Cyprus businesses urged to treat cyber risk as boardroom priority

Cyprus businesses are being pushed to treat cyber risk as a boardroom matter rather than an IT problem, as AI-driven attacks, growing dependence on outside technology providers and new EU rules place greater responsibility on senior management. That shift ran through much of the discussion at the 6th Cyber Security Conference in Nicosia this week, where regulators, technology specialists and business executives repeatedly returned to the same point: having policies, procedures and security software is no longer enough. What matters increasingly is whether an organisation can spot an attack, make decisions quickly and keep operating when systems come under pressure. Held at the Hilton Nicosia under the theme “From Compliance to Cyber Resilience”, the conference put the question simply, asking “Can your organisation withstand a cyber incident, and continue to operate?” Opening the conference, former ISACA board member Michalis Kassini, in statements highlighted by local news outlet InBusiness, said that “cybersecurity had long since stopped being simply a technical obligation or a matter of regulatory compliance.” Instead, he linked it directly to leadership, board accountability, business continuity and customer trust, while pointing to the growing number of European rules changing the way companies are expected to manage digital risk. That responsibility is already reflected in the EU’s NIS2 Directive, under which the management bodies of essential and important entities must approve cybersecurity risk-management measures and oversee their implementation. Board members are also required to receive training enabling them to understand and assess cyber risks. Communications Commissioner Marios Pieri, meanwhile, presented findings from cybersecurity maturity assessments carried out in Cyprus. The organisations examined recorded an average maturity score of just 1.6 out of 3, while 49 per cent of the required security controls remained at an initial or fragmented stage. The weaknesses were not confined to technology. According to Pieri, important gaps remained in governance, risk management and identity and access management. Between June and August alone, the national CSIRT also dealt with 544 malicious electronic addresses, with attacks affecting sectors including energy, healthcare, telecommunications and public administration. The wider European picture points to similar pressures. The latest ENISA Threat Landscape examined 4,875 incidents between July 2024 and June 2025, with public administration emerging as the EU’s most frequently targeted sector, accounting for 38.2 per cent of incidents. Transport followed at 7.5 per cent, digital infrastructure and services at 4.8 per cent and finance at 4.5 per cent. Distributed denial-of-service attacks accounted for 77 per cent of the incidents analysed, while ransomware was assessed as the most damaging threat. Phishing remained the leading initial route into systems, followed by the exploitation of vulnerabilities. ENISA executive director Juhan Lepassaar has warned that “systems and services that we rely on in our daily lives are intertwined”, meaning disruption in one part of the chain can quickly affect others. That interdependence was also raised by Costas Euthymiou, head of the Regulation, Strategy and Supervision Department at Cyprus’ Digital Security Authority. Euthymiou said “cybersecurity regulation was not simply about protecting servers or data centres, but about the resilience of the services on which everyday life depends, from electricity and water to other critical infrastructure.” He explained that “even somebody who has never used a computer remains indirectly dependent on the digital systems controlling essential services.” Euthymiou also urged companies not to wait before beginning their compliance work, noting that the list of entities falling within the Cypriot regime can change as businesses and their activities evolve. The role of senior management was also addressed by PwC Cyprus manager Christos Menelaou, who said “executives were not expected to become cybersecurity specialists.” They were, however, expected to understand the main digital risks facing their organisation, what the consequences of an attack could be and whether the business was properly prepared to respond. One of the main gaps he continues to see in the market, he said, is that cyber risk either does not reach the boardroom or is still treated largely as a technical matter. Farukh Rakhimov, head of financial and compliance at AdTech Holding, made a similar point, saying “cybersecurity required commitment throughout an organisation, backed by investment both in technology and in the people expected to use it.” For Cyprus’ sizeable financial-services sector, those responsibilities are particularly relevant. The EU’s Digital Operational Resilience Act, or DORA, has applied since January 17, 2025, introducing a common framework for ICT risk across banks, investment firms, insurers and other financial entities. It places ultimate responsibility for ICT risk management with the management body and