The cyber leadership gap: Are we discussing compliance or risk?

Article | 2026-9-14

10 minute read

Executive Summary

Cyber security has entered a new phase. While threats continue to evolve, the biggest challenge for many organizations is no longer technology. It is how leaders understand, govern, and make decisions about cyber risk.

As AI accelerates transformation and digital ecosystems become more complex, cyber resilience has become a business capability rather than a technical function. Compliance remains important, but it is only a baseline. The organizations making the greatest progress focus on the risks they carry, the disruption they can tolerate, and how quickly they can recover.

The key question for leaders is no longer whether cyber security matters. It is whether the organization can make deliberate decisions about risk and maintain trust, continuity, and confidence when disruption occurs.

So why are many organizations still discussing cyber security primarily through the lens of compliance rather than risk? In this article, we explore what separates resilient organizations from the rest and what leaders can do differently.

Speak with our cyber security experts

Cyber resilience is a leadership challenge, not just a security challenge

For many years, cyber security was largely viewed as a technology responsibility. Security teams managed controls, mitigated threats, and responded to incidents, while executive leaders focused on growth, operational performance, and customer outcomes. That separation no longer reflects reality.

Today, almost every business process depends on digital systems, connected ecosystems, and data. A cyber incident can disrupt operations, damage customer trust, delay innovation, trigger regulatory scrutiny, and affect financial performance. Cloud adoption, digital supply chains, remote work, AI-powered services, and growing regulatory expectations have also distributed risk across the enterprise rather than concentrating it within technology teams.

In a recent interview with CyberDaily Australia, we discussed how this shift requires a different approach. Cyber resilience is not simply the ability to prevent attacks. It is the ability to anticipate, withstand, respond to, and recover from disruption while maintaining business continuity and stakeholder confidence. *1

One pattern we see consistently across organizations is that cyber conversations often begin and end with compliance. Compliance establishes a baseline, but it does not tell leaders what risks the business is carrying. The more useful questions are: What risks are we carrying? What are we prepared to accept? What do we need to protect most?

Explore our cyber security practice

Why the boardroom and the security team often see different risks

A common challenge is the disconnect between executive leadership and cyber specialists. Security teams often discuss vulnerabilities and controls, while business leaders focus on operational, financial, and strategic impact. This gap can make cyber investments difficult to prioritize and measure.

A recent Fujitsu global survey of 400 executives suggests that organizations with stronger cyber resilience are more likely to discuss cyber risk in business terms.*2

Leaders can make better decisions when cyber is connected to outcomes such as revenue protection, operational continuity, customer trust, and regulatory compliance.

Bar chart showing that cyber resilience leaders outperform laggards across four measures: learning from cyber incidents, leadership promotion of cyber awareness, collaboration with external partners, and board-level oversight of cyber risk. The largest gap is in learning from cyber incidents, where leaders score 93% compared with 35% for laggards.

Figure 1: Cyber resilience is a day-to-day priority for leading organizations

Loading component...

A recurring problem is that cyber is still treated as something IT owns. Yet when a critical system fails, customer data is compromised, or a service goes offline, the consequences are business issues. Business leaders therefore need to understand the risks embedded in the systems and services their operations depend on.

Another tendency is to seek certainty where none exists. Every organization carries cyber risk. The goal is not to eliminate risk entirely, but to understand it and make deliberate decisions about where investment and attention should be focused.

Healthcare provides a useful example. Security requirements that appear straightforward on paper often need to be balanced against the need to keep critical services operating. In an Emergency Department, clinicians may rely on shared workstations to access patient records, pathology results and medication information. Multi-factor authentication and automatic session locking can strengthen security, but during a resuscitation or major trauma response they may also delay access to time-critical information.

The challenge is not choosing between cyber security and patient care. It is making explicit decisions about which risks are acceptable, what safeguards are required, and who is empowered to make those trade-offs. The answer is rarely to remove a control altogether. Instead, organizations must determine how security, safety and operational continuity can be balanced within the realities of the operational environment.

This illustrates the difference between compliance and risk-based resilience. Compliance asks whether the required control has been implemented. Risk-based leadership asks whether it achieves its intended outcome in context, whether it creates new risks, and whether the overall balance remains acceptable.

Similar trade-offs exist across industries, wherever security controls must be balanced against safety, operational continuity or customer service outcomes.

Loading component...

AI is changing the speed and scale of cyber risk

Like everything right now, the rapid adoption of Artificial Intelligence (AI) has expanded the cyber discussion beyond traditional security concerns. Many organizations initially viewed AI primarily as a productivity and innovation opportunity. While those opportunities remain significant, AI also introduces new governance, sovereignty, security, and accountability challenges.

AI systems depend on large volumes of data spanning multiple systems, suppliers, and jurisdictions. Questions around ownership, privacy, explainability, and accountability are becoming business concerns rather than purely technical ones.

AI also changes the speed and scale of the cyber challenge. Offensive capabilities can evolve faster than organizations can implement new defenses, making resilience even more important. Leaders therefore need to consider not only prevention, but how effectively the organization can detect, respond, recover, and limit business impact.

Regulation continues to evolve, but innovation is moving faster. Organizations cannot afford to wait for every requirement to be defined before acting.

For example, a health service may approve a generative AI tool because it meets procurement and security requirements, yet still face significant risk if clinicians use it to summarize patient information or support clinical decisions without clear validation, disclosure, or accountability.

Meeting acquisition requirements does not make every use case acceptable. Leaders must establish clear governance mechanisms today, including:

Loading component...

