Why Cybersecurity Is Now a Boardroom Priority, Not Just IT

Jan de Vries · 2026-10-13

By Michele Centemero Whether I'm talking to a retailer in Italy, a fintech founder in London, or a bank in Germany, I keep hearing the same question in different accents: How can we keep innovating and moving faster without putting our organizations and customers at greater risk? It's a fair concern. Across Europe, businesses are pouring money into new tech, embracing AI, and finding fresh ways to serve customers. But they're also navigating shifting regulations, rising expectations, and threats that get more sophisticated by the day. The ambition is there. What's harder to find is the confidence to act. ### Cybersecurity Is No Longer an IT Issue For years, cybersecurity was tucked away in the IT department. That view is outdated. A single cyber incident can grind operations to a halt, wreck customer relationships, and erode trust built over decades. Today, cybersecurity is discussed not just in server rooms but in boardrooms. Recent Mastercard research found that 93% of European organizations have experienced fraud or attempted cyberattacks in the past year, and a third (32%) say those attempts are becoming more frequent. But those numbers only tell part of the story. What stays with me is the uncertainty behind them. Leaders know they need to act, but it's not always clear where to start, which risks demand immediate attention, or whether their investments are actually making a difference. Seven in ten (69%) business leaders say measuring the success of cybersecurity investments is challenging. Similar numbers report difficulties integrating security measures with legacy systems and managing AI-enabled attacks. ### Rethinking the Goal: Confidence, Not Perfection This is why we need to rethink how we talk about cybersecurity. The goal can't be to eliminate every risk—no organization can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when something goes wrong. What encourages me is that many organizations are already changing their approach. One in three European business leaders say that as they increase their use of technology, they're broadening their cybersecurity priorities. These include real-time monitoring and incident response, supplier risk management, and compliance with evolving AI regulation. These aren't just technical decisions—they're decisions about protecting a business's ability to operate, innovate, and retain customer trust. > "Cybersecurity is no longer just about defense; it's about enabling growth with confidence." ### Collaboration Is Key These decisions can't be made in isolation. No business operates alone anymore. Suppliers, technology providers, payment partners, and service providers all play a role in keeping businesses and their customers safe. A weakness in one part of that network can have consequences across the rest. That's why third-party risk management is becoming such a priority for business leaders. Many European leaders also recognize they don't have all the answers in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner, and respond with greater confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We continue to invest in technologies and partnerships that help organizations understand cyber risk and respond to emerging threats. ### Leadership and Culture Matter Technology matters, but technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making. Boards should be asking not only whether their organizations are protected, but how risk is measured, how quickly the business could recover, and what a serious incident would mean for customer trust. Cybersecurity is no longer a necessary evil—it's a business imperative. And the confidence to act comes from preparation, collaboration, and a culture that puts security first.