Why Cybersecurity Is Now Every Board's Problem, Not Just IT's

Jan de Vries · 2026-10-13

Whether I'm talking to a retailer in Italy, a fintech founder in London, or a bank in Germany, I keep hearing the same question in different accents: How do we keep moving fast and innovating without putting our people and customers at greater risk? It's a fair worry. Businesses across Europe are pouring money into new tech, leaning into AI, and finding fresh ways to serve customers. All while juggling shifting regulation, rising expectations, and threats that get more clever by the day. The ambition is clearly there. What's harder to find is the confidence to actually act. ### Cybersecurity Moved Out of the Server Room For years, security was treated as the IT department's job. Hand it over, let them deal with it, get back to business. That view doesn't hold up anymore. A single incident can stop operations cold, wreck customer relationships, and undo trust that took years to build. These days, the conversation happens in the boardroom, not just the server room. Recent Mastercard research found that 93% of European organizations dealt with fraud or attempted cyberattacks in the past year. A third of them (32%) say those attempts are only getting more frequent. But the numbers only tell part of the story. What stays with me is the uncertainty sitting behind them. Leaders know they need to do something. They just aren't always sure where to start, which risks deserve attention first, or whether their spending is actually moving the needle. About seven in ten (69%) say measuring the success of security investments is tough. Similar numbers struggle with integrating security into legacy systems and handling AI-enabled attacks. ### Rethinking How We Talk About Risk Here's the thing. The goal can't be to eliminate every risk. No organization can promise that. What businesses need instead is confidence. The kind that comes from understanding your exposure, preparing for disruption, and knowing exactly what to do when something goes wrong. What encourages me is that many organizations are already shifting. One in three European business leaders say that as they use more technology, they're widening their security priorities. That includes: - Real-time monitoring and incident response - Managing supplier and third-party risk - Keeping up with evolving AI regulation These aren't just technical choices. They're decisions about protecting a business's ability to operate, innovate, and keep customer trust intact. > Resilience isn't about avoiding every storm. It's about knowing your ship can handle one. ### No Business Operates Alone None of this happens in isolation. Suppliers, tech providers, payment partners, service providers, they all play a part in keeping customers safe. A weak link in one spot can ripple across the whole network. That's exactly why third-party risk management has become such a priority for leaders. Many European leaders also admit they don't have all the answers in-house. And that's okay. The best partners help you make sense of a changing landscape, spot emerging risks sooner, and respond with more confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. ### Leadership Matters More Than Tools Technology matters, no question. But technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decisions. Boards should be asking not just whether they're protected, but how risk is measured, how fast the business could recover, and what a serious incident would mean for customer trust. That's the real shift. Cybersecurity isn't a box you tick. It's a business imperative, and the companies that get that are the ones that will keep moving forward with confidence.