Why Cybersecurity Is Now Every Business Leader's Job

Jan de Vries · 2026-10-13

For years, cybersecurity lived in the IT department. A server room problem. Something the tech team handled while everyone else got on with the real work of running the business. That view doesn't hold up anymore. A single breach can stop operations cold, break customer relationships, and undo trust that took years to build. So the conversation has moved. It's no longer just in server rooms. It's in boardrooms. ### The Numbers Behind the Worry Mastercard research found that 93% of European organizations dealt with fraud or attempted cyberattacks in the past year. About a third (32%) said those attempts are getting more frequent. But the raw figures only tell part of the story. What really sticks is the uncertainty underneath them. Leaders know they need to act. They just aren't always sure where to start, which risks matter most right now, or whether their spending is actually doing anything. Consider this: - 69% of business leaders say measuring the success of cybersecurity investments is hard - A similar share struggle to integrate security with legacy systems - Many also report difficulty managing AI-enabled attacks That's a lot of people spending money without a clear sense of whether it's working. ### Rethinking What Success Looks Like The goal can't be to eliminate every risk. No organization can promise that, and pretending otherwise sets everyone up to fail. What businesses actually need is confidence. The kind that comes from understanding your exposure, preparing for disruption, and knowing exactly how to respond when something goes wrong. > "Businesses need the confidence that comes from understanding their exposure, preparing for disruption and knowing how to respond when something goes wrong." That's a more honest target. And a more useful one. ### What Forward-Thinking Companies Are Doing One in three European business leaders say that as they lean harder on technology, they're widening their cybersecurity priorities. That means real-time monitoring, incident response, supplier risk management, and keeping up with evolving AI regulation. These aren't just technical calls. They're decisions about protecting a business's ability to operate, innovate, and keep customers on board. And here's the thing: none of this happens in isolation. Suppliers, tech providers, payment partners, service providers — they all play a role in keeping customers safe. A weak link in one spot can ripple across the whole network. That's why third-party risk management has climbed so high on the priority list. ### Resilience Is a Team Sport Many leaders admit they don't have all the answers in-house. Good partners help make sense of a shifting landscape, spot emerging risks sooner, and respond with more confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. Technology matters. But technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making. So boards should be asking harder questions. Not just whether the organization is protected, but how risk is measured, how fast the business could recover, and what a serious incident would mean for customer trust. That's where real confidence starts.