Cybersecurity Awareness Month: 10 Questions Every Business Leader Should Be Asking About Cyber Risk

For the first time in the 19-year history of Verizon’s DBIR, exploited software vulnerabilities have overtaken stolen credentials as the most common way attackers break in. The finding reframes the cybersecurity questions for business leaders, because patching speed, vendor access and employee habits are shaped by leadership decisions long before they reach the IT team. Cybersecurity Awareness Month is a natural moment to start, and the ten questions below give leadership a clear framework. 

Put Leadership in Charge of Cyber Risk

Cyber risk gets real attention and budget once someone owns it and leadership knows what an incident could cost. 

Who in Leadership Owns Cyber Risk?

Accountability for cyber risk is a separate assignment from managing IT, covering decisions about budget, acceptable downtime, vendor requirements and insurance that only leadership can make. When the honest answer points to the IT provider, a business risk has been handed off to a service contract. Once named, that owner should report to leadership on a set schedule. 

What Would a Serious Incident Cost Your Business?

Verizon’s 2026 Breach Impact Study, built on nearly 70,000 U.S. cyber insurance claims, offers a reference point. It found a median impact of about $38,000 for businesses under $25 million in revenue and about $96,000 for those between $25 million and $250 million. Those figures count only insured losses, so the full cost is likely higher, and the most severe 2.5% of cases under $25 million exceeded 7% of annual revenue. The median claim impact rose 80% between 2019 and 2024, against inflation of roughly 23%. 

Check the Foundations

Strong security programs rest on basic controls applied consistently and reviewed by someone outside the team that runs them.

Are the Basics in Place Across Your Entire Organization?

Phishing training, strong passwords, multifactor authentication (MFA) and prompt software updates form the baseline for any organization. Most leadership teams will hear that all four are in place. The better question is where the exceptions are, such as an executive exempted from MFA, a shared login on an older system or a laptop that stopped receiving updates.

When Did Your Organization Last Have an Independent Risk Assessment?

Teams that manage an environment every day can be the last to spot the workarounds they built into it. An outside assessment shows where controls stand, which systems carry the most exposure and what to fix first, and it gives leadership a baseline for measuring progress. 

 

Know Where Attackers Get In

Both of these risks come down to decisions leadership makes about timelines and contracts.

How Quickly Are Known Vulnerabilities Patched?

Exploited vulnerabilities were the entry point in 31% of breaches in Verizon’s DBIR, and the report notes that AI is helping attackers move on known flaws in hours instead of months. A patch cycle measured in weeks leaves a long window open. Leadership should know the real patch timeline for critical systems and what happens to the devices and applications that fall outside it. 

Which Vendors Can Reach Your Systems or Data?

Breaches involving a third party rose 60% from the previous report and now account for 48% of all breaches in the report. Software providers, cloud platforms, payment processors and contractors with remote access all extend an organization’s attack surface. Leadership should expect a current list of who has access, what security controls each vendor must maintain and how quickly access ends when a relationship does. 

Prepare Employees for the Threats They Face Now

Employee risk has moved beyond the inbox to text messages, phone calls and AI tools used outside IT’s view.

Are Your Employees Prepared for Scams by Text and Phone?

Social engineering through fake text messages and voice calls succeeded 40% more often than email phishing in Verizon’s simulation data. Training built around suspicious email links covers only part of the problem. Anyone who approves payments, changes vendor banking details or resets passwords needs a verification step that doesn’t depend on the channel the request came through.

Which AI Tools Are Your Employees Using With Company Data?

Frequent employee use of AI tools jumped from 15% to 45% in a single year, and unapproved “shadow AI” is now the third most common source of non-malicious data leakage in Verizon’s data. Leadership should set an AI governance policy that names approved tools, limits which data can go into them and assigns an owner to keep it current. 

Plan for Recovery Before You Need It

The final two questions assume something gets through, since recovery planning is what limits the cost when it does.

How Long Could You Operate Without Your Core Systems?

Ransomware accounts for 39% of claims from businesses under $25 million in the Breach Impact Study, and business interruption carries the highest median loss of any category in the study, at about $90,000. Leadership should be able to answer in hours or days for each critical system, based on a documented continuity plan and backups that have been restored in a test, since a nightly backup job confirms only that data was copied. 

Does Your Cyber Insurance Still Match Your Risk?

Verizon’s claims research found that business interruption grew from 21% to 32% of known cyber losses between 2023 and 2024, making it the largest loss driver, and it notes that policies sized before 2023 may reflect a loss mix that no longer holds. Insurers also ask detailed questions about MFA, backups and incident response, and leadership should confirm with the IT team before each renewal that those answers still describe how the organization operates. 

Make Cybersecurity a Standing Leadership Conversation

Every October, Cybersecurity Awareness Month offers a good moment to raise these cybersecurity questions, and they do their best work as a standing agenda item. The answers change every time a vendor, employee or system changes, and revisiting them on a set schedule keeps leadership’s view of the risk current.

James Moore Technology Services helps leadership teams assess cyber risk, close the gaps that matter most and plan for recovery. Contact us when you’re ready to find out where your organization stands.

All content provided in this article is for informational purposes only. Matters discussed in this article are subject to change. For up-to-date information on this subject please contact a James Moore professional. James Moore will not be held responsible for any claim, loss, damage or inconvenience caused as a result of any information within these pages or any information accessed through this site.