The new pressure on European CISOs
Cyber resilience has become the defining priority for security leaders across Europe, and Italian companies are among those feeling the shift most acutely. For years, the conversation in boardrooms revolved around compliance: tick the boxes, pass the audit, file the documentation. That era is ending. Regulators, insurers and customers now want proof that a business can absorb an attack and keep operating, not just proof that it followed a checklist.
The trigger for this change is partly technological. Attackers have adopted artificial intelligence faster than most defenders, using it to write convincing phishing messages in flawless Italian, clone voices for fraudulent payment requests and probe networks for weak credentials at machine speed. The result is a threat landscape where the old assumption (that small and medium businesses are too minor to target) no longer holds.
For the CISO of a mid-sized Italian manufacturer or professional services firm, this creates a difficult position. Budgets have not grown at the pace of the threat, yet expectations have. Understanding what cyber resilience actually requires, and what it does not, is the first step toward closing that gap.
What cyber resilience means in practice
Resilience is often confused with prevention. Prevention aims to stop every attack; resilience accepts that some attacks will succeed and focuses on limiting the damage and restoring operations quickly. Both matter, but only one of them is achievable.
Recent European research consistently shows that the average time to identify and contain a breach still exceeds 200 days, and that organisations with tested incident response plans reduce breach costs by a significant margin, often in the range of 30 to 40 percent. Those numbers hold for large enterprises. For an SMB with a small IT team, the recovery gap tends to be wider, because there is less redundancy in both systems and people.
Italian companies are converging on three practical pillars, and they are worth examining individually because each one demands a different kind of investment.
Identity management as the new perimeter
The network perimeter dissolved when work moved to laptops, mobile phones and cloud applications. What replaced it is identity: the credentials that let a person or a service access company data. Most successful intrusions today do not involve exotic exploits. They involve a stolen or guessed password.
Multi-factor authentication remains the single highest-return control an SMB can deploy, and it is now expected by most cyber insurance underwriters. Beyond MFA, the meaningful step is reviewing privileges: who has administrator rights, which accounts belong to former employees, and which service accounts have passwords that have not changed in years. This kind of housekeeping costs almost nothing and removes a large share of practical risk.
Conditional access policies add another useful layer. If an account normally logs in from Milan during business hours and suddenly authenticates from another continent at three in the morning, the system should challenge or block that session automatically.
Asset visibility: you cannot protect what you cannot see
The second pillar is knowing what you own. It sounds basic, and yet asset inventory is where most SMB security programmes quietly fail. Shadow IT, forgotten test servers, unmanaged personal devices and legacy machines running unsupported operating systems all sit outside the protection you believe you have.
A credible inventory covers hardware, software, cloud subscriptions and the data each system holds. It should be updated continuously rather than annually, because environments change every week. Once the inventory exists, patching priorities become obvious instead of arbitrary, and vulnerability management stops being guesswork.
For companies building this capability from scratch, a structured approach to cybersecurity that combines discovery tooling with periodic assessment is usually more effective than buying another point product.
Recovery: the capability nobody tests until it is too late
Backups exist in almost every company. Tested, isolated, rapidly restorable backups exist in far fewer. The distinction matters enormously, because modern ransomware operators specifically hunt for backup repositories before they encrypt anything else.
The practical standard is the 3-2-1-1 model: three copies of data, on two different media, one stored offsite, and one immutable or offline. Immutability is the element most often missing, and it is the one that determines whether a ransomware incident becomes an inconvenience or an existential event.
Equally important is the restore test. A backup that has never been restored is a hypothesis, not a control. Running a full recovery exercise at least twice a year reveals dependencies nobody documented, licence keys nobody stored and recovery times far longer than management assumed.
How AI is changing the risk equation
Artificial intelligence has changed both sides of the security equation, but not symmetrically. Attackers benefited first, because their use case is simpler: generate more convincing lures, at higher volume, in more languages.
Business email compromise illustrates the shift clearly. Generative tools have removed the linguistic errors that once made fraudulent messages easy to spot, and voice cloning has made phone-based verification less reliable than it was. European law enforcement bodies have repeatedly flagged deepfake-enabled fraud as one of the fastest-growing categories of financial crime, with individual incidents costing companies millions.
There is also a second category of AI risk that has little to do with attackers: exposure created by a company’s own use of AI tools. Employees paste customer data, contracts and source code into public chatbots, often with no policy in place and no record of what left the organisation. Under GDPR, this can constitute an unauthorised transfer of personal data, with the accountability sitting squarely on the employer.
What defenders gain
On the defensive side, AI delivers real value in areas humans handle poorly: correlating large volumes of log data, spotting anomalous behaviour patterns and reducing the noise that overwhelms small security teams. Managed detection services built on these capabilities give an SMB something close to enterprise-grade monitoring without an enterprise-grade headcount.
The caveat is that AI-driven tools require tuning and human judgement. An alert nobody reviews provides no protection. This is why many mid-sized European companies now combine automated detection with an external partner who handles triage and response, rather than attempting to build a 24/7 capability internally.
The regulatory picture in Europe
Compliance has not disappeared, it has become more demanding. NIS2 has significantly widened the population of companies subject to formal security obligations, pulling in mid-sized firms across manufacturing, food production, waste management, digital services and logistics that previously fell outside regulatory scope.
The directive introduces requirements around incident reporting timelines, supply chain security and, critically, management accountability. Company directors can be held personally responsible for failures in cybersecurity governance, which has changed how seriously these discussions are taken at board level in Italy and across the EU.
DORA applies parallel obligations to the financial sector and its technology suppliers, while the AI Act adds a further layer for organisations that develop or deploy AI systems in higher-risk contexts. For a European SMB, the practical consequence is that security posture is increasingly a commercial requirement: larger clients now audit their suppliers, and failing that audit costs contracts.
Where SMBs should start
Given limited budgets, sequencing matters more than ambition. A realistic first year focuses on the controls with the highest ratio of risk reduction to cost.
Start with MFA everywhere, endpoint detection and response on all devices, immutable backups with tested restores, and a written incident response plan that names who does what in the first hour. Add structured security awareness training, because phishing remains the entry point in the large majority of incidents, and AI-generated lures have made human judgement harder to rely on.
From there, move to asset inventory, vulnerability scanning and supplier risk review. These take longer to implement but become the foundation for NIS2 evidence and insurance renewals. Companies that need help structuring this progression often find it useful to work with an external partner who can map the technical roadmap against regulatory deadlines, which is a core part of our managed IT services.
Turning resilience into a business advantage
The final point is commercial rather than technical. Resilience is increasingly visible to customers, partners and insurers, which means it can differentiate a company rather than merely protect it.
An SMB that can demonstrate tested recovery procedures, documented governance and a clear incident response process wins tenders that competitors lose. It also negotiates better insurance terms, because underwriters price risk on evidence of controls, not on promises.
The pressure on CISOs and IT managers is real, and it will not ease. But the response does not require an enterprise budget. It requires clear priorities, honest testing of what already exists, and a willingness to treat security as an operational discipline rather than a documentation exercise. Businesses that want to discuss where their own gaps sit can get in touch with our team for a practical assessment.