Cybersecurity is not an IT problem – it's a boardroom responsibility

IN most Sri Lankan organisations, cybersecurity is still viewed as an IT concern, i.e. something the “tech people” will take care of once the operational systems are running smoothly.

- By Shafee Abdul Raheem

This mindset is dangerously outdated. In today's digital economy, where every business process, from payroll to procurement, depends on interconnected systems, cybersecurity is a governance and leadership issue, not a technical one.

Across dozens of organisations we have engaged with, one pattern repeats: the head of IT is expected to "handle" cybersecurity alongside server maintenance, system rollouts, and user support.

There is rarely a dedicated cybersecurity function, and very few boards receive structured cybersecurity briefings. The result? Cyber risk remains invisible until a breach occurs.

The misconception:

"Cyber = IT"

This assumption stems from history. In the 1990s and early 2000s, cybersecurity mainly meant firewalls, antivirus software, and network protection, all managed by IT teams. But the modern cyber landscape is entirely different.

Today, threats exploit not just systems, but people, processes, and access patterns. They thrive on poor governance: excessive privileges, unmanaged accounts, lack of oversight, and weak accountability.