Why 93% of European Firms Face Cyber Attacks: The New Business Imperative

Jan de Vries · 2026-10-13

When I talk to a retailer in Italy, a fintech founder in London, or a bank executive in Germany, I keep hearing the same question in different accents: How do we innovate faster without putting our customers and our business at greater risk? It's a fair question. European companies are pouring money into new tech, embracing AI, and finding fresh ways to serve customers. But they're also juggling changing regulations, rising expectations, and threats that get more sophisticated by the day. The ambition is there. The confidence? Not so much. ### Cybersecurity Is No Longer an IT Problem For years, cybersecurity lived in the server room. That's outdated. A single breach can halt operations, wreck customer relationships, and erase trust built over decades. Now, the conversation has moved to the boardroom. And the numbers back it up. Recent Mastercard research found that 93% of European organizations experienced fraud or attempted cyberattacks in the past year. Nearly a third (32%) say those attempts are becoming more frequent. But the stats only tell part of the story. What really sticks with me is the uncertainty behind them. Leaders know they need to act, but they're not sure where to start, which risks matter most, or whether their investments are actually working. Seven in ten (69%) say measuring the success of cybersecurity spending is a challenge. Many also struggle to integrate security with legacy systems and to manage AI-enabled attacks. ### Rethinking the Goal: Confidence, Not Perfection We need to change how we talk about cybersecurity. The goal isn't to eliminate every risk—no organization can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when things go wrong. That shift is already happening. One in three European business leaders say they're broadening their cybersecurity priorities as they adopt more technology. They're focusing on real-time monitoring, incident response, supplier risk management, and compliance with new AI regulations. These aren't just technical decisions—they're about protecting the business's ability to operate, innovate, and keep customer trust. ### No Business Is an Island These decisions can't be made alone. Suppliers, tech providers, payment partners—they're all part of the safety net. A weakness in one link can ripple across the whole chain. That's why third-party risk management is now a top priority for leaders. Many European executives also admit they don't have all the answers in-house. The best partners help them navigate the changing landscape, spot emerging risks sooner, and respond with confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We keep investing in technologies and partnerships that help organizations understand cyber risk and respond to emerging threats. ### Leadership and Culture Matter More Than Tech Technology matters, but it's never enough on its own. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making. Boards should ask not only whether they're protected, but how risk is measured, how quickly they could recover, and what a serious incident would mean for customer trust. > "Cybersecurity is no longer just about defense—it's about confidence. And confidence comes from preparation, collaboration, and a culture that puts security first." So, how can you build that confidence? Start by understanding your exposure. Invest in the right partnerships. And make security a boardroom priority, not just an IT one. The threats aren't going away—but with the right approach, neither is your ability to innovate.