Why Cybersecurity Is Now a Boardroom Priority, Not Just IT

Jan de Vries · 2026-10-13

I talk to a lot of business leaders across Europe—retailers in Italy, fintech founders in London, bankers in Germany—and they all ask some version of the same question: How do we keep innovating and moving faster without putting our customers and our company at greater risk? It's a fair concern. Businesses everywhere are investing in new tech, embracing AI, and finding fresh ways to serve customers. But they're also dealing with changing regulations, rising expectations, and increasingly sophisticated threats. The ambition is there. The confidence? That's harder to find. ### Cybersecurity Is No Longer Just an IT Problem For years, cybersecurity was seen as the IT department's job. That view is outdated. A cyber incident can stop operations cold, damage customer relationships, and erode trust that took years to build. Today, cybersecurity is a boardroom topic, not just a server-room one. And the numbers back it up. Recent Mastercard research found that 93% of European organizations experienced fraud or attempted cyberattacks in the past year. A third (32%) say those attempts are becoming more frequent. But the stats only tell part of the story. What sticks with me is the uncertainty behind them. Leaders know they need to act, but they're not always sure where to start, which risks to tackle first, or whether their investments are actually making a difference. In fact, 69% of business leaders say measuring the success of cybersecurity investments is challenging. Many also struggle to integrate security with legacy systems and to manage AI-enabled attacks. ### Rethinking How We Talk About Cybersecurity We need to change the conversation. The goal can't be to eliminate every risk—no organization can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when something goes wrong. What's encouraging is that many organizations are already shifting their approach. One in three European business leaders say that as they increase their use of technology, they're broadening their cybersecurity priorities. That includes real-time monitoring, incident response, supplier risk management, and compliance with evolving AI regulations. These aren't just technical decisions—they're decisions about protecting a business's ability to operate, innovate, and keep customer trust. > "Cybersecurity is no longer just about technology. It's about leadership, accountability, and a culture where security is part of every decision." ### The Power of Collaboration No business operates in isolation anymore. Suppliers, tech providers, payment partners—they all play a role in keeping businesses and customers safe. A weakness in one part of the network can have ripple effects across the rest. That's why third-party risk management is becoming a top priority for leaders. Many European leaders also recognize they don't have all the answers in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner, and respond with greater confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We keep investing in technologies and partnerships that help organizations understand cyber risk and respond to emerging threats. ### Technology Alone Isn't Enough Technology matters, but it's not a silver bullet. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making. Boards should be asking not just whether their organizations are protected, but how risk is measured, how quickly the business could recover, and what a serious incident would mean for customer trust. Cybersecurity is no longer just an IT issue—it's a business imperative. And the sooner leaders treat it that way, the better prepared they'll be for whatever comes next.