Cybersecurity is everyone’s job. Not just IT’s.
It’s tempting to leave cybersecurity responsibility with IT only. Because when something goes wrong with technology, the instinct is always to look at the technical team first, regardless of where the actual decision that caused the problem was made.
That instinct made sense when IT genuinely controlled every piece of technology in a business. But that’s not true anymore.
Gartner expects that by 2027, 75% of employees will acquire, modify, or create technology entirely outside IT’s visibility. That’s not a distant prediction, it’s already close to how most businesses work today. A marketing team signing up for a new platform. An ops manager switching on an AI feature inside a tool that was approved for something else. A finance lead adopting a spreadsheet add-on because it saves time. None of that goes through IT first.
Every one of those is, technically, a security decision, whether it is recognised as such or not.
The weakest link is still your employees
You may argue no matter where the decisions are made, as long as you have the right tools you’re protected.
However, all the tools and controls in the world don’t change one thing – you’re only as good as your weakest link, and as Simon du Plessis, IT Practice Director at CloudClevr, puts it, that link is still your people.
"It's also down to every individual in the business. When you look at really combating cyber threats, employees play a big part. That’s why cybersecurity training matters. We do simulated phishing for new users, and the reason for that is not to point fingers, but it's just to make sure all users in the business remain very vigilant.”
The point isn’t to catch people out. It’s to build cybersecurity as a habit and culture before a real attempt tests it.
We’ve written before about what that actually looks like in practice – building a genuine security-first culture rather than relying on an annual awareness course nobody remembers. It tends to work best with a couple of things in place – genuine champions who uphold security outside IT, in departments that would otherwise never think about security day to day, and visible backing from senior leadership, because a habit that isn’t modelled from the top rarely gets embedded throughout an organisation.
The board conversation is shifting too
Boards are being pulled into this more directly too, driven by regulators, insurers, and frameworks like the UK’s Cyber Governance Code of Practice. There was a time when a board’s role in cyber security was largely passive. That’s changed now. Boards are increasingly expected to engage with this directly, not receive a summary of it once a year and consider the job done.
The Board of directors don’t need to become technical experts. But they do need to understand cyber governance well enough to ask the right questions, evaluate whether the business is genuinely prepared, and make sure security decisions align with where the business is actually trying to go.
That changes what “good” looks like at board level. It’s no longer enough for IT teams to point to a handful of technical controls and call it covered. Boards increasingly need evidence of security’s actual business impact, presented in language leadership can act on, not a list of what’s been installed.
And boards have a genuine role in making sure cyber resilience and risk management are embedded throughout the organisation – its people, systems, processes and technologies alike – so that security is treated as a shared organisational capability, not something that belongs to one department.
This becomes obvious during an incident
All of this becomes very real, very quickly, the moment something actually goes wrong. A real incident rarely stays inside IT for long, it pulls in whoever the business actually needs in that moment, whether or not anyone planned for that in advance.
IT is dealing with containment and recovery. Legal and compliance are working out what has to be reported, to whom, and by when. Leadership is making decisions about downtime, cost and risk with incomplete information, usually under real-time pressure. And someone, often in marketing or customer service, has to work out how to tell customers and suppliers what’s happening, which is a much harder question than it sounds if the usual communication channels are down. Where does the customer contact list actually live? How do you reach a supplier if the email system you’d normally use is offline too?
An incident makes this shared responsibility visible, often when it’s least convenient.
So where does responsibility sit?
None of this is about assigning more blame, or handing IT an even longer list of things to be responsible for alone. It’s about recognising that the businesses getting this right have already stopped treating security as something one team does on behalf of everyone else.
That shows up in small, ordinary ways – a marketing lead who flags a new tool before signing up for it, because it’s become second nature. A board that asks about supplier risk. An employee who pauses on a request that feels slightly off, because verifying first is simply how things are done now. A leadership team can see not just which controls are in place, but where the business has evidence that they’re working.
That’s what shared responsibility looks like in practice. And it changes the question businesses need to ask.
Instead of “Do we have cybersecurity covered?”, the more useful question is: “How much of what we believe about our cybersecurity can we actually prove?”
Because confidence is useful. Evidence is better.
Our Prove & Protect guide explores some of the assumptions businesses commonly make about their cybersecurity and what happens when you put those assumptions to the test.
Ready to challenge yours?
Download the guide and find out where your confidence is backed by evidence, and where there might be gaps worth investigating.
