The vast majority of cybersecurity breaches stem from human error. Clicking phishing links or using weak passwords are common examples. But another kind of human mistake is putting companies at risk: executive misalignment on cybersecurity. New research from Ernst & Young LLP (EY US) reveals that C-suite leaders often misunderstand the scale and nature of cyber threats. This gap, especially between CISOs and their C-suite peers, may be leaving organizations vulnerable to cyber threats.
Cybersecurity Breaches Decrease Stock Value
EY’s analysis of 96 companies in the Russell 3000 shows a 1.5% stock price drop within 90 days after a cyber breach. These incidents don’t just affect IT—they affect investor confidence and company value.
C-suite Cybersecurity CISOs Sound the Alarm, Executives Miss the Message
The 2025 EY Cybersecurity Study surveyed 800 executives. It found that 66% of CISOs feel today’s threats are more advanced than current defenses. Only 56% of other C-level leaders agree.
More than two-thirds of CISOs worry their executives underestimate the risk. Just 57% of other leaders acknowledge that concern. This divide can cripple a company’s readiness.
Jim Guinn, EY Americas Cybersecurity Leader, urged action with regard to C-suite cybersecurity, “Companies need to move beyond a ‘check the box’ mentality and recognize cybersecurity as a strategic investment, not simply a cost center. It’s time to take the bull by the horns and push for not just the resources but the authority for cyber leaders to build truly resilient organizations. The cost of inaction is simply too high.”
Where Threats Come From: CISOs See Inside Risks
The report found that 47% of CISOs believe insiders, employees, are to blame for cyber incidents. Only 31% of other executives agree. This highlights differing understandings of where threats originate.
On solutions, 75% of CISOs say AI has helped reduce incidents. In contrast, 77% of non-CISOs credit employee training. These opposing views impact how companies set security strategies.
Cyber Budgets Growing—But Are They Targeted Right?
Only 21% of companies currently spend over 10% of IT budgets on cybersecurity. That’s projected to rise to 38% next year. EY stresses that leadership must invest wisely and align cybersecurity with broader business goals.
Other News: C-suite Cybersecurity Gap Leaves Businesses Exposed(Opens in a new browser tab)
