The accelerating threat environment has made cyber risk a C-suite and board-level priority for many companies, driving greater emphasis on enterprise-wide oversight and collaboration. Insights from the Marsh Global Cyber Buyers Study, which surveyed more than 2,200 cyber risk leaders around the world, including 200 from Australia and New Zealand, highlight how decision-making structures vary across organisations.
In this article, we explore the evolution of key decision makers and cyber risk oversight in the Pacific region, factors driving this shift and actions organisations can take to strengthen their enterprise-wide governance.
The evolution of key decision makers
The roles and responsibilities of decision makers in the evolving landscape of cybersecurity have shifted considerably since the early 2020s. Traditionally, cyber risk sat largely with the Chief Information Officer (CIO), IT operations teams, security specialists and sometimes compliance officers. The focus was primarily technical and often centred around patching, access controls and meeting regulatory checklists. While these efforts were necessary, the organisational approach to cybersecurity were often siloed and reactive. Decisions and investments were driven mostly by incident response and operational constraints rather than strategic or broader business objectives. Over time, this approach saw gaps as technologies evolved, businesses became more reliant on technology and cyber threats grew more sophisticated.
An enterprise-wide approach to cyber risk decision-making
The combination of rapid digital transformation, cloud migration, complex third‑party ecosystems, hybrid working models, enhanced regulatory oversight and more sophisticated cyber attacks has led to a more integrated approach to organisational cybersecurity.
With the damage and business impacts becoming more extensive, organisations responded by embedding cybersecurity considerations into product roadmaps, procurement policies and HR processes, and elevating cyber to board-level risk discussions. Consequently, today’s cyber decision-making has broadened significantly and become more strategic and central to executive’s priorities. HR, legal, procurement and third-party risk teams are often part of the decision-making process and work closely with Chief Information Security Officers (CISOs), enterprise risk teams, business unit leaders, developers, IT operations and cloud architects.
Responsibilities and focus have shifted from purely technical controls to setting risk appetites, vendor cyber resilience and people-focused measures such as training and insider-risk programs. This shift reflects a view that cyber is now a business risk, not just an IT problem. The result is a more distributed governance model where accountability and decisions are shared across various business functions.
Establishing oversight on decision-making
Cybersecurity leaders typically either support committees or act as the primary decision makers in shaping response and mitigation strategies. These differences in cyber risk governance highlight the importance for coordinated, enterprise-wide decision frameworks that balance risk priorities and engage a range of stakeholders.
