The cyber leadership gap: Are we discussing compliance or risk?

A recurring problem is that cyber is still treated as something IT owns. Yet when a critical system fails, customer data is compromised, or a service goes offline, the consequences are business issues. Business leaders therefore need to understand the risks embedded in the systems and services their operations depend on.
 
Another tendency is to seek certainty where none exists. Every organization carries cyber risk. The goal is not to eliminate risk entirely, but to understand it and make deliberate decisions about where investment and attention should be focused.
 
Healthcare provides a useful example. Security requirements that appear straightforward on paper often need to be balanced against the need to keep critical services operating. In an Emergency Department, clinicians may rely on shared workstations to access patient records, pathology results and medication information. Multi-factor authentication and automatic session locking can strengthen security, but during a resuscitation or major trauma response they may also delay access to time-critical information.
 
The challenge is not choosing between cyber security and patient care. It is making explicit decisions about which risks are acceptable, what safeguards are required, and who is empowered to make those trade-offs. The answer is rarely to remove a control altogether. Instead, organizations must determine how security, safety and operational continuity can be balanced within the realities of the operational environment.
 
This illustrates the difference between compliance and risk-based resilience. Compliance asks whether the required control has been implemented. Risk-based leadership asks whether it achieves its intended outcome in context, whether it creates new risks, and whether the overall balance remains acceptable.
 
Similar trade-offs exist across industries, wherever security controls must be balanced against safety, operational continuity or customer service outcomes.

Cyber security, data governance, and AI governance can no longer be managed separately. Governance should help leaders understand business impact, risk exposure, and response options, not simply satisfy compliance requirements.

The organizations making the greatest progress are not necessarily those with the most sophisticated security tools. They are the ones that treat data as a governed business asset throughout its lifecycle. Stronger data discipline reduces risk, improves transparency, and supports both resilience and AI governance.

It also underpins recovery. An organization cannot confidently restore critical services if it does not know which information is authoritative, where copies reside, which dependencies are essential, or what data can safely be deleted. Strong data governance is therefore not only a risk management capability, but a resilience capability.

While technology controls remain essential, culture increasingly determines how effectively organizations manage cyber risk. Many incidents arise through ordinary business activities such as vendor interactions, data sharing, process gaps, configuration errors, or governance failures, often outside dedicated security teams.
 
As a result, cyber resilience depends on collective responsibility.
 
Resilient organizations establish clear decision rights and ownership for critical data and systems, and embed cyber risk into procurement, operational planning, risk management, and executive governance.
 
Supply chains are a particularly important area of focus. Organizations often have less visibility into supplier risk than they believe. Many assess direct suppliers, but have far less understanding of dependencies beyond that first layer, including offshore providers, subcontractors, technology vendors, and service partners supporting critical operations.
 
These hidden dependencies can introduce significant resilience, security, and sovereignty risks that may not be evident until disruption occurs.

Leaders should therefore extend their oversight beyond immediate suppliers and ensure third-party relationships include clear expectations for risk management, monitoring, reporting, and incident response.
 
Managing these risks requires business owners, security leaders, and executives to work together across the wider business ecosystem. Cyber accountability cannot stop at the security function or the organization’s own boundaries.