More than 85 percent of companies experienced a cybersecurity incident in the past year, and the number of personal data breach reports has exceeded 22,000 annually. – Companies invest in technology, but still too little in people. We need training for employees, boards, and IT specialists – said Paweł Jurek, business development director at DAGMA Bezpieczeństwo IT, during a debate at CYBERSEC EXPO & FORUM.
Experts at CYBERSEC EXPO & FORUM in Katowice warned that the biggest challenge is no longer technology, but people, organizational culture, and the lack of investment in education. The growing number of attacks, increasingly sophisticated methods used by cybercriminals, and the rapid spread of artificial intelligence make cybersecurity one of the most important business challenges.
The discussion was based on a report by ESET and DAGMA Bezpieczeństwo IT. It shows that 85 percent of companies have experienced a cybersecurity incident in the last 12 months, and nearly half of experts observe an increase in attacks year over year. At the same time, 62 percent of employees already use AI-based tools in their daily work, while only a small fraction of organizations have formal rules governing their use.
From technology to people
– We no longer have a technology problem. Technologies are available. The problem is whether someone knows how to use them, understands the threats, and whether the organization can respond appropriately – stressed Marcin Dudek, head of CERT Polska at NASK. He pointed out that most organizations already have threat detection tools. The issue arises when no one analyzes the alerts they generate or feels responsible for taking action.
From the perspective of CERT Polska, the most damaging threats for businesses are three types. First, Business Email Compromise fraud, which involves taking over business correspondence and persuading companies to make transfers to fake bank accounts. Second, ransomware attacks that encrypt data and demand a ransom. Third, breaches that lead to data leaks. – We handle several ransomware incidents a week. These are situations where the organization’s operations are paralyzed and companies face the threat of data publication – Dudek said.
The growing scale of the problem is confirmed by data from the Personal Data Protection Office (UODO). President Mirosław Wróblewski noted that the number of reports concerning personal data breaches increased from about 10,000 to over 22,000 annually. – We see a very clear increase in cases related to organizational security, technical security, and staff training. This trend is observed not only in Poland but across Europe – he said. He also warned that many organizations still try to hide incidents. – Sweeping problems under the rug does not work. Information eventually comes out anyway, and the consequences are then much more serious – he added.
The AI challenge and the culture of fear
One of the most interesting threads of the debate was the role of employees. Although for years it has been repeated that humans are the weakest link in cybersecurity, panelists tried to reverse that narrative. – Man is not the weakest link. He is the strongest. A computer cannot solve a problem alone. It is a human who can make a mistake, but only a human can also fix it – argued Andrzej Dulka, president of the Polish Chamber of Information Technology and Telecommunications.
However, experts pointed out that the employee must receive appropriate support. The report shows that only 48 percent of employees say they know the procedures for handling a cyber threat, and 58 percent have not participated in a security training for at least five years. According to participants, the biggest mistake businesses make is postponing cybersecurity actions. UODO president Mirosław Wróblewski noted that organizations often find money for new projects or technology investments, but employee training is pushed to the back burner. – It is precisely the lack of knowledge and staff preparation that becomes one of the main sources of risk – he stressed.
Agnieszka Ulanowska, director of internal audit and IT security at VeloFunds TFI and ISACA Warsaw Chapter, said the main problem is an organizational culture based on fear. – If an employee is afraid of consequences, they will not report mistakes or suspicious situations. They must be sure that the company will help them solve the problem, not look for someone to blame. Only then can they become a real first line of defense for the organization – she emphasized.
A new source of threats is artificial intelligence, especially the willingness to use it to complete tasks faster, even if company policy imposes restrictions. The report shows that more than one third of AI users would be willing to bypass company restrictions to continue using their favorite tools. According to Paweł Jurek from DAGMA Bezpieczeństwo IT, this shows a growing tension between the need for efficiency and security requirements. – Companies invest in technology, but still too little in people. We need training for employees, boards, and IT specialists. Cybersecurity is no longer a matter for the IT department. It is an element of managing the entire organization – he concluded.
Źródło: wnp.pl, Fot. PTWP
