The Human Factor

According to the IBM* report on the cost of a data breach, around 20% of threats are internal. These threats can occur accidentally, such as sending confidential information to the wrong recipients or falling victim to phishing attacks via email. On the other hand, there are malicious insider threats involving intentional actions, such as data theft or granting unauthorised access.

Mitigating these risks requires ongoing training of employees in good security practice, monitoring of suspicious behaviour and the promotion of an organisational culture centred on responsibility and compliance with security standards. The human factor remains one of the weakest links in cybersecurity, so it is crucial to address it seriously.

*(https://www.ibm.com/reports/data-breach)

Ransomware as a Service (RaaS)

Ransomware remains one of the biggest threats to digital security. Criminal groups offer "ransomware as a service" (RaaS) tools, allowing even individuals with little technical knowledge to carry out attacks. These groups operate like structured companies, with a "customer support department" for the cybercriminals ("customers") who rent their infrastructure, facilitating extortion on a large scale.

According to Sophos's The State of Ransomware in Healthcare 2024 report*, 67% of healthcare institutions worldwide were affected by ransomware this year, up from 60% the previous year. Response times have worsened, given the nature of the attacks, and a full recovery of operations can take months.

A very common myth about cyber attacks is that everything is resolved as soon as operations return to normal. However, detailed forensic analysis should be considered, as it is extremely important for identifying and mitigating the vulnerabilities that were exploited.

*(https://www.sophos.com/en-us/whitepaper/state-of-ransomware-in-healthcare)

The Sense of Security with NIS2 Coming into Force

The European Union's NIS2 directive aims to establish a higher standard of cybersecurity, promoting best practice among organisations. However, implementing these standards, directives and frameworks requires investment in technology, training for employees and senior management, and the adaptation of internal processes.

Striking a balance between compliance, processes and investment is a challenge. The right balance will allow smaller companies to meet all legal requirements without compromising their capacity for growth and innovation. Even so, implementing security standards should be seen as a long-term strategic investment rather than an operating cost. It is essential that companies are not tempted to adopt a minimalist approach to cybersecurity, limiting investment to the bare minimum. Such a stance could leave them vulnerable to increasingly sophisticated and complex threats. The key to an effective approach lies in an investment model that is sustainable yet robust, capable of mitigating risks efficiently and protecting the organisation without compromising its financial health.

Although NIS2 is not a definitive solution to every cybersecurity challenge, it represents a significant step forward in creating a safer business environment. Sectors with greater exposure remain priority targets for cybercriminals. Nevertheless, the standardisation of security practices creates a more solid foundation for mitigating risks and strengthening the business ecosystem.

Cybersecurity is therefore a constantly evolving field, where preparedness and resilience are the best defences against increasingly sophisticated and accessible threats.