Why Cybersecurity Is Now a Boardroom Priority

Jan de Vries · 2026-10-13

By Michele Centemero Whether I'm speaking to a retailer in Italy, a fintech founder in London, or a bank in Germany, I often hear different versions of the same question: How can we continue to innovate and move faster without exposing our organizations and customers to greater risk? It's an understandable concern. Across Europe, businesses are investing in new technologies, embracing AI, and finding new ways to serve customers, all while navigating changing regulation, rising expectations, and more sophisticated threats. The ambition is there. What's harder to find is the confidence to act. ### Cybersecurity Is No Longer Just an IT Issue For a long time, cybersecurity was seen primarily as the responsibility of the IT department. That view no longer reflects reality. A cyber incident can bring operations to a halt, disrupt customer relationships, and damage trust built over many years. Today, cybersecurity is discussed not only in server rooms but increasingly in boardrooms. Recent Mastercard research found that 93% of European organizations have experienced fraud or attempted cyberattacks within the past year, with a third (32%) saying that such attempts are becoming more frequent. But these figures tell only part of the story. What stays with me is the uncertainty behind them. Leaders know they need to act, but it's not always clear where to begin, which risks demand immediate attention, or whether their investments are making a meaningful difference. Seven in ten (69%) business leaders say measuring the success of cybersecurity investments is challenging. Similar numbers report difficulties integrating security measures with legacy systems and managing AI-enabled attacks. ### Rethinking Our Approach to Cybersecurity This is why we need to rethink the way we talk about cybersecurity. The goal cannot be to eliminate every risk. No organization can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when something goes wrong. What I find encouraging is that many organizations are already changing the way they approach cybersecurity. One in three European business leaders say that, as their organizations increase their use of technology, they are broadening their cybersecurity priorities. These include real-time monitoring and incident response, supplier risk management, and compliance with evolving AI regulation. These are not simply technical decisions: they are decisions about how a business protects its ability to operate, innovate, and retain the confidence of its customers. > "Cybersecurity is not just about technology; it's about trust. And trust is the foundation of every successful business relationship." – Michele Centemero ### Collaboration Is Key These are also decisions that cannot be made in isolation. No business operates alone anymore. Suppliers, technology providers, payment partners, and service providers all play a role in keeping businesses and their customers safe. A weakness in one part of that network can have consequences across the rest of it. That's why third-party risk management is becoming such an important priority for business leaders. Many European leaders also recognize that they don't have every answer in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner, and respond with greater confidence. At Mastercard, we have learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We continue to invest in technologies and partnerships that help organizations understand cyber risk and respond to emerging threats. ### Leadership and Culture Matter Technology matters, but technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture in which security is part of everyday decision-making. Boards should be asking not only whether their organizations are protected but how risk is measured, how quickly the business could recover, and what a serious incident would mean for customer trust. Cybersecurity is not just a technical challenge; it's a business imperative. By fostering a culture of security, embracing collaboration, and focusing on resilience, European businesses can innovate with confidence and protect what matters most.