Training executives in cybersecurity? Fine. But not like this.

Today, some top business schools pride themselves on adding a cybersecurity module to their management programmes. EM Lyon, HEC, ESCP: they have all understood that digital security is now a strategic subject. Good.

But let's not kid ourselves: we are still scratching the surface. We sprinkle on a little "risk culture", we run two crisis simulations, and we think we have trained "cyber-aware" managers.

That is not enough. It is not equal to the stakes.

Why training executives is no longer optional

The nature of the debate has changed. Training an executive in cybersecurity is no longer an optional good practice, it has become a legal obligation. The European NIS 2 directive, in its article 20, requires the management bodies of essential and important entities to approve risk-management measures themselves and to follow training that allows them to identify risks and assess cybersecurity practices. That responsibility is personal and cannot be delegated, and a failure to meet it can go as far as a temporary ban on holding management positions.

In March 2026, Cigref and ANSSI jointly published a report, "Governance of digital security: direction, deployment and steering", which says the same thing in another way. The director general of ANSSI, Vincent Strubel, sums up the stakes there: making digital security "not a technical option for technicians, but a matter of overall governance at the right strategic level".

The problem is that awareness is not keeping pace. According to Fortinet's 2025 report on the skills gap, 76% of organisations say their board of directors increased its attention to cybersecurity in 2024, but only 49% of executives believe the members of that board are genuinely aware of the risks involved. A survey relayed by Cybersecurity Dive points the same way: close to 60% of the directors questioned judge that they have not received sufficient cyber-resilience training over the past twelve months.

In other words, the law makes training mandatory, boards are getting to work, and yet the gap between the box ticked and real understanding is not closing. That is exactly my point.

Is a cybersecurity module enough to train an executive?

Training people in cybersecurity is not about showing a few slides on ransomware or running a case study on a fake breach. Nor is it about ticking a box on an ISO compliance grid.

Training people in cybersecurity means changing the way we look at the digital world.

It means training people to see the flaws, in the systems, in the teams, in the behaviours. It means understanding that a software bug can trigger a social crisis, that an Excel file can wreck a reputation, that a poorly protected password can bring a company down. This is not a thought experiment: in its 2025 edition, Verizon's Data Breach Investigations Report estimates that the human factor is still involved in close to 60% of the breaches analysed. The flaw is almost never only technical.

And above all: it means learning to think outside the frame.

Hackers are artists

I know this because I am one. Because I grew up in that culture where you learn on your own, where you take systems apart to understand how they work. Because I have spent time with brilliant, curious hackers, sometimes on the margins, but driven by a thirst for knowledge that no programme ever gave them.

The hacker is not a thief. The hacker is a craftsman of doubt, an architect of the flaw. Someone who searches, tests, gets it wrong, starts again. Someone who sees what others do not see. A critical mind above all.

And that is exactly what we need in executive committees.

Does an executive need to become a technical expert?

No. We do not need every executive to be a technical expert. They are not technicians, but cyber strategists. What they must do is understand the fundamental mechanics of the digital world: architecture, dependencies, exposure, value chain. It is not about knowing how to code. It is about knowing how to ask their CISO the right questions.

It is also about getting past technocratic naivety: no, cybersecurity does not boil down to "buying a solution". No, the cloud is not secure by default. No, GDPR compliance does not protect you from cyberattacks.

Cybersecurity is not a product. It is a culture.

My proposal: a real paradigm shift

If we want leaders who are competent in the face of cyber risk, we have to go further than business schools do today.

Here is what I propose:

Bring voices from the field into the lecture halls: vulnerability researchers, independent experts, former hackers, whistleblowers. The ones we do not invite often enough, because they do not fit the corporate mould.

Create a national cyber apprenticeship programme, where future decision-makers spend time alongside cybersecurity professionals. Not in a classroom: in the field, in the SOCs, the CSIRTs, the crisis units.

Integrate hacker thinking into management training. Not to train pirates, but to introduce the logic of workarounds, vulnerability analysis and digital creativity.

Cross the disciplines: law, sociology, philosophy, design, cybersecurity. Because attacks exploit human, social and political flaws. Systemic thinking is needed.

Is cybersecurity an IT subject or a governance subject?

It is a governance subject, and what I am defending here is not an educational gadget. It is a strategic emergency.

Digital crises are no longer exceptions: they are the background noise of the modern world. Security can no longer be handed to an IT department disconnected from the business stakes. Cybersecurity puts liability, reputation and relationships with clients, partners and states on the line. And that liability is no longer theoretical: again according to Fortinet, 52% of organisations report that an executive has already faced a fine, a dismissal or serious professional consequences following a cyberattack.

We need leaders who are clear-eyed, critical, agile, able to understand the invisible. Able to navigate uncertainty without waiting for an audit to react. And able to work with experts, not to steer them from a distance.

It is time to hack the schools

Training people in cybersecurity is not about running a course. It is about reforming the way we train the elites. It is about breaking the silos between technical and strategic. It is about valuing atypical profiles, non-linear experiences, alternative visions.

It is about telling younger generations that they can understand the digital world differently. That they can make it a tool of sovereignty, of resilience, of freedom.

And that for this, we need to hack teaching itself.

Discover my appearances in the press and media

---

Sources

• Directive (EU) 2022/2555 (NIS 2), article 20 "Governance": approval of risk-management measures and mandatory training for management bodies. EUR-Lex; analysis by Haas Avocats (in French).
• Cigref and ANSSI, "Gouvernance de la sécurité numérique: orientation, déploiement et pilotage", March 2026: Cigref (in French).
• Fortinet, "2025 Cybersecurity Skills Gap Global Research Report": board attention, risk awareness and consequences for executives. Fortinet.
• Lack of cyber-resilience training for board directors (Corporate Governance Institute and Board Intelligence survey): Cybersecurity Dive.
• Verizon, "2025 Data Breach Investigations Report": human factor involved in close to 60% of breaches. Verizon.
• Programmes of the schools mentioned: emlyon, MSc in Cybersecurity and Defense Management (Campus France); ESCP School of Technology (in French).