Clarifying ownership for AI decisions and outcomes
Establishing data governance standards
Managing model risk and transparency
Monitoring third-party AI providers
Integrating AI oversight into existing risk frameworks

Cyber security, data governance, and AI governance can no longer be managed separately. Governance should help leaders understand business impact, risk exposure, and response options, not simply satisfy compliance requirements.

Data discipline remains the foundation of cyber resilience

Despite rapid advances in technology, one of the most persistent drivers of cyber risk remains surprisingly fundamental: poor data management.

Across industries, organizations continue to accumulate information without clear ownership, retention strategies, or governance controls. Data is often duplicated, retained beyond its business value, and poorly governed, increasing complexity, regulatory exposure, and risk. In discussions with organizations across industries, I often see leaders focus on how much data they possess rather than why they hold it. As AI adoption accelerates, data without a clear purpose, owner, or retention strategy creates governance challenges and additional risk exposure.

For leadership teams, several questions are becoming increasingly critical:

Loading component...

Why are we collecting this data?
What value does it create?
Who owns it?
How long should we retain it?
What business risk does it introduce?

The organizations making the greatest progress are not necessarily those with the most sophisticated security tools. They are the ones that treat data as a governed business asset throughout its lifecycle. Stronger data discipline reduces risk, improves transparency, and supports both resilience and AI governance.

It also underpins recovery. An organization cannot confidently restore critical services if it does not know which information is authoritative, where copies reside, which dependencies are essential, or what data can safely be deleted. Strong data governance is therefore not only a risk management capability, but a resilience capability.

Loading component...

Building a culture of cyber accountability

While technology controls remain essential, culture increasingly determines how effectively organizations manage cyber risk. Many incidents arise through ordinary business activities such as vendor interactions, data sharing, process gaps, configuration errors, or governance failures, often outside dedicated security teams.

As a result, cyber resilience depends on collective responsibility.

Resilient organizations establish clear decision rights and ownership for critical data and systems, and embed cyber risk into procurement, operational planning, risk management, and executive governance.

Supply chains are a particularly important area of focus. Organizations often have less visibility into supplier risk than they believe. Many assess direct suppliers, but have far less understanding of dependencies beyond that first layer, including offshore providers, subcontractors, technology vendors, and service partners supporting critical operations.

These hidden dependencies can introduce significant resilience, security, and sovereignty risks that may not be evident until disruption occurs.

Leaders should therefore extend their oversight beyond immediate suppliers and ensure third-party relationships include clear expectations for risk management, monitoring, reporting, and incident response.

Managing these risks requires business owners, security leaders, and executives to work together across the wider business ecosystem. Cyber accountability cannot stop at the security function or the organization’s own boundaries.

Loading component...

What leaders should do next

Organizations do not need to wait for a major regulatory event or significant cyber incident to strengthen resilience. The most effective actions are often practical and foundational.

1. Shift the conversation from compliance to risk

Use compliance as an important baseline, but focus leadership discussions on the risks the organization is carrying, what it is prepared to accept, and where risk needs to be reduced.

2. Connect cyber risk to business impact

Move beyond technical metrics. Ask what happens to operations, customers, revenue, critical services, and trust if a system or dependency fails. This helps leaders prioritize investment around what matters most.

3. Plan for recovery, not perfect prevention

Zero cyber risk is not realistic. Organizations need to understand what they must keep running, how quickly they can identify disruption, and how effectively they can restore critical systems and data.

4. Make cyber a shared business responsibility

Cyber risk now cuts across technology, business functions, data, AI, suppliers, and operations. Stronger resilience comes from bringing those perspectives together and making informed risk decisions across the enterprise.

Conclusion

As AI adoption accelerates and digital ecosystems become more interconnected, organizations need to move beyond compliance-focused thinking and the expectation that every risk can be eliminated.

Our Wayfinders perspective is that cyber resilience is ultimately a leadership challenge. The organizations that succeed will not necessarily be those with the most advanced security tools. They will be the ones that understand their risks, make deliberate decisions about how to manage them, and build the resilience to maintain trust when disruption occurs.

Loading component...

Footnotes & References

Loading component...

Laura O’Neill
Partner, Uvance Wayfinders, Oceania

Laura O’Neill is a cyber security leader who helps organisations strengthen resilience, uplift security maturity and align cyber initiatives with business strategy. With experience spanning start-ups, consulting and executive leadership, she advises boards on cyber risk, governance, AI security and secure digital transformation.

Loading component...

Uvance Wayfinders
Consulting by Fujitsu

Uvance Wayfinders combines AI-native consulting, deep industry expertise, and Fujitsu's technology capabilities to help organisations turn strategy into measurable business outcomes.

A blue illuminated arched bridge extends under the twilight sky.

Explore Wayfinders' approach

Loading component...

Related Information

Cyber security

Uvance Wayfinders identifies risks from an attacker’s perspective and optimizes detection, defense, and response to deliver effective cybersecurity.

The cyber resilience divide

As cyber threats intensify, resilience gaps put business continuity at risk. Discover how leading organizations protect value by balancing risk and resilience.

Aerial view of a complex highway interchange at night.

Redesigning security through white-hat hacking

Insights from a white-hat hacker on AI-driven cyber threats, revealing how security redesign and stronger cyber resilience empower sustainable business growth.

Padlock with keyhole on digital circuit board.

Loading component...

Conversation bubble icon. One of the bubbles contains a heart.

Loading component...

Consulting inquiries

Loading component...

page top