Why businesses still get cybersecurity leadership wrong

The bigger problem, though, is not confined to one city. Across sectors, cyber risk is still too often treated as a technical issue first and a leadership issue second.

Current National Cyber Security Centre guidance is explicit that boards have a critical role in cyber resilience and that governance must cover people, processes, systems and technology, rather than leaving the subject to IT teams alone.

That matters because the threat picture is becoming harder to manage. The World Economic Forum’s Global Cybersecurity Outlook 2025 found that 72% of organisations reported rising cyber risks, while AI-related threats and uneven resilience across supply chains are adding new pressure.

In the UK, the NCSC has also warned that AI will make phishing and scam content more convincing, lowering the barrier for attackers.

The practical issue for businesses is that stronger tools alone do not fix weak governance. Board-level cyber guidance from the NCSC stresses that senior leaders need clear oversight, clearer accountability and better communication if risk decisions are going to be made properly.

In real terms, that means cyber cannot sit in a silo, and technical teams have to be able to explain business risk in language decision-makers can act on.

That is where cybersecurity leadership becomes the real differentiator. Secure-by-design thinking is gaining ground, and AI will shape the next phase of both attack and defence, but neither works well without culture, trust and responsibility holding up underneath.

Businesses that treat cyber as a boardroom issue rather than a back-office problem are more likely to make faster, better decisions when pressure builds.

In an exclusive interview with Cyber Security Speakers Agency, Purvi Kay shared her views on the business mistakes, leadership gaps and future pressures shaping cybersecurity today.

The cybersecurity leadership mistake still leaving businesses exposed

In cyber security, leaders often think of it as a technical problem and forget that, while there is a technical element to it, it is also a leadership and culture issue.

Most of the cyber security issues and problems we see come from weak governance. They come from poor communication. When technical experts are not able to translate jargon into language that makes business sense, leaders are not able to make informed decisions. Poor communication is a key security issue.

There is also the problem of unclear accountability within the organisation: who is doing what, who is responsible, and who is accountable for these risks. Those things are undervalued, and that is one of the biggest mistakes we are making currently.

Cyber does not fail just because of poor tech. It fails because culture fails, and we really need to tap into culture. The technology that we are pumping so much money into is great, but it will only work when people, governance and cybersecurity leadership work in cohesion.

Why the best security leaders turn complexity into clarity

For leaders generally, you think about strategic vision, empathy and influencing ability, but the best leaders I have seen in security are those who can translate complexity into clarity and bring the organisation along with them.

It is very difficult for leaders to sell security. Security is always seen as a barrier, but great leaders are able to show the organisation that security is actually an enabler and should be thought about at the forefront. It should be thought about at board level.

Those who are able to do that are really good cyber security leaders, or security leaders in general, because they do not just manage risk. They inspire clarity, confidence and collective responsibility in the organisation.

AI, secure by design and the future of cyber risk

I see security shifting towards proactive, intelligence-driven models. Especially with AI, we are also seeing a lot of AI-accelerated threats. We are also seeing security shift to a more secure-by-design approach, and that is brilliant because we are now looking at security being embedded at the forefront of everything you do, everything you build.

But at the centre of all of this is human resilience. I know there is a lot of hype about AI replacing humans, but without human resilience in the midst of this, AI is not going to work. We need that human element as well.

What I am also seeing is a shift towards global collaboration. Our allied nations are realizing that we are in it together and need to collaborate even more. In terms of the future of security, I feel that it is built on AI, with security embedded in the design, and all of this powered by human resilience globally.

This interview with Purvi Kay was conducted by Tabish Ali of the Motivational Speakers Agency.