It belongs on the agenda of those who lead the company, not those who run the servers.
There is a precise moment when cyber risk stops being a technical problem and becomes a business problem.
It isn't when the ransomware arrives. It isn't when customer data turns up on the dark web. It isn't when your accountant calls because an invoice arrived with your company's name on it and a different bank account number.
It comes before that. It is now. It is the moment when the people leading the company decide, knowingly or by default, how much risk they are prepared to accept.
Because that is what this is: a decision. Not a technical matter to delegate, not a compliance task to file away, not a cost to minimise. A strategic decision, with operational, financial and reputational consequences that fall on the whole organisation.
The risk that never shows up in the reports
Every business leader manages risk every day. Market risk, financial risk, operational risk. They know it, measure it, balance it. They make decisions about it knowing it comes with the job of running a company.
Cyber risk has a trait that sets it apart from almost all the others: it is invisible until it materialises, and when it does, it happens all at once.
A machine that is wearing out gives signs. A customer in trouble is easy to spot. A shrinking margin shows up in the accounts. A cyber incident under way shows up nowhere: not in the operational reports, not in management meetings, not in the quarterly update from the head of IT. Until the day it shows up everywhere at the same time. (We wrote about the gap between what you can see and what is happening in The Invisible Weight.)
This is not a quirk of IT. It is the nature of cyber risk. And it has a clear implication for anyone running a company: the monitoring that works for every other risk is not enough here. It takes a deliberate choice, not waiting for the problem to make itself visible.
What managing this risk means
Managing cyber risk does not take technical skills. It takes the same skills a business leader uses every day: weighing likelihood and impact, allocating resources, setting priorities, accepting trade-offs with open eyes.
In practice, it means putting questions on the leadership agenda that rarely make it there.
Which data and processes, if compromised, would stop the business from operating? Not every system is worth the same. Knowing which ones are critical, and making sure they are protected in proportion, is the starting point of any serious strategy.
Is the level of investment in security proportionate to the risk you run? According to the CLUSIT 2026 Report, Italy invests 0.13% of GDP in cybersecurity, while France and Germany are at around 0.3%: less than half. We have written about why this leaves us so exposed in Why SMBs are targeted by cybercriminals. What matters here is something else: that gap is no accident. It is the sum of investment choices made one at a time, company by company.
Who in the company has formal responsibility for monitoring cyber risk and bringing it to the attention of leadership? If the answer is "the head of IT, when something happens", the process doesn't exist yet. What exists is a reaction, not management.
Answering these questions does not mean becoming a security expert. It takes the same clarity you bring to any other business risk, and a willingness to treat security for what it is: part of a company's resilience, not a technical cost.
The cost of uncertainty and inaction
There is an understandable temptation to put these decisions off: the systems work, nothing serious has happened, there are more urgent and more visible priorities.
The problem is that inaction has a cost, and that cost is not linear.
When an incident hits an SMB, it doesn't touch one department. It touches the whole company. It halts production, cuts off access to data, paralyses operations. The direct costs can be measured. The indirect ones (weeks of downtime, trust eroded among customers and partners, a reputation damaged, often beyond repair) are almost always higher.
The Cisco Cybersecurity Readiness Index 2024 found that 73% of organisations expect a significant cyber incident within the next 12 to 24 months. That is not an outside projection: it is how companies rate their own situation. Three in four expect a serious problem.
In this context, inaction is not a neutral position. It is a choice with a clear, documented risk profile.
NIS2: a change of paradigm, not a box to tick
The NIS2 Directive, in force in Italy since October 2024, brings in something that goes beyond technical requirements: it explicitly places responsibility for cybersecurity on the top management of organisations.
Not on IT. Not on the head of security. On management.
It is a change that reflects a reality already in place: cyber risk has consequences for the whole organisation, and the decisions that set the level of exposure (budget, priorities, processes, company culture) are made at the top. It was only a matter of time before formal responsibility followed.
For those who grasp the real scope of this shift, NIS2 is not a bureaucratic burden. It is a chance to build cyber risk governance that actually works, with clear responsibilities, defined processes and a vision that goes beyond minimum compliance. For those who treat it as a checklist, the result will be paperwork in order and an unchanged security posture. They are not the same thing.
A question of leadership
The companies that manage cyber risk best are not necessarily those with the biggest budgets or the most advanced technology. They are the ones whose leaders have decided to treat it as a business risk in every respect, with the same seriousness they bring to financial or operational risk.
That choice does not require becoming a technical expert. It requires visibility of the real risk, clear responsibility for who manages it, and tools that fit the context: proportionate to the size of the organisation, sustainable in the resources they demand, effective when it counts.
Hoxey was built for Italian SMBs with exactly this logic: not to add complexity for people who already have too much of it, but to give them tools that work in the real conditions SMBs operate in.