EN

NL

Yuri Bobbert

Function Professor in Digital Transformation

Email yuri.bobbert@uantwerpen.be

Discover our publications

Expertise

Information Technology Governance & Strategy
Risk, Security and Compliance
Design Science Thinking & Research
Academic & Practical coaching
Entrepreneurship
Business Development and Consulting
Regulatory Technology
Marketing & General Management
Information Audit / Assurance

Prof. Dr. Yuri Bobbert is an experienced business executive, entrepreneur, and scholar with a dual PhD from Radboud University and the University of Antwerp in IT performance measurement. Building on that research and his work at AMS, he co-developed multiple technologies and has authored more than 100 publications. In 2025, Bobbert was awarded the Global Inspirational Leadership Award from ISACA Global, an International IT body with over 300.000 members globally.

Yuri served as Global Group Chief Security Officer at NN Group (AEX-listed) and at the Dutch government agency UWV. At NN Group he led the merger and integration of NN and Delta Lloyd’s IT Security, Risk & Compliance functions. Previously, he spent over a decade as CEO of B-ABLE, guiding the firm’s growth through to its acquisition by DPA Professionals (AEX-listed). In 2019, he joined ON2IT Zero Trust Innovators as Group CSO, and overseeing North American engagements in the financial sector. He is also the co-founder of AnoveAI (2023, RegTech), Meetingwizard (2020, EdTech), and other ventures.

In academia, Yuri started as an Associate Professor at NOVI University of Applied Sciences in 2013 and has chaired the LOI University of Applied Sciences Bachelor of IT supervisory board since 2012. He lectures at Antwerp Management School (since 2016) and mentors Master’s students across universities. Since 2017, he has been the academic lead for the Executive Masters in Risk and Cybersecurity Management. A frequent conference speaker, Yuri is the author or co-author of several books, including Implementing DORA (2024), 25 Years of Group Support Systems (2022), Strategic Approaches to Digital Platform Security Assurance (2021), Leading in Digital Security (2020/2023), Cybersecurity in 60 Minuten (2018), Critical Success Factors for Business Information Security (2018), Exploring Capabilities and Skills for Digital Value Creation (2018), Improving the Maturity of Business Information Security (2018) and Maturing Business Information Security (2010).

For more information and resources, please visit Yuri’s website.

Programs

Master Class Cyber Security Architecture & Technologies

Master Class Cyber Security Management

Discover our programs

Recent publications

Performance Management in Information Security

Organizations often struggle with effective cybersecurity performance management due to the lack of standardized metrics, siloed security practices, and difficulty quantifying cybersecurity initiatives' value. Many businesses fail to tie cybersecurity performance directly to organizational goals, leading to gaps in resource allocation, risk mitigation, and strategic planning. This results in poor visibility into the effectiveness of cybersecurity measures and an inability to adapt quickly to emerging threats.

NIS2

The NIS2 – What Boards Must Do

The NIS2 – a European directive that follows in the footsteps of NIS1 – requires full implementation by member states on October 17, 2024. This means that member states will have had time between January 16, 2023 and October 17, 2024, to translate the law into more specific rules and instructions in order to comply effectively. It's worth noting that certain countries and industries have already anticipated this shift and have started adapting to it. In this article, I describe three stances vital to boards or anybody having a steak in the company. And the primary obligations you must consider.

Digital risks 1

The need for Digital Due Diligence; How to prevent a pig in a poke

The heightened scrutiny of cybersecurity underscores the critical need for careful digital due diligence on digital assets and comprehensive risk assessments in mergers and acquisitions.

Trends cyber security 1

Influential trends for emerging roles in digital security - 2023 and beyond

Looking at cyberdata collected in recent times reveals intriguing insights that may affect our future view on digital security education as a prime defense mechanism for dealing with future threats. In this article, we first observe the cumulative change in cyber threat actors followed by summarizing our analysis of more than 20 years of cyberdata, based on the VERIS Community Database in order to distill key trends by extrapolating trends toward the future. When examining these findings, we then used our own expertise and observations to suggest future roles that might dominate the field of cybersecurity.

Cybersecurity management

How Small and Medium Enterprises approach cybersecurity

At Antwerp Management School's Master in IT Risk & Cyber Security Management we noticed that SMEs are struggling to adequately address cybersecurity risks and are taking a slightly different approach than large(r) organizations. So we decided to have a closer look at the typical SME cybersecurity risks and approaches. This not only resulted in extensive research, but also in the development of the SMB Cybersecurity Canvas by Vincent van Dijk.

Strategy & Innovation

Always verify

Never trust and always verify - the increasing number of cyber threats & risks

The increased digitization of the world we live and work in, has given rise to an increasing number of cyber threats and IT-risks. Over the past few years, we’ve seen a huge surge in the number, the intensity, and the sophistication of the attacks. But it’s not all doom and gloom. With proper technical solutions such as firewalls, antivirus programs , back-ups and a no-trust attitude, companies can better defend themselves.

