Italy under attack: +12% of cyber threats in 2023

Cyberattacks in Italy increased by 12% in 2023 compared to the previous year, with 69% of threats attributable to cybercrime. This alarming data emerges from the Clusit Report, which places Italy among the most affected countries in the world. The most widespread threat remains ransomware, followed by malware and phishing attacks, with an average cost per victim company approaching 200,000 euros.

Quick Response

  • In 2023, cyberattacks in Italy increased by 12%
  • 69% of attacks are of a cybercriminal nature
  • The most widespread threats are ransomware, malware, and phishing
  • The average cost per affected company is 200,000 euros
  • Only 34% of Italian companies have an incident response plan

ACN: the institutional response to the crisis

In the face of this emergency, Italy has established the National Cybersecurity Agency (ACN), tasked with coordinating the national response. The ACN operates in synergy with the National Cybersecurity Strategy (SNCS), which outlines priority objectives until 2026. Among the most recent initiatives, notable are the allocations for almost 60 million euros in the triennium 2025-2027, as provided by the DPCM of September 30, 2025.

The national cybersecurity perimeter

The governance system for digital security is structured through the national cybersecurity perimeter, which identifies and protects critical infrastructures. Eleven strategic sectors have been defined by DPCM 131/2020, including energy, telecommunications, transport, and digital services. Each sector has its own competent administration, tasked with monitoring the public and private entities essential for the functioning of the State.

The challenge of training and awareness

Despite institutional progress, structural criticalities persist. Only 34% of Italian companies have adopted an incident response plan, while the shortage of qualified personnel remains a serious problem. The improper use of credentials by employees is among the main vulnerabilities, to the point of being included in the national security perimeter with the category ICP-A-20.

The most dangerous threats for Italian companies

Ransomware continues to be the main threat for Italian companies, with increasingly sophisticated and targeted attacks. Among the most widespread variants, LockBit 3.0 and BlackCat stand out, responsible for numerous breaches in 2023. Infostealers, such as RedLine and Raccoon, also represent a serious danger, with a 30% increase in detected attacks over the course of the year.

The crucial role of cyber insurance

In the face of a threatening landscape, cyber risk policies are becoming an indispensable tool for companies. Average premiums for comprehensive coverage range from 5,000 to 50,000 euros annually, depending on the sector and level of risk. However, only 20% of Italian SMEs have taken out cyber insurance, leaving most businesses without adequate protection.

Opportunities for security service providers

The Italian cybersecurity market offers growing opportunities for managed SOC and MDR service providers. According to estimates, the market value will reach 2.5 billion euros by 2026, with an annual growth rate of 15%. Among the most requested services are penetration testing, vulnerability assessment, and breach remediation services.

The challenge of compliance with NIS2 and DORA

Italian companies must face the challenge of compliance with new European regulations. The NIS2 directive, which came into force in 2023, extends security obligations to a greater number of sectors and companies. At the same time, the DORA regulation imposes new measures for digital operational resilience in the financial sector. Companies must invest in SIEM and DLP solutions to ensure compliance.

Future prospects for cybersecurity in Italy

Despite the difficulties, the prospects for cybersecurity in Italy are positive. Investments in critical infrastructures and market growth offer opportunities for the development of skills and advanced technologies. However, to achieve true digital resilience, joint efforts between institutions, companies, and citizens will be needed.

Frequently Asked Questions

What is the average cost of a ransomware attack in Italy?

The average cost of a ransomware attack for an Italian company is 200,000 euros, including recovery costs and indirect losses.

How can I protect my company from phishing?

To protect yourself from phishing, it is essential to invest in employee training and adopt technological solutions such as email filters and two-factor authentication.

Which sectors are most at risk of cyberattacks?

The sectors most at risk include energy, telecommunications, transport, and financial services, due to their critical importance for the functioning of the State.

