Cybersecurity is no longer an IT problem

David Zey Gerry Pitt

September 7, 2026

It’s 8 a.m. on a Monday. 

Employees can’t log in.

Customer orders stop flowing.

Accounting can’t access invoices.

Phones start ringing with confused customers on the line, and somewhere in a back office, the IT team is scrambling through server logs while leadership stands in the doorway asking: “What happened?”

For most business owners, the instinctive answer is that IT failed.

A firewall didn’t hold, a system wasn’t patched, someone in tech support missed something.

IT is outclassed in resources against the hackers.

But in the vast majority of cyber incidents, the truth is less comfortable and more important: the organization experienced a leadership failure, not just a technical one.

Technology alone rarely causes a successful cyberattack.

Attackers exploit gaps that leadership created or allowed to persist – employees who were never trained to spot a phishing email, a password policy nobody enforced, a vendor relationship nobody vetted, a response plan that existed only in theory.

Poor decisions, weak processes and inadequate planning open the gate in your fortifications, and the malware just walks through it.

That’s the real shift.

Cybersecurity isn’t just about protecting computers anymore.

It’s about protecting the business itself, the revenue, the reputation and the customer relationships.

The biggest misconception

Ask many small- and mid-sized business owners about their cybersecurity posture, and you’ll hear some version of the same answer: “We hired an IT company – they’re handling it.”

That belief is dangerous.

IT providers and managed service partners play a critical role.

They can install firewalls, patch systems and monitor networks for suspicious activity.

Think of it like a castle: you can have the walls, the moats and the watchtowers in place, but how the king’s court rules often determines whether it gets breached.

IT builds the walls, but they can’t make the decisions that only leadership can make, such as:

• How much risk is the company willing to accept?
• How much should be invested in prevention versus other priorities?
• What policies will employees actually be held to?
• How prepared will the company be when an incident happens? Not if, but when.

These are not technical questions.

They are business questions, and they belong on leadership’s desk.

Cybersecurity is a business strategy, not a technology strategy.

Treating it as an outsourced IT function is like assuming a locksmith is responsible for your company’s entire approach to physical security.

A locksmith installs good locks.

Whether employees prop the back door open is a matter of culture and leadership.

It’s an easy mistake to make.

Cybersecurity sounds technical, full of acronyms and specialized vendors, so it’s natural to file it next to network maintenance or hardware purchases.

But no IT provider is in the room when leadership decides to skip a security review to hit a launch deadline, or when a manager lets a contractor use a personal laptop to save time.

Those decisions happen inside the business, not in the server closet.

That’s where most breaches actually start.

Five leadership responsibilities

1. Build a culture of security

No firewall can stop an employee from clicking a convincing phishing link, reusing a weak password, sharing confidential information over an unsecured channel or plugging a personal device into the company network.

Technology can reduce these risks, but it cannot eliminate human behavior as a factor.

Leaders set the tone.

That means talking about security regularly, not just showing an annual training video.

It means encouraging employees to report suspicious emails or mistakes without fear of getting in trouble.

Punish someone for reporting a mistake, and the next mistake won’t get reported at all.

Culture protects your company when technology isn’t enough.

Your people’s presence and engagement outperform monitoring software all day long.

2. Invest in the fundamentals

It’s tempting to chase the newest cybersecurity product with the flashiest sales pitch.

But most breaches happen because a company skipped the basics: multi-factor authentication, regular backups, software updates, password managers and employee training.

These unglamorous controls stop most attacks before they start.

The thing about unglamorous controls is that they require unglamorous discipline.

Whether those basics actually get done isn’t a technical question.

It’s a leadership decision about priorities and budget.

A five-figure security platform doesn’t help much if half the staff reuses the same password everywhere, or if backups have never been tested to see if they actually restore.

The fundamentals aren’t exciting, but they stop the most attacks for the least money.

3. Make cybersecurity part of every business decision

Every new initiative adds risk.

New software, remote work, a new vendor, an AI tool, a new online service: each one expands what an attacker could target.

Before any major decision, leaders should ask one simple question: What cybersecurity risk comes with this?

And there should be someone in the room who can answer that question, or leaders are operating on partial information.

The goal isn’t to slow down growth or say “no” to new ideas.

It’s to move forward with eyes open and see what needs to be seen.

4. Prepare before something happens

Most companies practice fire drills.

Most carry insurance.

Many have a disaster recovery plan for a flood or a power outage.

Far fewer have ever rehearsed what happens during a ransomware attack, a data breach or an extended systems outage.

Ask yourself – if your systems were unavailable tomorrow morning:

• Who would do what?
• Who calls the insurance carrier?
• Who drafts the customer notification?
• Who has the authority to take systems offline?
• Who talks to employees waiting for direction?
• Who talks to the press?
• Who decides whether to pay a ransom, and who has the authority to make that call?

If the answer isn’t clear, that’s the plan to build first.

Preparation doesn’t prevent every incident, but it replaces panic with process, and that difference shows up in lost days, lost customers and lost revenue.

5. Lead by example

Employees watch what leadership does far more closely than what leadership says.

If executives skip multi-factor authentication because it’s inconvenient, share passwords for the sake of speed or find workarounds for security procedures, employees will conclude those rules are optional.

Security culture starts at the top, and it either strengthens or collapses based on what leaders model every day.

Cybersecurity as a competitive advantage

Most of this comes down to fear: the breach that could happen, the downtime that could cost thousands of dollars, the reputation hit that could take years to repair.

But there’s an upside, too.

Cybersecurity is also an opportunity.

Companies with strong security build more trust with customers, win contracts that competitors lose, see less downtime and recover faster when something does go wrong.

More customers now ask vendors about their cybersecurity practices before signing a contract. 

In a lot of industries, good security isn’t just defense anymore.

It’s part of good customer service, and it sets you apart.

Conclusion

Go back to that Monday morning.

The instinctive question is: “How do we stop hackers?”

That’s the wrong starting point.

The better questions belong to leadership:

• Are we building a security-minded culture?
• Are we investing in the fundamentals?
• Are we actually prepared for a disruption?
• Are we leading by example, or asking employees to follow rules we ignore ourselves?

Success isn’t measured by how many attacks a company prevents.

No one prevents them all.

It’s measured by how well the company is prepared when something unexpected happens.

In today’s business environment, cybersecurity isn’t an IT responsibility supported by leadership.

It is a leadership responsibility supported by IT.