‘Idealistic but passive’ boards putting firms at greater risk of cyber attack

Business leadership with an “idealistic but passive” approach to cybersecurity are leaving themselves open to attack, according to ISACA.

The association has warned that while boards are acknowledging the importance of cybersecurity, that’s not yet translating to funding.

The recent explosion of AI-powered vulnerability detections, combined with severe flaws such as last month’s PHP2Shell, have reinforced the importance of cybersecurity.

Chris Dimitriadis, ISACA’s chief global strategy officer, said organizations still aren't doing enough to invest in security personnel.

“Without a skilled cybersecurity workforce, organizations leave themselves vulnerable to chance, to bad actors, and to rogue AI attacks,” said Dimitriadis. “As with any workforce, morale and working conditions are essential to attracting and retaining the right professionals with the abilities to bolster an organization’s cyber resilience.”

“An idealistic but passive board translates to underfunded, overworked, apathetic cybersecurity teams – who will not be able to prevent or protect against attacks.”

Talent shortages hamper cyber capabilities

Findings from ISACA’s 2026 State of Cybersecurity report found more than half of organizations are struggling to retain talented cyber security employees.

The research also noted that high stress, poor pay, and limited opportunities for promotion are among the most common reasons for staff resignations.

Almost 50% of European IT and cyber professionals aren’t confident that their board has adequately prioritised security, and more than half do not expect their organizations’ cyber budgets to increase in the next 12 months.

Dimitriadis pointed to this underinvestment as a key risk factor for organizations’ security posture.

“While recent cyber attacks have heightened recognition of the importance of investing in cybersecurity, recognition alone is not enough,” he said.

“In this industry, we can’t afford to reach breaking point. Boards have to translate their priorities into action and that means providing adequate funding to attract, hire, train, and upskill cybersecurity professionals”.

AI is an area of particular concern for many security professionals, according to ISACA, with numerous implications for organizations’ risk postures.

In addition to cyber criminals using AI to accelerate and scale development of exploit chains, the body has warned that widespread deployment of AI by businesses also introduces separate risks which must be actively managed.

Speaking to the press at ISACA Conference Europe in October, Dimitriadis warned that if organizations lack a clear strategy around AI security, they risk being overwhelmed.

“You can’t really protect what you don’t understand. You can’t really assume that you are doing well in cybersecurity when you have AI risks against you, and if you don’t understand how AI operates, how those risks may be introduced, and what to do about them, then most probably one would fail in protecting the organization.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.