Institutions tend to believe persistent problems will, over time, settle into place. A risk emerges. It creates friction. Eventually responsibility is assigned, processes form around it, and the problem becomes manageable, if not resolved.
Cyber risk has never quite followed that pattern.
Instead of being absorbed into general management, it was professionalized. Organizations hired specialists, built security teams, invested heavily in tools, and elevated a role meant to sit at the center of digital uncertainty. Over time, the presence of this role came to function as reassurance. Someone was responsible. Someone was paying attention.
What remained less clear was whether responsibility had been meaningfully integrated into how the business itself was run, or whether it had simply been set aside.
The modern chief information security officer (CISO) occupies that ambiguity. The CISO is expected to anticipate threats, prevent incidents, coordinate responses, explain technical realities to senior leadership, and help navigate disruption when it occurs. At the same time, the role rarely carries authority over the decisions that most shape exposure. How systems are designed. How tightly operations are coupled. How much disruption is considered acceptable in pursuit of efficiency or growth.
That tension rarely draws attention to itself. It tends to surface only under pressure.
How Cyber Drifted Away from Governance
Cyber risk entered organizations as a technical concern because, for a time, it largely behaved like one. Early incidents were bounded. Systems went offline, were restored, and operations resumed. Responsibility rested, understandably, with those who ran the technology.
As digital systems became inseparable from business operations, the nature of the risk changed. Software came to govern logistics, payments, compliance, identity, and coordination. In many organizations, there is no longer a meaningful distinction between technology and operations. When one falters, the other does too.
What did not change as quickly was the way responsibility was distributed.
Rather than becoming part of the same executive conversation as financial exposure or operational continuity, cyber risk remained associated with technical expertise. Security functions grew more formal. Reporting became more regular. The CISO role gained visibility, and in some cases proximity to boards.
This professionalization brought real gains. It reduced disorder. It created common language. It allowed complex issues to be discussed with greater clarity.
It also helped preserve the sense cyber risk could largely be managed within a specialist domain. Decision authority remained elsewhere. Ownership, in practice, became diffuse.
Responsibility Without Control
CISOs are often expected to account for outcomes shaped by decisions they did not make. Those decisions are rarely framed as security choices at the time.
Platform consolidation, rapid cloud migration, acquisitions integrated under compressed timelines, outsourcing arrangements which reduce internal visibility. Each choice can be justified on commercial grounds. Rarely are they considered together, as a system.
Cyber risk accumulates in that space. It develops quietly, shaped by incentives that reward speed, scale, and cost reduction more reliably than resilience.
When incidents occur, attention shifts quickly to controls and response. Those questions matter. Alongside them sits another reality. The organization is encountering the version of itself it has been constructing over time, one optimized for uninterrupted digital function, with limited tolerance for uncertainty.
In those moments, the CISO is often asked to explain not only what failed, but why the business feels as exposed as it does.
What Incidents Reveal
Public accounts of cyber incidents tend to dwell on mechanics. How attackers gained access. Which malware was used. What vulnerability was exploited. The detail can be clarifying, but it rarely accounts for impact.
When Maersk was affected by the NotPetya outbreak in 2017, the defining problem was not data loss so much as interruption. Shipping operations slowed because the digital coordination that sustained them disappeared. Ports, schedules, and documentation processes which normally functioned in the background became constraints. Recovery required restoring systems but also reconstituting how the organization operated without them.
The Colonial Pipeline incident in 2021 followed a different path but exposed a similar dependence. A ransomware intrusion into corporate IT systems led to a precautionary shutdown of fuel distribution. Even without confirmed compromise of operational technology, uncertainty itself proved sufficient to halt activity. The effects extended quickly beyond the company, affecting markets and consumers who had no direct connection to its networks.
In both cases, disruption tracked dependence rather than novelty. What mattered was not merely systems failed, but alternatives were limited once confidence in those systems was lost.
The incidents did not so much introduce new weaknesses as clarify existing ones.
Why the Arrangement Persists
The prevailing distribution of responsibility persists for understandable reasons. Specialization brings order. A named role provides a focal point. Reporting cadence creates the impression of oversight.
More quietly, it allows organizations to defer less comfortable conversations. Questions about how operating models behave under stress. About how much redundancy remains after years of efficiency initiatives. About where recovery actually begins when automation stalls.
Delegation creates distance. As long as disruption is contained, that distance feels manageable. Risk appears to be handled. Attention shifts elsewhere.
When disruption widens, the same structure offers fewer answers.
Measurement and Distance
Cyber risk is typically communicated through measures which make sense within security programs. Maturity models, control coverage, likelihood estimates. These metrics help teams prioritize effort. They also abstract away consequence.
Executives tend to experience risk differently. They want to know when operations resume, which commitments cannot be met, what customers will notice, and how long confidence takes to restore.
Many organizations do not hold these answers in a shared, explicit form. The knowledge exists informally, distributed across functions and individuals. Documentation substitutes for rehearsal. Confidence is inferred rather than demonstrated.
The gap between those states often remains invisible until it is tested.
Where Exposure Forms
Cyber risk grows most quickly in places security teams do not control. It accumulates in efficiency drives that remove slack, in outsourcing arrangements that trade visibility for cost, and in architectures built for scale rather than isolation.
These decisions are familiar and rational. They are often rewarded.
Taken together, they shape how disruption travels.
When failure occurs, the result can feel abrupt. In retrospect, it often reflects the compound effect of incentives that were never reconciled.
Rethinking Ownership
Treating cyber risk as a business risk does not requires alignment.
Alignment between authority and accountability. Between strategic decisions and their operational consequences. Between how risk is described and how disruption is actually experienced.
It begins with recognizing digital disruption is not exceptional in modern business. It is an ordinary condition that must be planned for, not merely resisted. Measurement reflects impact and recovery, not prevention alone. Planning assumes systems will degrade at inconvenient moments.
CISOs remain essential in this picture. Their expertise, preparation, and coordination matter. What they cannot provide, on their own, is ownership of decisions they do not control.
Cyber incidents rarely demonstrate neglect. More often, they reveal how responsibility was distributed in ways that felt workable until they were tested.
Organizations live within those arrangements every day. Failure makes them visible.
