Hans de Vries, director of cybersecurity and operations at the European Union Agency for Cybersecurity (ENISA), points to three critical actions that organisations must take in the immediate aftermath of a cyberattack: secure systems and gather evidence, report the incident to authorities, and notify all affected parties. The speed and precision of these steps can determine whether a company survives the breach or succumbs to its consequences.
In an interview with WNP, De Vries warned that advancements in frontier AI models are shortening the window between vulnerability discovery and exploitation. These models can detect zero-day flaws faster than ever before, making public safety a real concern. He stressed that cybersecurity can no longer be treated as a one-time investment but must become a continuous process woven into the fabric of the organisation.
The growing threat landscape, fuelled by AI-generated phishing attacks and automated exploits, leaves no room for hesitation. Companies that have practiced incident response scenarios and prepared business continuity plans are far more likely to weather a crisis. De Vries underlined that the weakest link remains human competence, not technology.
Three steps to take in the first minutes
According to De Vries, the moment an organisation detects a breach, the clock starts ticking. The first priority is to secure all affected devices and networks to prevent further damage. Simultaneously, teams must begin gathering digital evidence – screenshots, error messages, logs – that will later support forensic analysis and legal proceedings.
– Rapid reporting of the attack helps experts address the problem sooner and stop additional harm. It also ensures you receive the advice and support needed to restore operations effectively – explained Hans de Vries.
The third step is to inform all stakeholders whose data or systems may be compromised. This includes customers, partners, and regulators. De Vries emphasised that timely communication builds trust and enables a coordinated response across the entire digital ecosystem.
Building a culture of cyber resilience
Cybersecurity is not a single technology or tool – it depends on three equal pillars: technology, people, and processes. Even the most advanced defences fail if employees lack skills or if procedures are unclear. Conversely, well-trained teams cannot succeed without adequate technological support. Organisations must invest all three elements in tandem.
De Vries called for a “secure-by-default” and “secure-by-design” approach to products and services, where security is embedded from the start rather than added later. He also highlighted the need for continuous improvement. – Resilience is an ongoing process, and we must constantly strive to maintain, improve, and adapt it to the changing landscape of threats, policies, and technologies – he said.
To help bridge the skills gap, ENISA has developed the European Cybersecurity Skills Framework, defining roles and competencies. De Vries urged companies to use this framework, especially when implementing the NIS2 Directive. – Defining roles and responsibilities in cybersecurity is essential – he added. He also recommended regular cyber exercises at local, national, and EU levels as tools to build technical and operational capabilities.
Źródło: WNP.PL, Fot. Markus Spiske/Unsplash; Scott Graham/Unsplash
