C-suite executives are confident in their organisation’s ability to prevent and respond to cyber-attacks, but this confidence may be dangerously misplaced.

Research from Node4 found that 91% of mid-market C-suite executives are confident in their organisation’s cyber posture, with over half expressing strong confidence. However, further research reveals that a third of senior leaders are not taking active steps to address cybersecurity threats, and of those who are, 21% do not expect to make progress in the next 12 months.

Despite their confidence, 53% of c-suite executives acknowledge facing security or performance challenges across their hybrid infrastructure. Worryingly, just 26% have fully resolved data security risks associated with offering hybrid work. This includes provisioning secure remote access to business systems and implementing zero-trust identity management. Furthermore, a third of executives report specific cybersecurity skills shortages and difficulty filling vacant positions within their organisation.

“Many businesses routinely underestimate evolving cybersecurity risks such as AI-driven threats, vulnerabilities across hybrid networks, or the increased sophistication of supply chain attacks,” says Richard Moseley, CEO, Node4.

“Cyber-criminals don’t stand still, and the C-Suite shouldn’t either. They have a responsibility to ensure defences remain fit for purpose. But this won’t happen if cybersecurity complacency at the top spreads through the rest of the organisation.”

He adds: “C-Suite leaders should also remember that attackers continue to use low-effort tactics, such as social engineering, to trick employees into sharing login information or approving MFA requests.

They can also hijack valid sessions or use leaked data from breaches. These methods don’t require traditional hacking skills; they depend on exploiting oversights—sneaking in through open doors. Recent retail sector breaches demonstrate that mid-market organisations cannot afford to be complacent about these types of threats either.”

Complacency is also evident in the relative importance C-Suite executives give to cybersecurity. It’s ranked seventh out of a list of ten strategic priorities for the next 12 months—behind skills development, net zero and digital transformation.

And although 29% say that cybersecurity threats have the most significant external influence on their organisation’s IT strategy, executives still think sustainability, hybrid working, and evolving regulations all have a greater impact.

Recommended reading

• Cybersecurity Teams Push Back on AI Hype Over Privacy Concerns
• AI Ushering in A “Digital Divide” in Cybersecurity, NCSC Warns
• Cyber-attacks A “Wake-up Call” to Retail Sector

Aside from exposing their organisations to cyberattacks, Node4’s report also suggests that cybersecurity complacency could delay AI adoption. Over a quarter of C-Suite executives think that ensuring data security and compliance is the biggest challenge in their organisation’s data strategy—a critical foundation for successful AI implementation.

Furthermore, almost 40% think concerns over data security and governance represent the biggest challenge to AI adoption within their organisation.

“The low priority assigned to cybersecurity correlates with the inflated confidence levels noted in our report. It suggests senior leaders are shifting their focus to other pressing issues, underestimating their organisations’ vulnerabilities,” Moseley said.

“Our findings indicate that cybersecurity is now seen as operational hygiene—still important but no longer a competitive or strategic differentiator. This complacency could prove detrimental—increasing risk exposure and hindering adoption of new technologies that could drive efficiency and growth.”