The skills gap in Italian cybersecurity

The shortage of qualified cybersecurity professionals represents a critical factor for national security. According to the Cybersecurity Observatory of the Politecnico di Milano, at least 10,000 new experts will be needed by 2026 to meet market demand. This skills gap is reflected in the slowness with which Italian companies adopt advanced Data Loss Prevention (DLP) and Security Information and Event Management (SIEM) solutions.

The economic impact of data breaches

The financial consequences of cyberattacks go far beyond the immediate cost of ransomware recovery. A Deloitte study reveals that Italian companies suffer an average loss of 3.2% of annual turnover following a security incident. This includes reputational damage, loss of customers, and penalties for non-compliance with NIS2 and GDPR.

The challenge of identity management

Identity access management (IAM) emerges as a critical area of intervention. 43% of the attacks detected in 2023 exploited vulnerabilities in corporate credentials, according to ACN data. The adoption of zero-trust architectures and institutional custody solutions for critical digital assets has become a priority for national critical infrastructures.

Opportunities for managed services

The Italian market for SOC as a Service and MDR services is rapidly expanding, with an expected annual growth rate of 22%. SMEs represent the segment with the most potential, given that only 15% of them currently use externalized breach remediation services. Costs for a complete MDR service range from 5,000 to 30,000 euros per month, depending on the complexity of the infrastructure.

The complexity of regulatory compliance

Adapting to European regulations presents technical and organizational challenges. 62% of Italian companies surveyed by Clusit reported difficulties in ensuring DORA compliance, particularly regarding disaster recovery as a service (DRaaS) and enterprise backup requirements. The lack of standardization in security audit processes represents a significant obstacle.

The evolution of ransomware threats

Ransomware variants are becoming increasingly specialized. LockBit 3.0, for example, introduced data exfiltration functionality before encryption, increasing leverage in negotiations with targets. BlackCat, on the other hand, has adopted a modular approach that allows attacks to be customized based on the vertical sector. These developments require a more dynamic approach to ransomware protection.

The role of cyber risk policies

Cyber insurance is becoming a strategic tool for risk management. The average cost of a cyber risk policy for Italian SMEs is 7,500 euros per year, with deductibles ranging from 5% to 20% of the premium. However, only 25% of policies include coverage for indirect losses, a crucial aspect for business continuity.

Prospects for investments

The Italian cybersecurity market will attract investments of over 1.8 billion euros in the biennium 2025-2026. Sectors with the most growth potential include institutional crypto custody, AML compliance for exchanges, and crypto asset management. The MiCA regulation could accelerate these trends, creating new opportunities for service providers.

The challenge of continuous training

Employee training represents a strategic investment for corporate security. Costs for ISO 27001 certification courses range from 1,500 to 5,000 euros per participant, with an estimated ROI of 1.8 times the initial cost. However, only 18% of Italian companies have implemented mandatory continuous training programs for employees.

Innovations on the horizon

New technologies are emerging in the cybersecurity landscape. Cloud security posture management (CSPM) solutions are becoming fundamental for companies adopting hybrid models. At the same time, advances in artificial intelligence are improving the detection and response capabilities of SIEM systems, reducing the average time to detect an attack from 203 to 78 hours.

International collaboration

Italy is strengthening international collaborations to counter cyber threats. Participation in initiatives such as ENISA and the cooperation agreement with the FBI for intelligence sharing represent significant steps forward. These efforts could lead to a 15-20% reduction in cross-border attacks by 2027.

Challenges for critical infrastructures

National critical infrastructures face unique challenges. 58% of energy operators interviewed by ENEA reported difficulties in integrating business continuity solutions with legacy systems. This problem is particularly critical for utilities, where 82% of infrastructures are over 15 years old.

Prospects for 2026

By 2026, the Italian cybersecurity landscape could undergo significant transformations. The adoption of zero-trust architectures could reach 45% of large companies, while penetration testing and vulnerability assessment services will become standard for SMEs. However, the skills shortage will remain a critical factor, requiring structural interventions in the education system.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all responsibility for the improper use of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.