DTQ recently organized an online event—Time To Accountability – Why 2026 is the year the blame game ends— focusing on a critical challenge facing businesses today: who’s responsible when cybersecurity fails. As companies rely more heavily on digital infrastructure, cloud services, and AI systems, the risks have evolved dramatically. Cybersecurity is no longer just an IT problem—it’s now a strategic priority demanding leadership attention.

The discussion kicked off with an insightful observation: organizations typically react to security incidents in one of two ways—either scrambling to fix the problem or pointing fingers. This defensive posture has characterized cybersecurity approaches for years. But speakers argued this mentality falls short in an era of sophisticated cyber threats, high-profile data breaches, and devastating business impacts.

The dialogue proposed a radical rethink—shifting from reactive blame games to continuous, proactive ownership. Under this model, companies must do more than respond swiftly to breaches. They need to explicitly assign responsibilities, integrate security into every layer of operations, and foster collective accountability throughout the organization.

Speakers

• Dr. Rajeev Jha – Chief Information Security Officer (CISO), Comviva
• Sunil Sharma – Deputy Chief Information Security Officer (Deputy CISO), Hitachi Digital
• Sudhanshu Pandey – Cybersecurity Professional, UNISON Insurance Broking Services Pvt Ltd
• Sanjay Kaushal – Global Chief Information Security Officer (Global CISO), Orbit Techsol

Moderator:

• Fabrizio Degni – Global Council for Responsible AI (Expert in AI Ethics and Data Governance)

Key Insights and Discussion

• Cybersecurity Failures Begin Long Before Breaches

A central idea that emerged early in the discussion was that cybersecurity incidents do not originate at the moment of attack. Instead, they are the result of decisions made much earlier within the organization. Breaches are often the final outcome of accumulated risks, ignored warnings, and delayed actions.

The conversation made it clear that focusing only on incident response overlooks the deeper issue. The real problem lies in how risks are identified, prioritized, and addressed before an incident occurs. By the time a breach becomes visible, it is already too late—the failure has already happened at a systemic level.

• Accountability is Misunderstood as Blame

A recurring theme throughout the session was the misunderstanding of accountability. In many organizations, accountability is treated as a post-incident exercise focused on identifying who is at fault.

However, the discussion challenged this notion by emphasizing that accountability is not about punishment. It is about preparedness and system design. When an incident occurs, the question should not be “Who made the mistake?” but rather “What structures allowed this to happen?”

This shift in perspective moves the focus from individuals to systems, highlighting the importance of building resilient architectures and processes.

• The Gap Between Compliance and Real Security

The session strongly highlighted the difference between compliance and actual security. Many organizations operate under the assumption that meeting regulatory requirements ensures protection. In reality, compliance often represents only the minimum standard.

Participants discussed how compliance is frequently treated as a checklist activity. Organizations complete required steps, generate reports, and assume they are secure. However, this approach fails to account for real-world threats, evolving attack methods, and internal vulnerabilities.

As a result, organizations may appear compliant while remaining exposed to significant risks. This creates a dangerous illusion of safety that can lead to complacency.

• Execution and Ownership as Points of Failure

While most organizations intend to implement strong security practices, the breakdown typically occurs during execution. Security frameworks and controls may be defined, but they are not always effectively implemented.

A major contributing factor is the lack of clear ownership. When responsibilities are not clearly assigned, risks tend to remain unaddressed. Teams may assume that someone else is responsible, leading to delays and gaps in action.

The discussion emphasized that while accountability can be shared across teams, ownership must always be clearly defined. Without ownership, there is no follow-through, and without follow-through, security measures fail.

• Organizational Silos and Misaligned Priorities

Another key issue discussed was the disconnect between different departments. Business teams often focus on growth and revenue, while security teams prioritize risk reduction. This creates a natural tension between speed and protection.

In many cases, business units request exceptions to security controls in order to meet targets or deadlines. These exceptions, while seemingly minor, can accumulate and create significant vulnerabilities.

The session highlighted the need for better alignment between departments. Security should not be seen as a barrier to business but as an enabler of sustainable growth.

• Leadership as the Driver of Security Culture

Leadership plays a critical role in shaping how cybersecurity is perceived and practiced within an organization. The discussion made it clear that accountability must start at the top.

When leadership treats cybersecurity as a secondary concern, it influences the behavior of the entire organization. Employees are less likely to take security seriously, and compliance becomes a formality rather than a priority.

