Published on 6 November, the Cybersecurity Assessment Netherlands 2026 shows that the capabilities and activities of state actors and cybercriminals are increasing. However, the digital resilience of Dutch organisations is not growing at the same pace. According to the NCTV, this imbalance increases the likelihood of espionage, data theft, sabotage and disruption of digital processes that could cause societal disruption, and therefore poses a serious risk to national security.

AI shortens response times
According to the NCTV, AI helps cyber actors find hidden vulnerabilities and then develop malware within a short period of time. This allows malicious actors to carry out attacks faster and on a larger scale. It does not stop there: AI is also playing an increasingly significant operational role within malware itself.

The NCTV notes that, in recent years, the time between the discovery and exploitation of vulnerabilities has fallen from days to, in some cases, just hours. This leaves organisations with less and less time to test and deploy patches. According to the NCTV, time-to-patch must therefore be reduced drastically.

For CIOs and CISOs, this is an important signal. The question is not only whether security measures are in place, but also whether governance, processes and decision-making are fast enough for a threat landscape that is constantly accelerating.

Boards need to act
The NCTV explicitly places responsibility on boards. Many organisations still do not have their basic security measures sufficiently in order. Board-level ownership, prioritisation and exercises are also lagging behind.

This analysis aligns directly with CIO Platform Nederland’s direction. We have long emphasised that cybersecurity is a strategic board-level issue. Organisations must also build resilient supply chains and be able to rely on secure products and services. Suppliers must incorporate security and compliance from the design stage and support their products and services throughout their entire lifecycle. This requires demonstrable compliance and appropriate certification.

No organisation can do this alone
Collaboration is becoming increasingly urgent, particularly when it comes to AI. That is why CIO Platform Nederland supports Prometheus (Dutch), an initiative by Digital Holland in which businesses, knowledge institutions and government organisations are working on collective, market-neutral capabilities for digital resilience.

The first step is a joint pilot to use AI to identify and validate vulnerabilities in widely used software on a larger scale. The ambition is to find and fix vulnerabilities faster, before attackers can exploit them.

The underlying idea is clear: no single organisation or sector can independently keep pace with the speed of developments in AI and cybersecurity. 

From threat assessment to action
The CSBN is therefore more than a warning. It gives boards reason to discuss a number of concrete questions: 

• Can we find, assess and fix vulnerabilities quickly enough?
• Do we know which suppliers, digital infrastructure and supply chain partners our critical processes depend on?
• Are cybersecurity and digital continuity genuinely part of board-level decision-making?
• Do we conduct enough exercises to prepare for the failure of critical digital services?
• Which risks can we manage ourselves, and where do we need to collaborate with suppliers, supply chain partners, government or other organisations? 

That last question also relates to the work CIO Platform Nederland is doing with NLdigital on continuity risks in digital services. This involves examining relevant scenarios, the severity of disruptions, the available response time and possible risk mitigation measures. 

Digital resilience remains on the agenda 
Through, among others, our CIO Committee Information Security, we continue to develop positions on cybersecurity regulation, certification, supply chain resilience and the practical measures organisations need. We also organise knowledge-sharing on emergency communications, exploring how organisations can stay in contact when regular means of communication are unavailable for an extended period.

The new CSBN underlines the urgency of this work. The digital threat will not wait for organisations to get their governance, processes and technology in order. The task is therefore not just to do more on cybersecurity, but above all to ensure that our resilience grows faster than the threat.