'We're a small company, who would attack us?' — we hear this sentence often, and unfortunately the statistics refute it categorically. Automated attacks don't pick victims by size but by vulnerability — and small companies are usually less protected. Meanwhile, the European NIS2 directive has widened the circle of obligated companies and raised the bar for everyone.

What did NIS2 change?

NIS2 covers far more sectors than its predecessor — from transport and energy to digital services and manufacturing — and it also affects the supply chain of large companies. If you are a supplier to a bigger client, you will increasingly see cybersecurity requirements directly in your contracts. Penalties for non-compliance reach millions of euros or a percentage of turnover.

The most common gaps we see

• No two-factor authentication — a single leaked password opens everything.
• Backups nobody has tested — a backup that can't be restored is not a backup.
• Old unmaintained software — sites and systems with known vulnerabilities, waiting for an automated scanner to find them.
• 'Just in case' access rights — employees with access to everything, including former ones.

The practical minimum for every company

The good news: 80% of the risk is covered by basic measures — two-factor authentication everywhere, automated and tested backups, regular updates, role-based access and one team training on phishing. These are not expensive things — they are discipline.

When to seek help?

If you can't answer 'yes' to the questions 'Do we know what data we keep and where?', 'Have we tested restoring from a backup?' and 'Have we passed a vulnerability test?' — it's time for an audit. That is exactly what we do: a review of your systems, a prioritized plan and step-by-step execution that fits your budget.

Cybersecurity in 2026 is not an option but a condition for doing business. The only question is whether you will arrange it in a planned way — or after an incident.