Five Cyber Myths That Refuse to Die in the Boardroom

Every boardroom has them: the comfortable sentences about cyber risk that get repeated until they harden into policy. They are not stupid - they are usually half-true, drawn from a decent instinct or a decade-old article. But decisions made on half-truths allocate real money and real attention to the wrong places.

The myths below survive because they are soothing. Each one lets the room believe the problem is smaller, more distant, or more solved than it is. The director's job is not to be the technical expert; it is to be the person who politely declines the comfortable sentence.

Here are the five that keep coming back, and the one sentence that retires each.

Key takeaways

• Attackers automate; small size is exposure, not protection.

• IT keeps systems running; someone senior must own the risk.

• An audit is evidence of discipline, not a verdict of security.

• Every industry holds something monetizable; vulnerabilities are what is interesting.

• Improvised incidents cost multiples of prepared ones; pre-make the hard decisions.

The five myths

'We are too small to be a target'

The most durable myth of all, and the data kills it every year: attackers automate, and automation does not check revenue. Small companies are attacked precisely because they are small - fewer defenses, same valuable data, and a tendency to pay quietly.

The retiring sentence: 'We are not too small to be attacked; we are too small to absorb the mistake.' The Verizon numbers have said this for a decade.

'IT has it handled'

A reassuring delegation that misunderstands the job. IT keeps systems running; security is about what happens when someone with patience and skill tries to make them misbehave. The two overlap, but 'handled' requires governance - priorities, budget, risk appetite - that only leadership can supply.

The retiring sentence: 'IT runs the systems; who is accountable for the risk?' If the room cannot name the person, the myth is doing its quiet damage.

'We passed the audit, so we are secure'

Audits sample yesterday's controls against a fixed list. Attackers probe today's system with a creative one. The audit matters - it is evidence of discipline - but treating it as a security verdict is like treating a home inspection as a burglar alarm.

The retiring sentence: 'The audit tells us we keep our promises; it does not tell us our promises are enough.' The gap between the two is where the interesting board questions live - the same gap explored in what happens when evidence contradicts the green dashboard.

'Our industry is not interesting to attackers'

Manufacturing heard this for years, right up until ransomware found the production schedule. Every industry holds something monetizable: customer data, payment flows, operational leverage, or a trusted relationship that can be abused to reach someone else.

The retiring sentence: 'Attackers do not find industries interesting; they find vulnerabilities interesting, and everyone has those.'

'We will handle it when it happens'

The most expensive myth, because the invoice is real and dated. Companies that improvise incidents pay several times more - in downtime, in rushed decisions, in trust spent at the worst exchange rate - than companies that decided the hard things in advance.

The retiring sentence: 'We are deciding it now or during the crisis; the crisis charges more.' The ten decisions worth pre-making while it is calm are the receipt.

The related discussion of evidence contradicts the green dashboard is worth your time alongside this one. The related discussion of decisions worth pre-making while it is calm is worth your time alongside this one.

Frequently asked questions

How do I challenge a myth without sounding alarmist?

Ask for the evidence rather than asserting the opposite: 'what tells us we are too small to be targeted?' The myth survives on assertion and dies on inspection. The calm question is more disruptive than the loud warning.

Which myth does the most financial damage?

'We will handle it when it happens.' The others misallocate attention; that one misallocates the entire incident. Preparation costs are visible and optional-feeling; improvisation costs are hidden until they are enormous.

How do we keep new myths from growing?

By keeping the board's information diet honest: real incident trends, your own near misses, and one measured readiness number per quarter. Myths grow in the dark; they do not survive a standing, factual conversation.

A Defensible Next Step

Listen for the comfortable sentence at your next meeting. When it arrives, ask for its evidence - politely, and on the record. That is most of what board oversight of cyber actually is. Book a Decision-Clarity Call if you want the honest baseline built.