From firefighting to foresight: Why governance is the key to strong cybersecurity
Every time a major cyber incident dominates the headlines, the same story repeats itself. At first, the narrative focuses on the technical dimension, but as investigations progress, another, deeper story emerges. The breach was not simply about code or systems — it was about leadership. It was about decisions that were not taken, risks that were not prioritized, and accountability that was absent. The lack of governance is often the root cause.
A pattern hiding in plain sight
Every time a major cyber incident dominates the headlines, the same story repeats itself. At first, the narrative focuses on the technical dimension: a vulnerability left unpatched, a firewall misconfigured, or credentials stolen. But as investigations progress, another, deeper story emerges. The breach was not simply about code or systems — it was about leadership. It was about decisions that were not taken, risks that were not prioritized, and accountability that was absent. The lack of governance is often the root cause.
This pattern should alarm us. Because if the root cause of our most damaging breaches lies in governance rather than technology, then our current approach to cybersecurity is dangerously incomplete.
One breach that changed the conversation
Take the case of Equifax, one of the largest consumer credit reporting agencies in the United States. In 2017, Equifax was the target of a data breach, which resulted in the personal data of 147 million Americans being compromised. The technical root cause was a known vulnerability in a widely used software library. A patch was available. It had been available for months. Yet the organization failed to act. Why? Because no one felt responsible for making sure the patch was applied. No process escalated the urgency of the risk. No oversight ensured that leadership understood the stakes.
Equifax became a global cautionary tale, not of technological weakness, but of governance failure. A problem that should have been straightforward to solve by applying a patch spiralled into a catastrophe because leadership structures were not in place to ensure accountability and action.
When leadership fails, trust breaks
The same lessons can be drawn closer to home. Danske Bank’s money laundering scandal, discovered in 2017, exposed systemic weaknesses in risk management and leadership oversight. Billions in suspicious transactions flowed through the institution because governance structures were ineffective, fragmented, or ignored. The result was devastating fines and reputational damage that still shadows the organization years later.
Or consider the Vastaamo case in Finland, where hackers exfiltrated deeply sensitive psychotherapy records between 2018–2019 and published them in 2020. The public outrage was enormous, not only because of the breach itself, but because the leadership response lacked transparency and accountability. Victims were left vulnerable in the moment when they most needed protection.
From firefighting to foresight
These cases reveal a hard truth: without governance, cybersecurity devolves into firefighting. Organizations react to incidents as they happen, rushing to contain damage while struggling with unclear roles, conflicting responsibilities, and inconsistent processes. In this state, security becomes a matter of luck rather than design.
Governance offers a way out of this chaos. It provides clarity, structure, and foresight. With governance, risks are managed systematically rather than reactively. Responsibilities are defined, accountability is enforced, and priorities are aligned with the broader business strategy. Well-established frameworks for managing information security serve as compasses, turning abstract principles into practical guidance.
