Why Cybersecurity Is Now a Boardroom Priority, Not Just IT

Jan de Vries · 2026-10-13

### The Question Every Leader Is Asking Whether I'm talking to a retailer in Italy, a fintech founder in London, or a bank in Germany, I keep hearing the same question in different words: How do we keep innovating and moving faster without putting our business and customers at greater risk? It's a fair concern. Across Europe, companies are investing in new tech, embracing AI, and finding fresh ways to serve customers. But they're also dealing with changing regulations, rising expectations, and more sophisticated threats. The ambition is there. What's missing is the confidence to act. ### Cybersecurity Is No Longer an IT Issue For years, cybersecurity was seen as the IT department's job. That view is outdated. A cyber incident can stop operations cold, disrupt customer relationships, and damage trust that took years to build. Today, cybersecurity is discussed in the boardroom, not just the server room. And the numbers back it up. Recent Mastercard research found that 93% of European organizations have experienced fraud or attempted cyberattacks in the past year. A third (32%) say those attempts are becoming more frequent. But the stats only tell part of the story. What sticks with me is the uncertainty behind them. Leaders know they need to act, but they're not always sure where to start, which risks need immediate attention, or whether their investments are actually making a difference. Seven in ten (69%) business leaders say measuring the success of cybersecurity investments is challenging. Many also struggle to integrate security with legacy systems and manage AI-enabled attacks. ### Rethinking How We Talk About Risk We need to change the conversation. The goal can't be to eliminate every risk—no organization can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when something goes wrong. What's encouraging is that many organizations are already shifting their approach. One in three European business leaders say that as they increase their use of technology, they're broadening their cybersecurity priorities. That includes real-time monitoring, incident response, supplier risk management, and compliance with evolving AI rules. These aren't just technical decisions—they're decisions about protecting the business's ability to operate, innovate, and keep customer trust. ### No Business Is an Island These decisions can't be made alone. No business operates in a vacuum. Suppliers, tech providers, payment partners, and service providers all play a role in keeping businesses and customers safe. A weakness in one part of the network can have ripple effects across the rest. That's why third-party risk management is becoming a top priority for leaders. Many European leaders also recognize they don't have all the answers in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner, and respond with greater confidence. > "Resilience grows through collaboration." That's what we've learned at Mastercard. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We continue to invest in technologies and partnerships that help organizations understand cyber risk and respond to emerging threats. ### Technology Alone Isn't Enough Technology matters, but it will never be enough on its own. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making. Boards should be asking not just whether their organizations are protected, but how risk is measured, how quickly the business could recover, and what a serious incident would mean for customer trust. Cybersecurity is no longer a checkbox. It's a business imperative. And the confidence to act comes from understanding, preparation, and collaboration.