We Know the Cyber Risk. So Why Don't We Act?

Table of Contents▾

Let me start with a question. What happens if your cybersecurity team lead or CISO shows up to an executive meeting and reports that four serious new vulnerabilities have been discovered in the application stack and urgently need fixing? What is the room’s immediate reaction?

This question alone reveals an organization’s underlying culture toward cybersecurity. As Alex Blau framed it in his 2017 Harvard Business Review piece, The Behavioral Economics of Why Executives Underinvest in Cybersecurity: Are you mitigating cyber threats to the absolute minimum, or are you actively managing enterprise risk? If you (or your CISO) are still trying to mitigate threats to the absolute minimum, read on.

---

The Paradox: Everyone Knows, Yet Action Lags#

Major cybersecurity breaches occur weekly across large organizations. What is particularly concerning is that attackers repeatedly exploit the exact same historical vulnerabilities. Basic flaws like SQL injection, problems solved decades ago, continue to compromise production systems that lack proper security hygiene.

At the regulatory level, accountability has shifted. European directives such as NIS2 assign direct responsibility to board-level management, ending the historical excuse that “security is purely an IT task.” Whether NIS2 will be enforced with significant fines remains to be seen; my guess is that it may become the new GDPR, with mild fines and a lot of “you should have done” talk.

Yet many organizations continue to postpone cybersecurity investments to “later”, which often becomes “never”. If risk awareness is no longer the bottleneck, what is preventing action when a single severe incident can threaten organizational solvency?

There is a lot of good work in this area, such as the excellent book The Next-Gen Information Security Professional by Vincent van Dijk. In this article I want to add an angle that is often overlooked or underestimated.

---

AI Has Dramatically Increased Attacker Speed and Scale#

Recent experimentation with uncensored, jailbroken Large Language Models (LLMs) deployed on high-performance compute (such as NVIDIA H200 setups) demonstrates a fundamental shift in threat dynamics.

Multi-agent architectures can construct, reason over, and adapt attack chains against specific endpoints in real time. These systems perform automated reconnaissance, vulnerability scanning, and attack vector generation at machine speed with minimal human intervention.

Attacker productivity, speed, and scale have multiplied. Consequently, the financial and operational cost of postponing defensive investments is compounding rapidly.

---

The Awareness-to-Action Gap: Bounded Rationality#

Regulatory frameworks often implicitly assume that executives act as perfectly rational decision-makers. Under classical rational choice theory, a leader evaluates all alternatives, costs, and probabilities to reach an optimal risk balance:

Probability of breach × Expected damage vs. Cost of investment × Risk reduction

In reality, executives operate under bounded rationality (Simon, 1955). They face limited time, constrained budgets, incomplete information, and competing operational demands. Instead of optimizing, leaders settle for acceptable trade-offs, often defaulting to statements like: “We’ve never had a major breach,” “Projects must ship,” or “We will address security next quarter.”

Psychological Distance#

Research by Barré et al. (2026) indicates that executive cybersecurity decisions are heavily influenced by psychological distance:

• Temporal Distance: Perceiving a breach as a distant future event.
• Spatial & Social Distance: Assuming incidents primarily affect other industries or competitors.
• Hypothetical Distance: Treating cyber threats as abstract probabilities rather than operational certainties.

The greater the perceived psychological distance, the more abstract the risk becomes, leading management to categorize security as a task to address later. If many organizations act this way, simple statistics say some of them will be wrong and pay the price, in some cases a hefty one.

---

Cognitive Biases Driving Postponement#

1. Present Bias: Prioritizing immediate quarterly deliverables, revenue targets, or bonus KPIs over mitigating distant security exposure. In short: not now.
2. Optimism Bias: Believing that while industry breaches occur frequently, “it won’t happen to our organization.” In short: not us.
3. Ambiguity Bias: De-prioritizing risks reported through ambiguous or yellow “traffic-light” status boards because they lack binary act/no-act metrics. In short: not clear enough.
4. Overconfidence: Overestimating the effectiveness of existing legacy controls, third-party suppliers, or past audits. If a CISO reporting four new vulnerabilities is seen as a failure of the security team, this bias may be at work. In short: we are fine.
5. Confirmation Bias: Focusing exclusively on favorable metrics (such as passed phishing simulation rates) while ignoring shifts in the broader threat landscape. In short: the evidence supports what we already think.

---

Misaligned Organizational Incentives#

Inaction is not merely a result of cognitive bias; it is driven by organizational incentive structures.

Revenue, utilization, profit margins, and project delivery deadlines are continuously measured and directly tied to executive compensation. In contrast, the return on a cybersecurity investment is an invisible outcome: an incident that does not occur. If nothing happens, there is no visible positive impact, and no bonus is paid.

A manager who allocates additional resources to cybersecurity creates immediate, visible costs: lower margins, additional project effort, delayed delivery, or more internal processes. The benefit is a reduced probability of an event that may never occur during that manager’s time in the role. Organizations frequently ask:

“Why should we spend €500k today to prevent an incident that may or may not happen?”

while rarely asking:

“What risk are we implicitly accepting by not spending it?”

This is where cognitive biases and incentives reinforce each other. Present bias makes today’s costs feel more important than tomorrow’s potential losses, while performance incentives reward the manager for cutting those same costs. Optimism and overconfidence then make postponement easy to justify: “Yes, cybersecurity is important, but our current controls are probably sufficient for now.” The government of the city of Berlin, which reportedly reduced cybersecurity spending and is now facing serious consequences after sensitive information appeared on the dark web, may be a recent example.

