Managing Cyber-Risk Is No Different Than Managing Any Business Risk

**Executive Summary:** This commentary argues that cybersecurity is fundamentally a business risk that should be integrated into enterprise risk management—highlighting survey data on widespread CISO adoption of AI and mixed perceptions of its risks, the stronger security posture of highly regulated industries and organizations with audit/risk committees, and the financial and reputational benefits of proactive cyber-risk investment; it recommends elevating the CISO role, expanding cyber-awareness across the organization, and prioritizing preventive measures over reactive remediation.