions about how a business protects its ability to operate, innovate and retain the confidence of its customers. ### Collaboration Is Key to Resilience These are also decisions that cannot be made in isolation. No business operates alone anymore. Suppliers, technology providers, payment partners and service providers all play a role in keeping businesses and their customers safe. A weakness in one part of that network can have consequences across the rest of it. That's why third-party risk management is becoming such an important priority for business leaders. Many European leaders also recognise that they don't have every answer in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner and respond with greater confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators and law enforcement to share intelligence and strengthen collective defences. We continue to invest in technologies and partnerships that help organisations understand cyber risk and respond to emerging threats. ### Leadership and Culture Matter Technology matters, but technology alone will never be enough. Resilience also depends on leadership, clear accountability and a culture in which security is part of everyday decision-making. Boards should be asking not only whether their organisations are protected, but how risk is measured, how quickly the business could recover and what a serious incident would mean for customer trust. Cybersecurity is no longer a technical checkbox. It's a business imperative that demands attention from the top down. By fostering a culture of security, investing in the right partnerships and measuring what matters, organisations can innovate with confidence and protect what they've built.