Business growth

Is your company the weakest link?

15-09-2026

Mark Kandborg, Group Chief Risk Officer at Nordea, explains why boards must treat cyber risk as a business-critical issue – and what they can do to prepare before an attack happens.

We live in a world where cybercrime generates more revenue than the illegal drug trade. These are not opportunistic hackers working from their basements. It is organised crime on a vast scale, targeting the weakest link – whether a large corporation, a small business or a sole trader. If criminals find a way in, they will exploit it. The consequences can be devastating.

That is why cybersecurity must be at the top of the board’s agenda – not delegated to IT or reviewed only once a year. It must remain a priority.

Everyone is exposed – but the least prepared are targeted first

A common misconception is that cyber risk primarily concerns large companies with complex digital infrastructure. It does not. Cybercriminals strike wherever they find an opportunity – and the least prepared make the easiest targets.

If criminals encounter strong defences, they are likely to move on. That is the key insight for any board: you do not need to be impenetrable, but you do need to be better prepared than the next target.

The board’s role – understand your unique exposure

The starting point is not technology, but the business. The board needs to understand the company’s specific exposure. Which technologies and online services does it use? Which third-party providers does it depend on, and how prepared are they? How reliant is the company on digital channels to serve its customers?

With that understanding, the board should define a clear risk appetite. What level of risk is acceptable? Which systems must remain operational under all circumstances? The answers should guide decisions on backups, data resilience and how quickly the company can switch to alternative systems after an attack.

A common misconception is that cyber risk primarily concerns large companies with complex digital infrastructure.

Three pieces of advice

1. Understand your unique exposure
Map the vulnerabilities in your business model, the technology you use, the services you depend on and the third parties with access to your systems. You cannot manage a risk you have not defined.

2. Train, train, train
Train employees to practice good cyber hygiene. Test contingency plans so everyone knows how to respond if an attack succeeds. Prepare the board and management to act, ensuring that they know which third-party specialists can help contain an attack quickly. A contingency plan that has never been tested is not a plan. It is just a document.

3. Make cybersecurity a standing agenda item
Cybersecurity is not a one-off exercise. The board needs regular reporting: Are systems being patched and updated? When were contingency plans last tested? The conversation must be ongoing, because the company’s preparedness needs to keep pace with the threat.

Watch the video

We wanted to show you a video but you cannot see it as you have not enabled cookies

Click here to update your consent

Working with suppliers to reduce Scope 3 emissions

The supply chain accounts for most corporate emissions, making it a significant opportunity for impact. Companies that move beyond reporting to active supplier engagement can reduce emissions while strengthening resilience and cutting costs, writes Lead Sustainability Business Analyst Martin Zistler.

24-09-2026

Sustainability

CSRD in practice: Lessons learned, simplifications and the road ahead

Nordea recently gathered sustainability and audit experts from EY, PwC, Deloitte and KPMG for a panel discussion on CSRD reporting, sharing lessons from 2025 and practical advice for what comes next.

23-09-2026

Tech & AI

AI changes the game – trust sets the rules

Nordea was once again strongly represented at this year's Nordic Fintech Week. Kirsten Renner, Nordea’s Group CIO, gave a keynote on how the ability to scale AI safely may become one of the most important competitive advantages in financial services. In this article, she expands on the themes from her keynote.