Northwave Study: Security Is in Place, but Not Yet Managed

Utrecht, October 2, 2026

Nine out of ten medium-sized organisations have an in-house CISO or Information Security Manager. However, in 83% of these organisations, the CISO or ISM does not make the final decision regarding the procurement of a security service. This is according to the study “Governance of Security and Privacy” by Northwave Cyber Security, conducted among 191 respondents at Dutch organisations with 100 to 1,000 employees.

The study was conducted in May and June 2026 by Beyond Products. In addition to the questionnaire, ten in-depth interviews were conducted. The conclusion: security is in place, but not yet effectively managed. Organisations have procured security solutions and assigned roles, but mandate, budget, and oversight are lagging behind.

The CISO rarely makes decisions independently

The role exists virtually everywhere, but the mandate often does not yet. That doesn’t have to be a problem: larger investments should be weighed at the executive level, and shared decision-making can be a deliberate policy. The question is whether the person responsible can organise the resources that go along with that responsibility.

The budget depends on the need

Fewer than three in ten organisations (29.3%) have a fixed annual security budget. The largest group (42.4%) allocates funds on a per-project or as-needed basis. Much security work, such as monitoring, management, and risk tracking, is, in fact, ongoing. Thus, the budget seems to follow the specific need rather than the risk.

NIS2 compliance is not yet always demonstrable

Of the organisations subject to NIS2 (n=52), more than a third (36.5%) say they currently cannot demonstrate compliance with the requirements.

The biggest objection is control

When asked about objections to an external security partner, 43.5% cite “keeping control in-house.” The biggest objection is not the price, but control. Reinforcing is acceptable; taking over is not.

“Don’t read this report as a benchmark to reassure yourself, but as a mirror for your own organisation. If you don’t recognise the patterns, compare them to the facts within your organisation. If you do recognise them, then after reading this, you’ll know where to start.”

Pim Takkenberg, General Manager Benelux, Northwave Cyber Security

Read the full report

The report describes, across eighteen chapters, where the mid-market stands: the measured maturity across seven dimensions, the challenges faced, what organizations learn from incidents, and what they look for in a security partner. It concludes with five reflection questions to ask within your own organisation.

View the study and download the report →

About Northwave Cyber Security

Northwave Cyber Security is a leading European specialist that helps organisations strengthen their digital resilience and respond effectively to cyber incidents. Founded in the Netherlands in 2006, Northwave operates in the Benelux, DACH, and Nordic regions, with offices in Utrecht, Leipzig, Brussels, and Stockholm.

The team consists of more than 275 experts in the fields of IT security, forensic investigation, psychology, law, criminology, cyber threat intelligence, risk management, and more. Northwave’s integrated approach combines technology, processes, and behavioral insights to create a holistic security strategy.

Since 2012, the certified Computer Emergency Response Team (NW CERT) has been assisting companies worldwide in responding to and recovering from ransomware attacks, data breaches, and other security incidents.