On the other hand, when leadership actively engages with cybersecurity issues, asks informed questions, and takes ownership of risks, it creates a culture of responsibility. This cultural shift is essential for building a resilient organization.

• Communication Challenges with Non-Technical Stakeholders

One of the practical challenges highlighted was the difficulty of communicating cybersecurity risks to non-technical stakeholders. Technical teams often struggle to translate complex issues into language that business leaders can understand.

This communication gap leads to poor decision-making. Risks may be underestimated, misunderstood, or ignored altogether. As a result, critical security measures may not receive the support they need.

The discussion emphasized the importance of bridging this gap through education, awareness, and simplified communication. Stakeholders must understand not just the technical details, but the business implications of cybersecurity risks.

• Low Engagement in Security Awareness

Even when organizations invest in training and awareness programs, engagement remains a challenge. The session highlighted that many employees participate in these sessions only to meet compliance requirements, without actively engaging with the content.

This lack of engagement reduces the effectiveness of training programs and leaves organizations vulnerable to human-related threats such as phishing and social engineering.

Building a strong security culture requires more than just mandatory training—it requires continuous effort, relevance, and active participation.

• Data Visibility as the Foundation of Security

A fundamental principle discussed during the session was that organizations cannot protect what they cannot see. Data is at the core of cybersecurity, yet many organizations lack a clear understanding of where their data resides and how it is used.

Without proper visibility, security measures become ineffective. Organizations may implement controls, but they cannot ensure protection if they do not know what they are protecting.

Data discovery and mapping were identified as critical first steps in building a strong security framework.

• Frameworks vs Real-World Preparedness

While frameworks and policies provide structure and guidance, they do not guarantee success. The session emphasized that real-world preparedness requires more than documentation.

Organizations must be ready to respond to incidents in real time. This includes defining roles, conducting drills, and ensuring coordination across teams. Without practice, even well-designed frameworks fail under pressure.

Preparedness is not theoretical—it is operational.

• AI as Both an Opportunity and a Threat

Artificial intelligence emerged as one of the most significant factors influencing cybersecurity today. The discussion highlighted both its benefits and its risks.

On one hand, AI enhances productivity, automates processes, and improves threat detection. On the other hand, it introduces new vulnerabilities, including advanced phishing attacks and data exposure risks.

The concept of “AI versus AI” reflects the evolving landscape, where both attackers and defenders use AI to gain an advantage. This dynamic creates a continuous cycle of innovation and adaptation.

• The Challenge of Black Box AI and Accountability

A particularly complex issue discussed was the use of AI systems that are not fully explainable. These “black box” systems make decisions that are difficult to interpret, raising questions about accountability.

If an AI system fails or behaves unpredictably, it becomes unclear who is responsible. This challenges traditional models of governance and risk management.

Organizations must develop strategies to manage these uncertainties, including monitoring AI behavior, setting clear boundaries, and ensuring transparency wherever possible.

•  Balancing Speed with Security

In a fast-paced business environment, organizations are under pressure to innovate quickly. However, this often leads to compromises in security.

The session emphasized that security should not slow down progress. Instead, it should be integrated into processes from the beginning. By embedding security into development and operations, organizations can achieve both speed and protection.

This balance is essential for long-term success in a competitive and risk-prone environment.

Conclusion

The session provided a comprehensive exploration of cybersecurity accountability, highlighting the need for a shift from reactive practices to proactive, system-driven approaches. It emphasized that accountability is not about assigning blame after an incident but about building resilient systems and cultures that prevent failures.

Key themes included the importance of leadership involvement, the limitations of compliance, the need for clear ownership, and the growing impact of artificial intelligence. The discussion also underscored the importance of communication, collaboration, and continuous preparedness.

Ultimately, the session reinforced that accountability is a shared responsibility. Organizations that embrace this mindset will be better equipped to navigate the complexities of modern cybersecurity and build lasting resilience in an increasingly uncertain digital landscape.

DTQ is a global platform that brings together professionals from diverse industries to share best practices, discuss challenges, and exchange innovative ideas and solutions. It fosters meaningful conversations aimed at strengthening trust in today’s rapidly evolving digital ecosystem. By encouraging collaboration and knowledge sharing, DTQ helps organizations and individuals build more secure, resilient, and accountable systems.