NIS2 2026: 507 serious attacks in Italy, how to manage incident response obligations

Cyber incidents in Italy: +42% in 2025, with 507 serious attacks

The 2026 Clusit Report reveals a record surge in cyber attacks in Italy: 507 serious incidents in 2025, a 42% increase compared to the 357 in 2024. A growth that positions Italy at 9.6% of global attacks, a disproportionate share compared to the country's economic and demographic weight. This trend, combined with the expansion of the NIS2 perimeter, radically transforms the cyber challenge: no longer just "how many attacks we suffer," but "how structured we are to manage them."

Quick Response

The NIS2 revolution: 20,000 organizations under obligation

The NIS2 Directive, transposed in Italy with Legislative Decree 138/2024, extends cyber risk management obligations to 18 essential and important sectors, involving over 20,000 organizations. Many entities, especially medium-sized ones, now have to comply with stringent procedures without having an internal structured incident response function.

Tight deadlines and procedural obligations

As of January 1, 2026, the obligation to notify significant incidents to CSIRT Italy is operational: pre-notification within 24 hours, complete notification within 72 hours, and final report within 30 days. Furthermore, since 2025, the designation of a CSIRT Referent has been mandatory, a figure authorized to interface with the National Cybersecurity Agency during the management of an incident.

Crucial deadline: October 31, 2026

By October 31, 2026, all organizations must have the basic security measures indicated by the ACN Determinations operational. From that date, the Agency may initiate inspection activities, with fines up to 2% of the annual global turnover or 10 million euros for non-compliance. The measures include multi-factor authentication, vulnerability management, backup, and documented incident response procedures.

Corporate management responsibility

Cybersecurity exits the IT perimeter to directly involve corporate management, which must demonstrate that it has approved and supervised an adequate incident management process. Legislative Decree 138/2024 provides for sanctions also against the personal liability of managers in case of non-compliance with governance, risk analysis, and incident management obligations.

The gap between SOC and CSIRT

Many companies with an internal or external SOC do not have a formalized CSIRT function. The difference is crucial: the SOC operates at a technical level, while the CSIRT coordinates, qualifies, and communicates externally and to management. This gap creates procedural vulnerabilities and significant sanction risks.

CSIRT as a Service: the structured response

Axitea's CSIRT as a Service service is designed to fill this gap. It externalizes the CSIRT Referent function in compliance with ACN indications, supporting companies with a dedicated team that follows the incident from detection to notification to authorities and support to administrative bodies. The service integrates with existing structures, adding coordination, traceability, and compliance.

Integrated approach for complete management

The proposed model covers the entire timeline of the incident, from organizational prevention to capitalization of experience. The preliminary phase defines roles, responsibilities, and incident response processes consistent with the company's operational model and regulatory obligations. When an event occurs, the team assumes the role of Incident Coordinator, analyzing the nature and impact of the incident and coordinating containment, mitigation, and restoration actions.

Legal and regulatory assessment

Each incident is also evaluated from a legal and regulatory perspective, with particular attention to notification obligations and the tight deadlines set by the legislation. This is where the risk of procedural error and therefore sanction is highest for organizations acting without a dedicated oversight.

Post-incident analysis for structural improvements

Once the event is closed, the post-incident analysis serves to formulate concrete recommendations to strengthen security controls and increase the organization's overall resilience. This approach transforms an incident, properly managed, into a structural improvement rather than an isolated event.

Axitea's strategic vision

Giorgio Triolo, CTO of Axitea, emphasizes: "CSIRT as a Service was born from a concrete observation: Italian companies face a growing level of risk, with regulatory deadlines and management responsibility sanctioned by law. For years, companies have assessed cyber maturity on the ability to prevent attacks. With NIS2, it is equally important to demonstrate the ability to manage them."

A concrete operational requirement

As the October 31, 2026 deadline approaches and ACN enters the inspection phase, the structured management of incidents ceases to be a theoretical exercise to become a concrete operational requirement. For organizations without internal specialized incident coordination skills, externalizing the function represents a viable path to meet regulatory obligations prepared.

The evolution of the managed services market

The positioning of the CSIRT as a Service service builds on Axitea's experience in integrated security and the synergy with Security Operation Center services. The goal is to read the incident not only in technical terms but also in its operational, economic, and reputational implications. This approach reflects the direction taken by the managed cybersecurity services market in response to NIS2.

Solutions for NIS2 compliance

For organizations that need to comply with NIS2 obligations, the CSIRT as a Service represents a complete solution. Explore our NIS2 compliance guide to better understand regulatory obligations and adaptation strategies.

The future of cyber incident management

Structured management of cyber incidents is set to become a central element of organizations' security strategy. With the increase in attacks and the intensification of regulatory obligations, companies that invest in solutions like CSIRT as a Service will be able to turn legal obligations into concrete operational advantages.