More than 85 percent of companies experienced a cybersecurity incident in the past year, and the number of personal data breach notifications has exceeded 22,000 annually. Experts at the CYBERSEC EXPO & FORUM in Katowice warned that the biggest challenge is no longer technology, but the human factor, organizational culture, and a lack of investment in education.
The growing number of attacks, increasingly sophisticated methods used by cybercriminals, and the rapid adoption of artificial intelligence make cybersecurity one of the most critical business challenges. A report by ESET and DAGMA Bezpieczeństwo IT, which served as a starting point for the panel discussion “Cyberportret polskiego biznesu 2026,” shows that 85 percent of firms have faced a security incident in the last 12 months, and nearly half of experts observe a year-on-year increase in attacks. Meanwhile, 62 percent of employees already use AI-based tools in their daily work, yet only a small fraction of organizations have formal rules governing their use.
Marcin Dudek, head of CERT Polska at NASK, noted that most organizations already have threat detection tools but fail to analyze alerts or assign responsibility for action. – Today we no longer have a technology problem. Technologies are available. The issue is whether someone knows how to use them, understands the risks, and whether the organization can respond appropriately – he said.
The human factor and organizational culture
Although employees are often called the weakest link in cybersecurity, panel participants tried to reverse this narrative. – The human is not the weakest link. The human is the strongest. A computer cannot solve a problem on its own. A person can make a mistake, but only a person can also fix it – argued Andrzej Dulka, president of the Polish Chamber of Information Technology and Telecommunications.
However, experts stressed that employees must receive proper support. The report reveals that only 48 percent of staff say they know the procedures in case of a cyber threat, and 58 percent have not participated in a security training session for at least five years. Agnieszka Ulanowska, director of internal supervision and IT security at VeloFunds TFI and ISACA Warsaw Chapter, pointed out that the problem is a culture of fear. – If an employee fears consequences, they will not report mistakes or suspicious situations. They must be sure the company will help solve the problem, not look for someone to blame. Only then can the employee become a real first line of defense – she said.
Rising threats and the role of artificial intelligence
From CERT Polska’s perspective, the most painful threats for businesses remain Business Email Compromise, ransomware attacks, and data breaches. Mirosław Wróblewski, president of the Personal Data Protection Office (UODO), noted that the number of personal data breach notifications has risen from about 10,000 to over 22,000 annually. – We see a very clear increase in cases related to organizational and technical security measures and personnel preparedness. This trend is observed not only in Poland but across Europe – he said, adding that many organizations still try to hide incidents. – Sweeping problems under the carpet does not work. Information eventually comes out, and the consequences are much more serious – he warned.
Artificial intelligence is becoming a new source of threats, especially through employees’ willingness to bypass company policies to use favorite tools. The report indicates that over one-third of AI users would be ready to override corporate restrictions. Paweł Jurek, business development director at DAGMA Bezpieczeństwo IT, said this shows a growing tension between efficiency and security. – Companies invest in technology, but still too little in people. We need training for employees, boards, and IT specialists. Cybersecurity is no longer solely an IT department issue. It is a matter of managing the entire organization – he summarized.
Investment in education as a key priority
According to the speakers, the biggest mistake businesses make is postponing cybersecurity measures. Organizations often find money for new projects and technology investments, but employee training is pushed to the back burner. – Yet it is precisely the lack of knowledge and personnel preparedness that is becoming one of the main sources of risk – concluded Wróblewski. Building a resilient company requires teamwork and an environment where workers are not afraid to report errors and suspicious situations. The panelists agreed that education and culture, not new software, are the critical factors that will determine whether a company can withstand the next cyberattack.
Źródło: WNP.PL, Fot. PTWP
