Why 93% of European Firms Face Cyber Threats—and What Leaders Must Do

Jan de Vries · 2026-10-13

When I talk to a retailer in Italy, a fintech founder in London, or a bank in Germany, I keep hearing the same question in different accents: How do we innovate faster without putting our customers and our business at greater risk? That worry makes sense. Across Europe, companies are pouring money into new tech, adopting AI, and finding fresh ways to serve customers. But they're also dealing with shifting regulations, rising expectations, and threats that get smarter by the day. The ambition is there. The confidence? Not so much. ### Cybersecurity Is No Longer an IT Problem For years, cybersecurity was tucked away in the server room. That view is outdated. A single breach can freeze operations, wreck customer relationships, and erase trust you've spent decades building. Today, cybersecurity is a boardroom topic. And the numbers back it up. Mastercard research found that 93% of European organizations experienced fraud or attempted cyberattacks in the past year. A third of them (32%) say those attempts are happening more often. But those stats only scratch the surface. What really sticks with me is the uncertainty underneath. Leaders know they need to act, but they're not sure where to start, which risks matter most, or whether their investments are actually working. Seven in ten (69%) say measuring the success of cybersecurity spending is tough. Many also struggle to integrate security with legacy systems and to handle AI-powered attacks. ### Rethinking the Goal: Confidence, Not Perfection We need to change how we talk about cybersecurity. The goal can't be to eliminate every risk—no organization can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when things go wrong. Encouragingly, many are already shifting. One in three European business leaders say that as they use more technology, they're broadening their cybersecurity priorities. That includes real-time monitoring, incident response, supplier risk management, and compliance with new AI rules. These aren't just technical choices—they're decisions about protecting your ability to operate, innovate, and keep customer trust. ### No Business Is an Island These decisions can't be made alone. Suppliers, tech providers, payment partners—they all play a role in keeping your business and customers safe. A weak link anywhere in the network can cause problems everywhere. That's why third-party risk management is now a top priority for leaders. Many European leaders also admit they don't have all the answers in-house. The best partners help you make sense of a changing landscape, spot emerging risks sooner, and respond with confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We keep investing in technologies and partnerships that help organizations understand cyber risk and respond to emerging threats. > "Technology matters, but technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making."—Michele Centemero Boards should ask not only whether their organizations are protected, but how risk is measured, how quickly the business could recover, and what a serious incident would mean for customer trust. Cybersecurity isn't just an IT issue anymore. It's a business imperative. And the first step is building confidence—one informed decision at a time.