The operational risk associated with attacks on a web application should be owned by the individual in charge of:

Network operations manages network infrastructure, which is a component but not the ultimate owner of the application's operational risk.

The cybersecurity function advises on, manages, and mitigates security risks, but the ultimate ownership of the operational business risk lies with the business unit.

Application development is responsible for building and maintaining the application securely, but the operational risk of the application in production rests with the business function.

The business function, often represented by the business owner or product owner, is ultimately responsible for the operations, revenue, and reputation associated with the web application and the business process it enables. Therefore, they own the operational risk, including the impact of security incidents, and are responsible for defining the acceptable risk levels.