Why 93% of European Firms Now See Cybersecurity as a Boardroom Issue

Jan de Vries · 2026-10-13

Whether I'm talking to a retailer in Italy, a fintech founder in London, or a bank executive in Germany, I keep hearing the same question in different accents: how do we keep innovating and moving faster without putting our company and customers at greater risk? It's a fair worry. Businesses across Europe are pouring money into new tech, embracing AI, and finding fresh ways to serve customers. All while juggling changing regulations, rising expectations, and threats that get smarter every year. The ambition is there. What's harder to find is the confidence to actually act. ### Cybersecurity Moved Out of the Server Room For years, cybersecurity was treated like an IT problem. Lock it down, patch it up, move on. That view doesn't hold anymore. A single incident can stop operations cold, wreck customer relationships, and undo trust you spent years building. Today, the conversation happens in boardrooms, not just server rooms. Recent Mastercard research found that 93% of European organizations dealt with fraud or attempted cyberattacks in the past year. A third of them (32%) say those attempts are getting more frequent. But the numbers only tell part of the story. What sticks with me is the uncertainty underneath them. Leaders know they need to act, yet it's rarely clear where to start, which risks deserve attention first, or whether their spending is actually doing anything. About seven in ten (69%) business leaders say measuring the success of cybersecurity investments is tough. Similar numbers struggle to integrate security with legacy systems and to handle AI-enabled attacks. ### Confidence Beats Perfection This is why we need to rethink how we talk about cybersecurity. You can't eliminate every risk. No company can promise that. What you can build is the confidence that comes from knowing your exposure, preparing for disruption, and knowing exactly how to respond when something breaks. > "The goal isn't a perfect defense. It's the confidence to keep moving when things go wrong." Encouragingly, many organizations are already shifting. One in three European business leaders say that as their tech use grows, they're broadening their security priorities. That includes: - Real-time monitoring and incident response - Supplier risk management - Compliance with fast-evolving AI regulation These aren't just technical calls. They're decisions about protecting your ability to operate, innovate, and keep customer trust intact. ### No Business Stands Alone None of this happens in isolation. Suppliers, tech providers, payment partners, and service providers all play a role in keeping you and your customers safe. A weak link in one part of that network can ripple across the rest. That's why third-party risk management has become a top priority for leaders. Many European executives also admit they don't have every answer in-house. The best partners help you read a shifting landscape, spot emerging risks sooner, and respond with more confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We keep investing in tools and partnerships that help organizations understand cyber risk and respond to what's coming. ### Leadership Is the Real Firewall Technology matters. But technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making. Boards should ask not only whether the company is protected, but how risk gets measured, how fast the business could recover, and what a serious incident would mean for customer trust. That's the real shift. Cybersecurity isn't a cost center anymore. It's how you earn the confidence to grow.