Building Confidence in a Digital Economy: Why Cybersecurity Is Now a Business Imperative

By Michele Centemero

Whether I’m speaking to a retailer in Italy, a fintech founder in London or a bank in Germany, I often hear different versions of the same question: How can we continue to innovate and move faster without exposing our organisations and customers to greater risk?

It is an understandable concern. Across Europe, businesses are investing in new technologies, embracing AI and finding new ways to serve customers, while navigating changing regulation, rising expectations and more sophisticated threats. The ambition is there. What is harder to find is the confidence to act.

For a long time, cybersecurity was seen primarily as the responsibility of the IT department. That view no longer reflects reality. A cyber incident can bring operations to a halt, disrupt customer relationships and damage trust built over many years. Today, cybersecurity is discussed not only in server rooms, but increasingly in boardrooms. Recent Mastercard research found that 93% of European organisations have experienced fraud or attempted cyberattacks within the past year, with a third (32%) saying that such attempts are becoming more frequent.

But these figures tell only part of the story. What stays with me is the uncertainty behind them. Leaders know they need to act, but it is not always clear where to begin, which risks demand immediate attention or whether their investments are making a meaningful difference. Seven in ten (69%) business leaders say measuring the success of cybersecurity investments is challenging. Similar numbers report difficulties integrating security measures with legacy systems and managing AI-enabled attacks.

This is why we need to rethink the way we talk about cybersecurity. The goal cannot be to eliminate every risk. No organisation can promise that. Instead, businesses need the confidence that comes from understanding their exposure, preparing for disruption and knowing how to respond when something goes wrong.

What I find encouraging is that many organisations are already changing the way they approach cybersecurity. One in three European business leaders say that, as their organisations increase their use of technology, they are broadening their cybersecurity priorities. These include real-time monitoring and incident response, supplier risk management and compliance with evolving AI regulation. These are not simply technical decisions: they are decisions about how a business protects its ability to operate, innovate and retain the confidence of its customers.

These are also decisions that cannot be made in isolation. No business operates alone anymore. Suppliers, technology providers, payment partners and service providers all play a role in keeping businesses and their customers safe. A weakness in one part of that network can have consequences across the rest of it. That is why third-party risk management is becoming such an important priority for business leaders.

Many European leaders also recognise that they do not have every answer in-house. The best partners help businesses make sense of a changing landscape, spot emerging risks sooner and respond with greater confidence.

At Mastercard, we have learned that resilience grows through collaboration. Our European Cyber Resilience Centre brings businesses together with governments, regulators and law enforcement to share intelligence and strengthen collective defences. We continue to invest in technologies and partnerships that help organisations understand cyber risk and respond to emerging threats.

Technology matters, but technology alone will never be enough. Resilience also depends on leadership, clear accountability and a culture in which security is part of everyday decision-making. Boards should be asking not only whether their organisations are protected, but how risk is measured, how quickly the business could recover and what a serious incident would mean for customer trust.

Cybersecurity Awareness Month offers a good opportunity to ask those questions. It is also a reminder that cybersecurity should not be viewed only as protection from something bad. Done well, it enables something positive.

So when business leaders ask me how they can continue to innovate and move faster without exposing their organisations to greater risk, my answer is simple: treat cybersecurity as a business priority, not a technology function. It gives businesses the confidence to innovate. It gives customers the confidence to participate in the digital economy. And it gives leaders the confidence to move forward, even when the path ahead is complex.