The Real Reason European Businesses Are Rethinking Cybersecurity

Jan de Vries · 2026-10-13

By Michele Centemero Whether I'm talking to a retailer in Italy, a fintech founder in London, or a bank in Germany, I keep hearing the same question in different accents: how do we innovate faster without putting our people and customers at risk? It's a fair concern. Across Europe, businesses are pouring money into new technology, embracing AI, and finding fresh ways to serve customers. The ambition is clearly there. What's harder to find is the confidence to actually act. ### Cybersecurity Moved Out of the Server Room For years, security was treated as the IT department's problem. That view doesn't hold up anymore. A single incident can stop operations cold, wreck customer relationships, and undo trust that took years to build. So the conversation has shifted. It's happening in boardrooms now, not just server rooms. Recent Mastercard research found that 93% of European organizations dealt with fraud or attempted cyberattacks in the past year. A third of them said those attempts are coming more often. But the numbers only tell part of the story. What sticks with me is the uncertainty sitting behind them. ### Leaders Know They Need to Act. They Just Aren't Sure How. Most executives understand the threat is real. What they struggle with is the "where do we start" question. Which risks need attention right now? Are our investments even doing anything? Seven in ten business leaders say measuring the success of cybersecurity spending is genuinely hard. Similar numbers report trouble integrating new security measures with legacy systems, and keeping up with AI-enabled attacks. That's why we need to change how we talk about this. The goal can't be eliminating every risk. No organization can promise that. What businesses actually need is confidence, the kind that comes from knowing your exposure, preparing for disruption, and knowing how to respond when something goes wrong. > "Resilience isn't about building a wall high enough to stop every threat. It's about knowing exactly what you'll do when one gets through." ### A Shift Is Already Underway Here's what I find encouraging. One in three European business leaders say that as their technology use grows, they're widening their security priorities. That includes: - Real-time monitoring and incident response - Supplier risk management - Compliance with evolving AI regulation These aren't just technical calls. They're decisions about protecting a business's ability to operate, innovate, and keep customer trust intact. And they can't be made alone. No business operates in a vacuum. Suppliers, tech providers, payment partners, service providers, they all play a part in keeping customers safe. One weak link can ripple across the whole network. That's exactly why third-party risk management has become such a priority. Many leaders also admit they don't have all the answers in-house. The right partners help businesses make sense of a shifting landscape, spot risks sooner, and respond with more confidence. ### Resilience Grows Through Collaboration At Mastercard, we've learned that resilience comes from working together. Our European Cyber Resilience Centre brings businesses together with governments, regulators, and law enforcement to share intelligence and strengthen collective defenses. But technology alone will never be enough. Resilience also depends on leadership, clear accountability, and a culture where security shapes everyday decisions. Boards should be asking harder questions: How is risk measured? How fast could we recover? And what would a serious incident mean for customer trust? Those are the questions that separate confident businesses from anxious ones.