The uncomfortable conclusion: “we’ll do security later” may not be the result of an uninformed or irrational manager. It can be the predictable outcome of a system that rewards short-term business performance while the consequences of cybersecurity decisions remain uncertain, delayed, and hard to attribute. In some organizations, the incentive structure itself makes cybersecurity failure more likely.

That raises a governance question: if we want management to treat cybersecurity as enterprise risk management, shouldn’t management incentives and accountability reflect that responsibility too? This is not one-sided, though. Cybersecurity professionals also need to get closer to the business, as the book mentioned above outlines well. In the end, cybersecurity is revenue protection.

---

Stop Relying on Awareness: Design Governance Against Bias#

At a recent Dutch cybersecurity conference, a vendor asked me: “How do we improve security awareness?” Awareness matters, but the time when IT compliance and security training alone was considered sufficient is coming to an end. Organizations relying on training videos and “is this a phishing mail?” quizzes risk falling behind, and falling behind fast.

Governance should be designed on the understanding that decision-makers at every level are human: they operate under uncertainty, face competing priorities, respond to incentives, and are affected by cognitive biases. The objective cannot be to eliminate bias, which is unrealistic. It should be to make it harder for bias to silently determine cybersecurity decisions.

1. Give risks real owners. NIS2 makes the CEO ultimately accountable, but on paper is not the same as in reality. I recently saw a specialized compliance firm present NIS2 while attributing cybersecurity responsibility to the CISO, missing the most important change compared to NIS. A risk that vaguely belongs to “IT” easily remains somebody else’s problem. Significant risks need an accountable business owner with the authority to act. Accountability without authority is just a way of having someone to blame.
2. Make risk acceptance explicit. “We’ll do security later” is a risk decision, even if nobody calls it one. If management decides not to mitigate a material risk, document the decision with its rationale, owner, expected exposure, and a reassessment date. Postponement then becomes a conscious decision instead of the default outcome of inaction.
3. Make abstract risks concrete. Board-level scenarios, stress tests, and realistic incident exercises reduce psychological distance by turning “we could suffer a cyber incident” into “what happens on Monday morning if this system is unavailable, customer data is compromised, or a critical supplier is breached?” This matches Barré et al.’s observation that CISOs use real incidents and sector-specific scenarios to make risks tangible for boards.
4. Pre-define thresholds for escalation and action. Not every decision should depend on whether an individual executive perceives a risk as urgent. At Eindhoven University of Technology, a trained security professional took the entire university offline after spotting something unusual in the network, potentially preventing a large-scale ransomware attack. We should not rely on such heroics. Certain risk levels, regulatory exposures, or control failures should automatically trigger escalation, remediation, or explicit acceptance at the right management level. Attackers operate at machine speed; we should be able to react at machine speed and ask (human) questions later.
5. Align incentives with responsibility. If managers are measured almost exclusively on revenue, margins, utilization, or cost savings, we implicitly accept that they will avoid anything that lowers their bonus. If cybersecurity is treated as risk management, incentives and accountability must reflect that too, including rewards when nothing happens. Otherwise we get the classic case of a CEO declining the CISO’s recommendations five times and then blaming the CISO after the breach.

The goal is governance in which “security later” becomes an explicit risk decision rather than the easiest way to avoid investment and disruption.

---

The Uncomfortable Questions for Leaders#

Regulations, frameworks, controls, and awareness can support leadership decisions, but they cannot remove the human making them. So instead of another recommendation, a few questions:

• If we were breached tomorrow, would I genuinely be surprised?
• Am I postponing security because the risk is actually low, or because other priorities produce more visible results this quarter?
• What evidence would make me act today? Am I effectively waiting for an incident to provide that evidence?
• Have I explicitly accepted this cyber risk, or have I simply postponed dealing with it?
• Would I be comfortable explaining today’s decision to customers, employees, the board, or a regulator after a serious incident?
• If I am already aware of the risk but awareness hasn’t caused me to act, what exactly am I waiting for?

Perhaps the cybersecurity awareness problem is no longer about making leaders aware of cyber risk. The real problem is understanding what happens between awareness and action, and designing governance accordingly.

---

Sources & Further Reading#

• Simon, H. A. (1955). “A Behavioral Model of Rational Choice.” The Quarterly Journal of Economics, 69(1).
• Blau, A. (2017). “The Behavioral Economics of Why Executives Underinvest in Cybersecurity.” Harvard Business Review.
• Barré, G., Khoi Nguyen, D., Huygh, T., & Nuijten, A. (2026). “Fifty Shades of Orange: Construal Levels, Cognitive Biases, and The Amber Dilemma in Cybersecurity Risk Communication.” 39th Bled eConference, pp. 163–176. DOI: 10.18690/um.fov.4.2026.10
• Safi, R., Browne, G. J., & Jalali Naini, A. (2021). “Mis-spending on information security measures: Theory and experimental evidence.” International Journal of Information Management, 57.
• Tsohou, A., Karyda, M., Kokolakis, S., & Kiountouzis, E. (2015). “Analyzing the role of cognitive and cultural biases in the internalization of information security policies: Recommendations for information security awareness programs.” Computers & Security, 52, 128–141.
• Berlin cybersecurity budget reduction: committee protocol and budget document (German).

---

This post reflects the personal opinion of the author and does not constitute legal advice. Organizations should consult qualified legal and compliance professionals regarding their specific situation.