Buds and fails

Why FUD fails and BAD prevails in Digital Security

Many cyber security specialists or security software sales representatives want to convince people to act or buy certain products by frightening them with statements like: “If you don’t do (or buy) this, you will be hacked.” Sadly, this way of communicating is still an often-used approach in Information Security to get the message across or motivate people to “buy” their products or service. We call this the FUD approach. FUD stands for Fear, Uncertainty, and Doubt and was introduced in the late eighties. As of 1991, the expression became fashionable for any form of disinformation used against the competition. FUD is a simple but effective strategy that supplies the audience with negative, fake, or false information to influence their behavior and decisions. FUD is so effective because adverse events have a more significant impact on our brain and associated attitudes than positive ones. In psychology, this is called negative bias. Negative bias can have an effect on behavior as well as your decisions. This is also why the news often spreads negative news because negative news draws greater attention and therefore sells. Although this might be effective in the short term to get things done, this won’t be a very successful approach in the long term. In this blog I'd like to explain you why.

The evolving role of the CISO in the public sector

The evolving role of the CISO in the public sector

Over the last seven years, the role of Chief Information Security Officer (CISO) has gained significant importance within local governments, because local governments that want to be in line with the Baseline Information Security Government urgently need such a CISO. About 50% of the job vacancies on LinkedIn are meant for local governments. But the role of CISO has drastically changed in recent years. The latest figures indicate that an astonishing 22% of the IT budget is allocated to cyber and information security. Our own experience is that dialogues with C-level executives nowadays revolve around questions such as: Are we doing the right thing, and are we doing this right? How do we measure and monitor our return on security investments (ROSI)? And where do we get the ‘biggest bang for the buck’?

Security assurance 1

Strategic Approaches to Digital Platform Security Assurance

Nowadays, it is impossible to imagine a business without technology. Most industries are becoming "smarter" and more tech-driven. We live in the era of the "platform society." For example, Coursera has become the world's most prominent online educator, collaborating with over 200 leading universities and companies. Platforms are becoming increasingly powerful and concentrate on collecting more and more data to cross- or upsell services. Ranging from small individual tech initiatives to complete business models with intertwined supply chains and "Platform" based business models. New ways of working, such as Agile and DevOps, are introduced, leading to opportunities and unknown risks.

Banner Cyber Security Architecture 1

Get the biggest bang for your security buck

Over the last seven years, our role as Chief Information Security Officer (CISO) has drastically changed. According to our Microsoft Outlook Analytics client, more than fifty percent of our mail is spam from cyber security suppliers, trying to grab our attention by selling fear, uncertainty and doubt (FUD). Over the last decade, we’ve seen this industry explode with self-proclaimed “cyber pros” and fuzzy vendors in the cyber domain. Is this because industry strategy agencies like IDC, Gartner, and Forrester predict that security spending keeps on increasing? Or is it because the cyber consumer just follows the herd? The latest figures indicate that an astonishing 22% of the IT budget is allocated to cyber and information security. Our own experience is that dialogues with C-level execs nowadays ask: Are we doing the right stuff, and are we doing this stuff right? How do we measure and monitor our return on security investments (ROSI)? And, where do we get the ‘biggest bang for the buck’. It’s a dialogue that very few suppliers actively participate in, while interacting with their CISO customers.

Digitale markt citroenen 1

Is digital security a market for lemons?

Although information security has a long history, it wasn’t really top of mind of senior management, board or other employees until late 2010. A “security professional” became a real job and market demand has grown ever since. Awareness about security risks increased significantly. The thriving forces for this were major security breaches such as Snowden, NotPetja and WannaCry shocking the world, but also regulators demanding companies to protect their critical assets, including non-tangible ones such as data. As a result of this, we can now state it has the board's attention by default.

Archetypes CISO

Which of these 4 CISO archetypes do you deserve and match with?

Why do CISOs have such a low retention in firms and leave after 1-2 years? Is this because recruiters and HR professionals find it hard to discover what is actually needed and “copy paste” function profiles with the exact same requirements, rather than looking at the real need in the organization: M&A strategy, family business, scale-up phase, consolidation, preparing for sales of the company, cultural differences etc.? The CISO role is an embryonic role compared to the CFO, and not one hundred percent clear about exact expectations.

Digital risks 1

Digital risks to business, what do they cost?

Analyzing Business Information Security for a data breach use case; In a digital business world that is highly distributed via an eco-system, ensuring your digital assurance becomes vital. Everything needs to work continuously and Confidentiality, Integrity and Auditability have to be assured, especially when your business is regulated and should demonstrate to be “in control”. Nevertheless, how do we do that when business models can be attacked by hackers? Hackers using heavily automated attack methods and work in a distributed evasive platform-model that disguises their identity and criminal organization. Therefore, hackers form a threat to your business. Varying from State sponsored hackers to scriptkiddies all finding sophisticated ways to hammer on your front porch of your business. To you an IP address means your API store or critical business process; for a hacker it is just an IP number attack, they don't care and don't know the impact.

Roles information security

Future roles in information security

We want to feel safe in this brave (and scary) new world we’re creating of machines, robots and artificial intelligence. Technological & political trends will definitely influence our profession. This new world will call for new jobs with new skillsets that address the future challenges ahead. Not only the role of CEO and CFO will change due to tech dominance in business also the role of the security officers and risk and security leaders will change. Zukin et all (2018) state “A broader skillset, including communication, change management, and leadership, is required in order to respond quickly and collaboratively to evolving cyber threats” (1)

Yuri bobbert

How to keep your business safe in a digital world?

In our society more and more devices are connected to the internet. These so called Internet of things (IoT) devices are everywhere and most of the time equipped with software. Root cause analysis of cyber-attacks reveal poor-coded software in these devices. And yes, hackers use vulnerable software to misuse these devices for hacks or attacks that have severe impact on organizations and society.