In most boardrooms, cybersecurity sits under Any Other Business. Right after the parking policy.
Picture your last leadership meeting. On the agenda: revenue, a people issue, the sign-off on the new line. Where did cybersecurity sit? At most mid-sized companies, nowhere. Or under Any Other Business.
Recently I sat at the Tag der Industrie, Germany's annual industry summit hosted by the BDI, in the same room as the Chancellor, half the federal cabinet, and the boards of the corporations whose names everyone knows. One line was spoken there that sounds like consensus and is really an invoice: security, innovation and competitiveness belong together. Nobody in Berlin settles that bill. You do, on Monday, in your meeting minutes. Or you default on it.
Monday, 9 a.m., the real test
Suppose the line from Berlin were meant seriously in your company. Then something would land on the table on Monday that today lands almost nowhere. Not a crisis session after the breach, but a fixed slot. A mid-sized firm with a few hundred people, a production line that cannot stop, a supplier you cannot run without. Your head of IT puts a number on the table: this is how well protected we are, no better. A metric, not a gut feeling. And at the end a decision gets made that costs money and carries a deadline.
That is the whole test. If that does not happen, the line was only a line.
Why it almost never happens on Monday
In the mid-market, cybersecurity is delegated, not owned. One person in IT carries it. On top of that, a pile of tools grown over the years: a scanner here, a solution there, each one sensible on its own, together a patchwork nobody can see across anymore. The rest runs on gut feeling, because there is no reliable picture of where things actually stand.
For years that was sound. Cybersecurity really was technical: firewall, backups, patches. Handing it to IT was the right call. The technology has not changed. What has shifted is the stakes. When the production line stands still for three weeks after an attack, that is no longer an IT glitch. It is a question of survival.
Ask your leadership team today how secure you really are. You will not get a reliable answer. What you have is a collection of tools and the assumption that they are enough. Nobody has checked.
The budget test
Real leadership does not show up on a panel or in a statement of intent. It shows up in the next budget decision. Real leadership writes security into the plan before an incident forces it in. Anyone who only starts thinking about a number once the incident hits delegated the question to IT long ago.
On the stage in Berlin came the second line of the day: cybersecurity is not just IT, it is a leadership responsibility. What that means in practice is decided in your budget round. It does not mean nodding through a keynote and feeling good about it. It means asking for an honest baseline, signing off a roadmap with dates and money against it, and checking next time whether what you approved actually got done. Any managing director can do two of those on Monday, with no degree in security.
Whoever delegates the moment it costs money never made it a board-level matter. On stage the words are free. In the budget round they are not. That is where it is decided whether anyone meant it.
Sovereignty is your risk question, not the politicians'
Digital sovereignty sounds like geopolitics from a podium. In your meeting it is a plain inventory question. How many individual vendors does your operation hang on? What happens if one of them fails, gets hacked, or simply dictates the price? The single cloud provider without which your order processing grinds to a halt is exactly one of those points.
Anyone who has outsourced their resilience to individual vendors no longer holds it in their own hands. You only notice in a crisis. By then, changing course is too late. Sovereignty, brought down to earth, means an honest list of your suppliers and dependencies that a managing director can read and understand without a degree in security. NIS-2 turns that list into a legal duty with liability attached. And liability cannot be delegated downward. It stays at the top.
What is missing here is not another tool. What is missing is a reliable baseline and a process that stays on it. That is exactly what Cybervize does: not the tenth tool, but a platform and a guided assessment that turns the baseline into a NIS-2 roadmap with real dates. We do not take the responsibility off the leadership team. We prepare it so it can actually be carried, without the leadership team having to become security experts themselves.
The small vendor at the big table, and why that is the point
Back to Berlin. Cybervize is a young startup that few in the room had heard of, and it still sat at the same table as the Chancellor, the federal cabinet and the heads of Germany's largest listed companies. I owe that access to the CISPA Helmholtz Center for Information Security and to Jürgen Philippi.
That is the real point. If cybersecurity belongs at this level, alongside industrial policy and competitiveness, then it belongs all the more in every leadership team below it. The table in Berlin is the symbol. The invoice gets settled one level down, thousandfold, in the mid-sized companies that together create more value than any single corporation on the index. Between the cabinet table and your Monday morning there is a gap. No summit in Berlin closes that gap. It closes in your meeting on Monday, or not at all.
The one question for your next meeting
Does your next leadership meeting have a cybersecurity item with a name, a number and a date against it? If not, you already know the answer. That is all you need to know to say whether the line from Berlin holds in your company, or was only ever spoken there.