Cybersecurity Awareness Month: What Business Leaders Get Wrong About Cyber Risk

Each October, Cybersecurity Awareness Month fills inboxes with reminders to use strong passwords and think before clicking. These messages are useful, and they are aimed almost entirely at employees. The costlier mistakes happen elsewhere: in budget meetings, in board agendas and in the assumptions leaders carry about who is responsible and what is at stake. As the campaigns fade, this article offers a different kind of awareness. It examines six things business leaders commonly get wrong about cyber risk, and what to do instead.

Myth 1: "Cybersecurity Is an IT Problem"

When a serious incident occurs, the consequences land on the whole organisation: operations stop, customers lose trust, regulators ask questions and executives face scrutiny. Treating security as a technical specialism delegated to one department leaves the people with authority over budgets, priorities and risk appetite out of the conversation.

The US National Institute of Standards and Technology made this point structurally when it released version 2.0 of its Cybersecurity Framework in 2024. The framework now has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The new function, Govern, places leadership decisions and accountability at the centre. Cyber risk is a business risk, and it belongs in the same conversations as financial and operational risk.

Myth 2: "We Are Too Small to Be a Target"

Many attacks are opportunistic and automated. They look for weaknesses, not for famous names, so a smaller organisation may be just as exposed as a large one while having fewer defences. Smaller firms also sit in supply chains. Attackers sometimes target them precisely because they offer a route into larger partners.

The practical lesson is to assess your exposure honestly rather than your prominence. What data do you hold? What would an outage cost per day? Who depends on you?

Myth 3: "Compliance Means We Are Secure"

Meeting a regulatory standard demonstrates that certain controls exist at a point in time. It does not prove that your organisation can withstand a determined attacker or that controls work in practice. Compliance is a floor, not a ceiling.

Compliance still matters, particularly for organisations operating under strict reporting rules. Our primer for boards on responding to regulatory investigations shows how scrutiny unfolds once something has gone wrong, and why preparation beforehand is far cheaper than improvisation afterwards.

Myth 4: "More Tools Mean More Protection"

Security budgets often drift towards purchasing products. But tools without clear ownership, configuration and monitoring create a false sense of safety, and overlapping products can generate more alerts than any team can examine. Before buying, ask which specific risk a tool addresses, who will run it and how its effectiveness will be tested.

Basics often deliver more than novelty. Multi-factor authentication, prompt software updates, restricted privileged access and tested backups are widely recommended precisely because they prevent or limit a large share of common incidents. Ask your security leaders whether these fundamentals are in place before approving anything exotic.

Myth 5: "Employees Are the Weakest Link"

The phrase is popular and unhelpful. Blaming individuals for clicking a convincing email ignores the fact that attackers are skilled and that systems should be designed to tolerate human error. It also discourages reporting. If employees fear punishment, they will hide mistakes, and delay turns small incidents into large ones.

Build a culture where people report suspicious messages and errors quickly without blame. The research summarised in our article on psychological safety and high-performing teams applies directly: teams that feel safe to speak up surface problems earlier.

Myth 6: "Prevention Is Enough"

No defence is perfect. Resilient organisations assume that some attempts will succeed and prepare to detect, respond and recover. That means a written incident response plan, named roles, clear decision rights and, crucially, rehearsal. A tabletop exercise, in which leaders walk through a realistic scenario, reveals gaps in communication, authority and legal obligations that no document alone will expose.

Technology adds further questions. As organisations adopt artificial intelligence, accountability becomes harder to trace. Our analysis of the AI governance gap shows why leaders must decide who owns risk when algorithms are involved, and our 90-day AI strategy playbook for business leaders treats security as part of any responsible adoption plan.

What Good Awareness Training Looks Like

Awareness campaigns work best when they respect people's time and intelligence. Keep sessions short, specific to the role and grounded in realistic examples. Finance staff, for instance, face different fraud attempts from recruiters or engineers. Make reporting easy, with one obvious button or address, and thank people who report, even when the alert proves harmless. Most importantly, let staff see leaders taking part. When executives skip training or demand exceptions to security rules, every message about taking security seriously loses credibility.

Awareness Is a Leadership Habit

Staff awareness campaigns matter, but they cannot compensate for gaps at the top. Leaders who treat cyber risk as a business risk, assess their real exposure, invest in fundamentals, build open reporting cultures and rehearse their response will be better placed when something goes wrong. Awareness should not be a month on the calendar. It should be a standing item on the leadership agenda. 

Frequently Asked Questions

Who is responsible for cybersecurity in an organisation?

Everyone contributes, but accountability sits with senior leadership and the board. Technical teams run controls; executives set risk appetite, allocate resources and decide how to respond to incidents.

What is the NIST Cybersecurity Framework?

It is a voluntary framework from the US National Institute of Standards and Technology. Version 2.0, released in 2024, has six functions: Govern, Identify, Protect, Detect, Respond and Recover.

Why is a tabletop exercise useful?

It lets leaders rehearse a realistic incident in a safe setting. It exposes unclear decision rights, communication gaps and legal obligations before a real crisis tests them.

Are small businesses really at risk?

Yes. Many attacks are automated and opportunistic, so they do not depend on a target's size. Small firms may also be used as routes into larger partners through supply chains.