As digital infrastructure expands and AI accelerates more ways for attackers to exploit vulnerabilities, accountants have a critical role to play in integrating cybersecurity into the core of governance, assurance and financial reporting. That means stepping beyond traditional roles to shape organisational resilience in an era where data, trust and capital are deeply intertwined.
The latest ACCA Global Economic Conditions Survey (GECS Q3 2025) shows just how sharply cyber threats have climbed up the risk agenda. Cybersecurity is now ranked among the top three global business risks, sitting alongside persistent economic and inflationary pressures.
Finance leaders surveyed warned that technological vulnerabilities, third-party dependencies and weak organisational resilience are increasingly undermining business confidence. In other words, the finance community recognises that cyber risk is not a niche technical issue but rather a systemic financial risk that must be managed through the same lens as other critical enterprise exposures.
GECS data shows cyber and technology risks rising sharply up the risk agenda, now ranking among the top four concerns for finance leaders in the region. With economic pressures and geopolitical uncertainty already weighing on confidence, CFOs are increasingly aware that cyber resilience is essential not only to protect operations but also to sustain trust in volatile markets.
CFOs and finance leaders are at the frontline of this shift. As cyber incidents escalate globally, financial leadership must go beyond mitigation. They must anticipate, quantify and integrate cyber risk into every dimension of strategic decision-making. Why? Because cyberattacks don’t just cause operational disruption, they also trigger a cascade of financial consequences:
- Direct financial losses from fraud, theft and extortion.
- Regulatory and legal liabilities, including fines and remediation costs.
- Reputational damage that can affect share price, creditworthiness and market access.
- Supply chain disruptions that impact cashflow and forecasting accuracy.
The finance function already has the tools to respond, from risk modelling and scenario planning to cost control and assurance. The challenge is to elevate cyber resilience to the same level of visibility and urgency as financial performance indicators.
Most organisations already meet basic compliance standards. But as ACCA’s research and member feedback show, compliance is not the same as resilience. A tick-box approach fails when threats are dynamic, cross-border and AI-enabled.
This is where accountants can be powerful catalysts for cultural change. Embedding cyber risk management across financial controls, reporting and assurance processes strengthens governance at its core. It ensures that cybersecurity isn’t relegated to a specialist team but is owned collectively, with finance playing a central role in:
- Embedding accountability: integrating cyber risk into internal controls, assurance frameworks and board reporting.
- Improving visibility: ensuring that cyber exposure and resilience metrics are included in financial reports and audits.
- Enhancing decision-making: enabling boards and investors to understand the financial impact of cyber threats.
This integration mirrors how environmental, social and governance (ESG) issues evolved over the last decade, moving from compliance footnotes to boardroom strategy. Cybersecurity is now on the same trajectory.
The GECS data shows that CFO confidence remains fragile in a volatile global economy. Cost pressures are elevated, geopolitical uncertainty persists, and technology-related risks are escalating. In this environment, CFOs have both the visibility and the voice to drive practical action.
Unlike IT or security teams, finance leaders are responsible for capital allocation, reporting and risk management. This gives them a unique vantage point to embed cyber risk within enterprise risk frameworks, align financial planning with potential threat impacts and support boards in making informed, risk-adjusted decisions.
They also shape how resilience is communicated externally through reporting and investor disclosures that increasingly reflect how prepared organisations are for cyber threats.
For Middle East CFOs, this pressure is particularly acute. GECS results show cost control and risk management dominating regional priorities, creating a clear opening to embed cybersecurity into financial strategy. Treating cyber resilience as a financial imperative positions CFOs as critical anchors of stability in a complex regional environment.
The rise of generative AI is accelerating this shift. AI enables attackers to launch more sophisticated and targeted campaigns, from deepfake impersonation to automated phishing and real-time financial fraud. ACCA members highlighted these concerns clearly: AI-powered cybercrime and weak supply chain controls are emerging as the most underestimated threats.
As the threat landscape evolves, so must the response. For finance professionals, this means building capacity to understand the financial mechanics of AI-driven risks, how they manifest, what they cost and how they should be reported and mitigated.
Finance, risk, technology, legal and communications functions must work together. But accountants bring something distinct: a disciplined, evidence-based approach to governance and reporting.
As more jurisdictions move toward mandatory cyber incident reporting and disclosure regimes, financial professionals will be instrumental in shaping how organisations meet, and go beyond, compliance. They can help ensure that reporting reflects not just incidents, but preparedness, resilience and strategic foresight.
Cyber risk now ranks among the top three global concerns identified by finance professionals in the latest GECS data. This is a decisive moment for the profession. As the custodians of financial resilience, CFOs and accountants have the opportunity (and responsibility) to lead on cybersecurity governance. By embedding cyber considerations into financial reporting, risk management and assurance, they can help protect not just the bottom line, but the trust that underpins it.
About the Contributor
Kush Ahuja is Head of Eurasia and Middle East at ACCA, where he drives initiatives to empower finance professionals to lead on governance, resilience and sustainable growth across the region.
All Content Rights Reserved by The Catalyst.
