Why Cybersecurity Is No Longer Just an IT Problem

Jan de Vries · 2026-10-13

### The Question Every Leader Is Asking Whether I'm talking to a retailer in Italy, a fintech founder in London, or a bank executive in Germany, I keep hearing the same question in different accents: How do we keep moving fast without putting our business and customers at risk? It's a fair concern. Across Europe, companies are pouring money into new tech, jumping into AI, and rethinking how they serve customers. The ambition is there. What's missing is the confidence to act. ### Cybersecurity Has Moved to the Boardroom For years, cybersecurity lived in the IT department. That's over. A single breach can freeze operations, wreck customer relationships, and erase trust you spent decades building. It's no longer a server-room conversation. It's a boardroom one. Recent Mastercard research found that 93% of European organizations dealt with fraud or attempted cyberattacks in the past year. A third of them said those attempts are happening more often. But those numbers only tell part of the story. What sticks with me is the uncertainty underneath them. Leaders know they need to act, but they're not sure where to start, which risks matter most, or whether their spending is actually doing anything. Nearly 7 in 10 business leaders say measuring the success of cybersecurity investments is tough. Many also struggle to integrate new security tools with legacy systems and to keep up with AI-powered attacks. ### Rethinking What Success Looks Like We need to change how we talk about cybersecurity. The goal can't be to eliminate every risk—no one can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when things go wrong. What's encouraging is that many organizations are already shifting their approach. One in three European business leaders say that as they adopt more technology, they're broadening their cybersecurity priorities. That includes: - Real-time monitoring and incident response - Supplier risk management - Compliance with evolving AI regulation These aren't just technical decisions. They're decisions about protecting your ability to operate, innovate, and keep customer trust. ### No Business Operates Alone These decisions can't be made in isolation. Suppliers, tech providers, payment partners, and service providers all play a role in keeping you and your customers safe. A weakness in one part of that network can ripple across the rest. That's why third-party risk management is becoming a top priority for business leaders. Many European leaders also admit they don't have all the answers in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner, and respond with greater confidence. > "Resilience grows through collaboration." That's what we've learned at Mastercard. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. ### Technology Alone Isn't Enough Technology matters, but it will never be enough on its own. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making. Boards should be asking not just whether their organizations are protected, but how risk is measured, how quickly the business could recover, and what a serious incident would mean for customer trust. Cybersecurity isn't a box you check. It's a mindset you build. And the businesses that get it right won't just survive the next threat—they'll earn the confidence to keep innovating, no matter what comes next.