Warding off a cyberattack is no longer just an IT matter. Organizations can also take significant action at an organizational and strategic level to reduce downtime.
“There are two types of companies: those that have been hacked, and those that will be,” begins Christophe Van Bortel, Head of the Antwerp Computer Crime Unit. This world-famous quote from former FBI Director Robert Mueller rings closer to the truth after every cyberattack. The question is not if, but when your company will be hit by a cyberattack.
“Victory goes to those who learn the fastest,” said Theo Francken at the start of the Cybernova event in Antwerp. He called on cyber experts to join the Cyber Force as reserve officers.
Not only must companies remain cyber-resilient and keep reinventing themselves, but we must also not lose sight of the organizational aspect. Today, cybersecurity is more than just a technical conversation.
Clicking is not the problem
“Let’s stop blaming the end user for a cyberattack,” argues Mikko Hyppönen, Chief Research Officer at WithSecure, during his keynote at the Cybernova event in Antwerp. “People make mistakes. A ‘stupid user’ clicked the wrong link, opened the wrong file, or fell for a phishing attack and lost their login credentials. I hate these sentences,” he continues.
“It is totally unfair to demand that everyone be a security expert. If a link appears that the user absolutely should not click on, why does it appear on their screen at all?”
He is convinced that we should not place the responsibility on the end user, but instead shift it to operating system manufacturers, security vendors, and telecom companies.
Are you prepared?
When malicious actors do manage to penetrate a system via ‘the weak link’ or another route, an organization can still do a lot to, for example, keep downtime to a minimum and limit the damage. However, this expected digital readiness is often not in line with actual readiness.
According to figures from Dell, 99.5 percent of surveyed companies say they have a cyber strategy. Only 57 percent of them were able to recover successfully during a (test) incident. “In addition, 63 percent believe that management overestimates their readiness for a major cyberattack,” also known as resilience debt. This is the gap between how executives assess their readiness and the actual readiness on the work floor,” explains Koen André Segers. He is Cybersecurity Lead & Global Field Tech Office at Dell Technologies.
That is where the greatest danger lies, according to him. “When does the risk surface? The moment you undergo an attack.”
Assessing the damage
The fact that the actual readiness of companies during a cyberattack is still too low is also evident from figures from the Federal Judicial Police. In 2024, 164 ransomware attacks were reported. “That’s an average of three per week,” says Bjorn Clevers, Head of the Cybercrime Team at the Federal Judicial Police of West Flanders.
50 percent of Flemish companies became victims of a cyberattack in 2024. Ten percent of these attacks were successful, which corresponds to 37,000 companies. “The financial damage per attack varies from one hundred thousand euros to 100 million euros. The total damage in Belgium in 2024 ranged from 14.6 million to 14.6 billion euros.”
More than an IT problem
When a cyberattack occurs, people often immediately look at technical problems, even though companies also run into many other obstacles. On the sidelines of the cyber event, Segers lists the most common shortcomings of companies when they are hit by a cyberattack.
Cyber resilience is a strategic business responsibility, more than a technical concern.
Koen André Segers, Cybersecurity Lead & Global Field Tech Office at Dell Technologies
“The biggest stumbling block is the lack of a well-documented and tested incident response plan. Companies that don’t have such a plan have to make decisions under enormous stress, which almost always leads to mistakes and precious loss of time.”
In addition, many companies do not know which systems they consider critical and what the interdependencies are, causing recovery to take much longer than necessary. Furthermore, they don’t know who to call at the time of the attack because they haven’t designated recovery partners in advance. Or they have, but the contact details are only on SharePoint, which is now encrypted along with everything else.
Internal communication also tends to go wrong under stress because tasks haven’t been assigned and there is no clarity on who is allowed to make decisions. In short, “cyber resilience is not an IT problem, but a strategic business responsibility that must be addressed at the highest level, preferably well before an attack takes place,” says Segers.
Furthermore, a recent report from Palo Alto Networks shows that the majority of cyber breaches are not the result of technological shortcomings, but of operational choices within organizations. In particular, the lack of consistent identity management and limited monitoring play into the hands of cybercriminals.
Organization and strategy
Segers does not mean to say that technical solutions are unimportant, although the real challenges lie at the organizational and strategic level. He lists several recommendations that can already make a big difference:
- Keep a physical copy of the incident response plan: during an attack, digital systems may be inaccessible.
- Designate recovery partners in advance and contact them proactively: this way, you don’t lose precious time searching for who to call at the worst possible moment.
- Ensure centralized monitoring of all systems: this allows forensic investigations after an attack to proceed much faster.
Geert Baudewijns, CEO of Secutec and experienced negotiator with cybercriminals, has one additional tip: “Do NOT store your cyber insurance details digitally, otherwise hackers will know exactly how well you are insured and for what amount.”
Of all times
“Cybercriminals are just like other criminals; they will always be there. It’s something that has existed throughout time,” says Hyppönen. We cannot change anything on the attacker’s side, but we can change our line of defense. Not only must your cybersecurity systems be up to date and evolve, but your company must also be prepared organizationally.
The question is not if you will be hit by a cyberattack, but when. The focus should be on strengthening cyber resilience rather than pointing fingers. If we want to change the world, technology is the best way to do it,” Hyppönen concludes.