Try this at the next leadership meeting: ask who gets the first call if the organization’s most important system goes down at 2 a.m. on Saturday. Then ask who has the authority to shut it down.
A clear answer is reassuring. A pause, or several different answers, points to a problem that another security tool will not solve: decision rights are unclear.
The National Cybersecurity Alliance theme for this Cybersecurity Awareness Month is “Don’t make it easy for them.” That advice is often aimed at employees. In practice, some of the easiest openings come from decisions that were deferred, split across teams or never assigned to anyone.
The numbers point back to ownership
Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation accounted for 31% of initial access in breaches. Only 26% of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated by organizations in 2025, down from 38% the year before. Third parties were involved in 48% of breaches.
Those are technical findings, but the response is not purely technical. IT can prepare a patch. Leadership decides whether the affected service can be interrupted, what risk is acceptable and what work takes priority.
What leadership needs to settle before an incident
Accountability. Name the executive responsible for cyber risk and set a regular reporting cadence. Shared responsibility still needs a clear owner.
Priorities. Identify the systems that cannot stop and the data that would cause the most harm if exposed. Those choices should shape spending and response plans.
Standards. Executives should follow the same MFA, access and exception rules expected of everyone else. Visible exceptions weaken the policy.
Decision rights. Customer notifications, system shutdowns and business-continuity tradeoffs are management decisions. They are easier to make when the authority and escalation path have already been tested.
NIST Cybersecurity Framework 2.0 added Govern as a core function alongside Identify, Protect, Detect, Respond and Recover. That change reflects what many organizations learn the hard way: governance problems often surface before a control actually fails.
Five questions for your next leadership meeting
- Who owns cyber risk here, and when did they last report to us?
- Which three systems would hurt most if they were down for a week, and how fast could we restore them?
- Is MFA enforced for everyone, including leadership?
- How many critical patches are past due right now?
- Which vendors and AI tools can access our data, and who approved that access?
Unclear or inconsistent answers are useful information. They show where to start before an auditor, customer or incident forces the issue.
Where to start
Take our 10-question quick check. It takes two minutes and tells you which of the four doors is most open. Then book a free 30-minute review with an SVAM security lead at svam.com/cybersecurity-awareness-month/