What Is the Role of Senior Management in Cyber ​​Resilience?

Ayşim Niksarlı, Director of Cybersecurity Consulting at Focerta, points out that cybersecurity within organizations is not merely a technical matter, but rather a strategic area that must be embraced at the senior management level. “Awareness among senior management is truly crucial for enhancing cybersecurity resilience and embedding it into the overall corporate culture. However, the current landscape varies significantly from one company to another and across different sectors. In highly regulated industries—such as finance, energy, or sectors involving critical infrastructure—there are stringent requirements and oversight mechanisms, enforced both by industry-specific regulatory authorities and, in Turkey, by guidelines issued by the Digital Transformation Office of the Presidency. Consequently, senior management bears a clear responsibility. In the banking sector, for instance, findings from internal and external audits, as well as penetration tests, are formally presented to and approved by the board of directors. Thus, senior management plays a pivotal role. That said, the situation differs by sector. In industries with less rigorous regulatory oversight or more limited budgets, management often adopts a ‘reactive’ approach—responding only after an incident occurs. Senior leadership tends to become engaged only when a security breach affects their own organization, a close business partner, or a direct competitor. It is essential to ensure that boards of directors are well-informed; at Forcer, we provide specialized cybersecurity awareness training for boards—a service we have already delivered to several banks. We observe that many global organizations have institutionalized such initiatives as formal programs focused on ‘Cybersecurity Leadership’.” …it is addressed under a specific program, which ensures that the subject is examined in great detail. In Türkiye, however, the approach is more closely aligned with—and driven by—regulations. It is essential that we provide the necessary input to boards of directors—covering budget decisions, strategy formulation, the ability to act swiftly without compromising the company’s competitive trajectory, and ensuring smooth progress within the digital landscape.”

Cybersecurity Resilience and the Role of Senior Management
In today’s digital world, cybersecurity has become an increasingly critical issue. Protecting an organization’s digital assets is not merely a technical matter; it is a strategic necessity. In this context, enhancing cybersecurity resilience—and embedding it into the corporate culture—depends heavily on the awareness of senior management. Senior leadership plays a pivotal role in defining and implementing cybersecurity strategies. However, the level of such awareness and responsibility varies significantly from one sector to another, and even from one company to another.

Cybersecurity in Regulated Sectors
In regulated sectors, awareness and responsibility regarding cybersecurity are more pronounced. In industries with critical infrastructure—such as finance and energy—rules and sanctions established by regulatory authorities heighten the accountability of senior management. In these sectors, boards of directors take a more active role in cybersecurity matters and closely monitor developments in this field.

The Situation in Other Sectors
In sectors that are not subject to intensive regulation, or where budgetary constraints are a factor, awareness regarding cybersecurity may be at a lower level. In such companies, senior management typically pays greater attention to the issue only when a cyber incident occurs—either within their own organization or to a competitor. This indicates that cybersecurity awareness is approached through the lens of “learning from misfortune.”