Poland has become the third most frequently attacked country in Europe by groups linked to foreign states. According to data from the latest Microsoft Digital Defense Report, cyber threats have ceased to be a distant technological risk and have become a direct challenge to the continuity of business and public institutions. The key conclusion from the debates at this year’s European Economic Congress is unambiguous: treating cyber security solely as a problem for the IT department is today the biggest strategic mistake of a modern organisation.
The scale of digital operations is growing at an unprecedented rate. Microsoft now analyses more than 100 trillion security signals per day, an increase of 28 per cent per year. At the same time, the activity of Russian groups targeting Poland and other NATO countries has increased by a quarter. The aims and tactics of the aggressors are also changing. Colonel Pawel Doniec of the Cyber Defence Forces Component Command points out that attacks are increasingly bypassing the heavily protected military infrastructure, hitting its civilian surroundings – logistics companies, suppliers and business partners involved in handling arms transport.
What’s more, criminals are less likely to look for vulnerabilities in software. Instead, they are buying stolen identities on the darknet, manipulating employees and using artificial intelligence to create precise phishing campaigns. Another challenge is operations designed to deliberately overload and distract defence teams before the actual strike.
In this reality, the traditional management structure in companies is failing. Expert Piotr Ciepiela notes that many of the most serious ransomware incidents affect organisations where the same person is responsible for both IT infrastructure and cyber security at the same time. This state of affairs is not due to a lack of staff competence, but to an omission at management level, which has failed to separate security as an independent strategic division. When IT’s operational goals – oriented towards speed and flexibility of solution deployment – collide with the rigours of data protection, the lack of independent oversight makes the task easier for attackers.
Examples from the public sector show that mature institutions are completely redefining the concept of risk. Sławomir Wasielewski of the Social Insurance Institution emphasises that protecting systems is not a technological cost, but a condition for social stability and a guarantee of continuity of benefit payments. Although the amendment to the National Cyber Security System Act, which is coming into force and implements the EU’s NIS2 directive, obliges the market to monitor threats systemically, legal regulations alone will not replace operational preparedness.
The ultimate responsibility rests with business leaders. Krzysztof Malesa, director of security strategy at the Polish branch of Microsoft, reminds us that at the core of every incident is a human being, and building resilience requires continuous work on board awareness. Organisations that understand this challenge in advance will gain stability; others will only learn an extremely costly lesson in response to a crisis.
