A stakeholder is any person or group that is affected by, or can influence, an organization’s activities. In cyber security, that includes employees, customers, suppliers, partners, regulators, investors, and sometimes the wider public. Stakeholders are not just “audiences” for security teams; they shape how systems are used, what data must be protected, and how risk decisions are made.
This term matters because many attacks exploit stakeholder relationships rather than code alone. Phishing targets employees, supply-chain compromises abuse trusted vendors, and social engineering relies on authority or urgency inside an organization. Defenders use stakeholder analysis to set access controls, define incident-response communications, assess third-party risk, and decide which data deserves the strongest protection. Clear stakeholder mapping also helps security teams balance business needs with compliance and privacy obligations, instead of treating security as only a technical problem.