Why Cybersecurity Is No Longer Optional for European Startups

Jan de Vries · 2026-10-13

Whether I'm talking to a retailer in Italy, a fintech founder in London, or a bank in Germany, I keep hearing the same question in different accents: How do we innovate faster without putting our business and customers at greater risk? It's a fair worry. Across Europe, companies are pouring money into new tech, embracing AI, and finding fresh ways to serve customers. But they're also dealing with changing regulations, rising expectations, and threats that get more sophisticated by the day. The ambition is there. The confidence? Not so much. For years, cybersecurity was seen as the IT department's problem. That view is outdated. A single cyber incident can stop operations cold, wreck customer relationships, and erase trust built over decades. Today, cybersecurity is a boardroom topic, not just a server-room one. In fact, recent Mastercard research found that 93% of European organizations have experienced fraud or attempted cyberattacks in the past year. And nearly a third (32%) say those attempts are becoming more frequent. ### The Real Challenge: Uncertainty, Not Just Attacks But the numbers only tell part of the story. What sticks with me is the uncertainty behind them. Leaders know they need to act, but they're not always sure where to start, which risks demand immediate attention, or whether their investments are actually making a difference. Seven in ten (69%) business leaders say measuring the success of cybersecurity investments is challenging. Similar numbers struggle with integrating security measures into legacy systems and managing AI-enabled attacks. That's why we need to rethink how we talk about cybersecurity. The goal can't be to eliminate every risk—no organization can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption, and knowing how to respond when something goes wrong. ### A Shift in Mindset What's encouraging is that many organizations are already changing their approach. One in three European business leaders say that as they increase their use of technology, they're broadening their cybersecurity priorities. These include real-time monitoring and incident response, supplier risk management, and compliance with evolving AI regulation. These aren't just technical decisions—they're decisions about protecting a business's ability to operate, innovate, and keep customer trust. And these decisions can't be made in isolation. No business operates alone anymore. Suppliers, tech providers, payment partners, and service providers all play a role in keeping businesses and customers safe. A weakness in one part of the network can have ripple effects across the rest. That's why third-party risk management is becoming a top priority for business leaders. Many European leaders also recognize they don't have all the answers in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner, and respond with greater confidence. At Mastercard, we've learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. We continue to invest in technologies and partnerships that help organizations understand cyber risk and respond to emerging threats. > "Technology matters, but technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture where security is part of everyday decision-making." Boards should be asking not only whether their organizations are protected, but how risk is measured, how quickly the business could recover, and what a serious incident would mean for customer trust. Cybersecurity isn't just an IT issue—it's a business imperative. And the time to act is now.