Those who do not guard the digital front door will soon find themselves locked out

This article is a commercial publication by Contentway bee The Financial Gazette in May 2026.

Every night, the digital front door of thousands of organizations is left open. Not because no one knows, but because no one truly understands what lies behind that door. Software layers pile upon software layers, vulnerabilities fade from view, and somewhere in a back room on the other side of the world, someone is patiently searching for an opening.

Cybersecurity is therefore no longer just an IT issue. It is an urgent and growing governance issue. Yet many organizations still treat it as a technical afterthought, far removed from the boardroom.

Marcel Dusink, IT and ISO auditor and co-founder and COO of Nestor Security, recognizes the pattern all too well. “Executives often say: we don’t have any incidents, do we? But they have had a great many near-misses.”

From gut feeling to administrative responsibility

The introduction of the European NIS2 guideline that attitude is changing. Not voluntarily, but legally. Directors will henceforth be held personally liable if they cannot demonstrate that they know the risks, have approved measures, and have ensured the implementation. Dusink compares it to the far-reaching effects of the US Sarbanes-Oxley Act of 2004. “You will simply be held liable,” Dusink states.

The sectors that are hit hardest are often precisely the sectors with limited resources: governments, healthcare organizations, independent administrative bodies. They are designated as essential entities, but rarely have the budgets of large financial institutions.

Compliance is not the same as resilience

The biggest misconception at the board level is that being compliant is enough. Dusink sees daily how organizations implement standards as an administrative task, a checklist to be ticked off, without connecting it to the actual risks within their own organization.

Nestor Security works differently. The starting point is always the specific context of the organization itself. Which processes are critical? What is the damage if they fail? Dusink illustrates this with a concrete example: a province responsible for winter road maintenance, but with no answer to the question of how long the salt spreaders can be out of service. Or a ferry service whose ticket sales systems failed because everything was housed in a single datacenter.

“There is never an infinite pot of money,” Dusink says. “So make choices. What we find exciting, we spend time on. What we find less exciting, we spend less time on.”

The risk-based approach is at the core of the working method. No standard solutions, but measures that fit what the organization actually does and what can actually go wrong.

For executives who want to start now, Dusink has clear advice: start a dialogue with managers in each department. Ask which processes are critical. Ask what the concrete consequences are if they fail. “As an executive, you need to know what is truly important. You only know that if you have those conversations.”