Cybersecurity: from operating cost to strategic advantage

The board feels ready. The data says otherwise

PwC research shows a clear contradiction. Almost every executive surveyed is confident they could steer the company through a serious crisis. At the same time, many of those companies do not even have a formal plan for escalating risk.

That confidence is fragile, because it rests on underestimating how large the cyber threat really is. The result is simple: you treat risk as a problem to handle once it blows up, not as a standing part of strategy. That is the most expensive moment to react.

Flip the perspective and treat mature security as an asset. It protects the value of the company and builds trust with customers and partners, and digital resilience is becoming a new test of credibility. Responsibility for it now lies with the board, not in the server room.

What one breach really costs

A cyberattack sounds abstract until you put it in money. Real cases show that the cost of a breach reaches far beyond fixing systems and paying a ransom.

In 2023, MGM fell to a social engineering attack. The opening was an employee's public LinkedIn profile. One small slip in digital hygiene got past advanced defenses and took down systems in Las Vegas, freezing reservations and casino floors. The direct cost was about 100 million USD in lost revenue, plus a 45 million USD class action lawsuit.

In early 2024, a ransomware attack on UnitedHealth Group cost 22 million USD in ransom alone and exposed the data of more than 100 million people. That means years of legal costs, data monitoring, and rebuilding trust.

The takeaway for the board is blunt: the weakest link is people. Verizon's 2025 report ties 60% of breaches to human error, such as phishing or weak passwords. Spending on training and process removes the most common attack vector before technology even comes into play.

The averages tell the same story. In 2024 the global average cost of a breach rose 10% to 4.88 million USD. In Poland, 70% of companies had an incident that put data and systems at risk, and the average cost of a single event tops one million złoty. This is not a distant risk. It is a current problem for companies of every size.

The most expensive loss is often the one that never shows up on an invoice. After a breach, 36% of customers cut back their relationship with the company and 22% end it entirely. Reputation and trust are assets that cost many times more to rebuild than the incident itself.

Security that wins contracts

Security is no longer only a shield. In B2B, it has become a selling point. Audits, certifications like SOC 2, and transparency about how you handle data increasingly decide who wins the deal.

Business customers want proof that their data is safe with you. 87% of consumers say they will not do business with a company they have doubts about on security. Where you stand here feeds straight into buying decisions.

Risk also comes in through suppliers. One weak partner can put the whole network at risk, so vendor due diligence has to be an ongoing process, not a one-time questionnaire. What counts is continuous monitoring of your partners' security, stability, and reputation.

Treated as a cost, security is just a box to tick. Treated as an asset, it becomes an advantage a competitor cannot copy overnight. Companies that take it seriously use their accreditations and reputation to win contracts and enter new markets. That is real trust capital, and it helps the business grow.

NIS2 and DORA: the risk lands on your name

European rules have changed the game. NIS2 and DORA move responsibility for cyber risk off the IT department and onto the board.

NIS2 took effect on October 17, 2024 and pulled in new sectors, including manufacturing, digital services, and transport. Penalties reach 10 million EUR or 2% of global annual turnover, whichever is higher. The biggest change is personal liability for senior management in cases of gross negligence in managing cyber risk.

The financial sector faces DORA. The regulation has been in force since 2023, with full application from 2025. It requires an ICT risk management framework, incident reporting, and regular threat-led resilience testing (TLPT). Penalties run up to 2% of total annual worldwide turnover.

Poland missed the deadline to implement NIS2, and the European Commission has opened proceedings. The delay only looks like relief. Running a business in a jurisdiction that drags its feet on the rules leaves you more exposed and hands an edge to partners who already meet the stricter standard.

In practice this means one thing: security has become a personal risk for board members. That is the strongest reason to move from delegating the topic to supervising it actively, to bring people with security expertise onto the board, and to invest in continuous testing.

Here are the main changes the new rules bring.

How to calculate the return: cost avoidance

The board speaks in numbers, so the argument has to be a number too. The return on security is rarely positive in the classic sense. Its real value is cost avoidance, exactly like an insurance policy on the company's strategic assets.

You pay a fraction of the potential loss to push away an event that could threaten the company's survival. A cyberattack is now one of those catastrophic risks.

A penetration test is not a one-off audit but part of continuous risk management. It simulates a real attack to find the gaps before an attacker does. The payoff: a lower chance and lower severity of a breach, DORA requirements met, and a stronger reputation.

The Penetration Testing as a Service (PTaaS) model makes continuous testing possible at a predictable cost. Instead of expensive once-a-year tests, you get ongoing vulnerability detection and proactive risk reduction. You also see lower insurance premiums and less operational downtime.

A simplified calculation shows how to measure that value through cost avoidance.

That math moves the security conversation from the qualitative (we protect the company) to the quantitative (this spend pays back many times over through the losses it avoids).

Recommendations for the board

The conclusion is clear. Cybersecurity is measurable financial, strategic, and legal risk, not a purely technical topic. Here is what to do to take control of it.

• Expertise on the board. Check whether the board genuinely understands technology risk. PwC found that only 32% of managers believe their board has the right knowledge in key areas. Consider a director with security expertise or training for current members.
• Formal oversight of risk. Set up a risk committee or assign this area to the audit committee, and ask for regular, readable reports instead of checklists.
• Continuous testing instead of one-off audits. Adopt the PTaaS model to find and close gaps before an attacker uses them. Make vendor due diligence a permanent process.
• A culture of accountability. No system will protect you from human error. Invest in regular training and awareness at every level, the board included.

A company's resilience no longer rests on its balance sheet, innovation, and market position alone. It also depends on how well it can protect itself and its customers in the digital space. The decisions made in the boardroom today will set the reputation and competitiveness of the years ahead.