requires firms to address areas including incident response, resilience testing and third-party technology risk. The regulatory framework is continuing to expand. Most provisions of the EU’s AI Act became applicable on August 2, 2026, although some requirements covering high-risk systems have later deadlines. Under the Cyber Resilience Act (CRA), meanwhile, reporting obligations for manufacturers of products with digital elements began applying on September 11, 2026, just days before the Nicosia conference. The CRA becomes fully applicable in December 2027. At the same time, AI is becoming part of both companies’ cyber defences and the threats they are trying to counter. Constantinos Koumides, president of the ISACA Cyprus Chapter, cited a figure showing that one in three European organisations is unsure whether it has already been hit by an AI-driven cyberattack. While businesses have improved their risk frameworks, technology and controls over recent years, he said the speed at which AI is changing the threat landscape is placing greater pressure on organisations to test whether those controls actually work. That speed was also emphasised by Conal Hickey, vice-president and security and resiliency practice leader at Kyndryl. Hickey told delegates that “the volume of published vulnerabilities in the second quarter of 2026 was 2.7 times higher than a year earlier, while 61 per cent of vulnerabilities which were subsequently attacked had initially been rated below the critical-risk level.” He also referred to a controlled study in which it took less than an hour to develop a working exploit for a browser vulnerability. For security teams, he argued, success should therefore be measured not simply by how quickly a patch is installed, but by how quickly an organisation reduces its actual exposure to a threat. Chief Scientist for Research, Innovation and Technology Demetris Skourides focused on the decisions companies are required to make once an incident is already under way. He raised the example of an attack happening at two in the morning, when somebody within the organisation needs to assess the situation and act immediately. Simply assigning responsibility to an individual is not enough, he said, if that person does not have the knowledge needed to carry out a proper threat and risk assessment. Skourides also raised the risks surrounding companies’ increasing use of AI. Businesses, he said, need to understand which AI models sit behind the applications they use, what might happen if those models are compromised or begin producing incorrect information and how dependent the organisation has become on a particular provider. He also pointed to the issue of supplier dependency and whether businesses have alternatives available if a system or provider becomes unavailable. Those dependencies extend beyond AI. Companies increasingly rely on cloud providers, software companies, outsourced technology services and open-source tools, making third-party and supply-chain risk an important part of their own cyber exposure. The growing speed of attacks was also a central theme in the presentation by Odyssey managed services director Andreas Konstantinides. Konstantinidis contrasted traditional detection and response cycles with AI-assisted attacks capable of beginning the theft of data within minutes. He said “attackers are increasingly able to use autonomous digital agents, with a large part of an attack cycle carried out without direct human involvement.” His presentation focused on the move from traditional security operations centres towards greater automation, with AI used to filter alerts, identify threats and speed up the response process while people retain responsibility for final decisions. Neurosoft Cyprus country manager Ilias Polychroniades also warned against assuming that investment in security tools, certifications and established procedures necessarily means an organisation is properly protected. Businesses can still have exposed internet-facing services, weak user identities, outdated systems, incomplete event logs and security controls which have never been properly tested. Drawing on incidents encountered by the company, he referred to cases involving exposed firewalls, outdated security systems with known vulnerabilities, compromised terminals and unpatched servers accessible from the internet. Attackers themselves are also changing their methods. Joost Nienhuis, channel technical director at Broadcom, said “digital extortion is increasingly moving away from the traditional use of malware.” Instead, some groups are relying on stolen credentials, legitimate system tools and existing vulnerabilities to enter corporate networks and steal data. The approach makes malicious activity harder to distinguish from ordinary use because attackers can operate through software and credentials which an organisation already trusts. Nienhuis also pointed to the role of AI in allowing attackers to adapt their methods more quickly and automate parts of their operations. Alongside changes in the threat itself, companies are also facing a changing technical framework. Cyprus Organisation for Standardisation ICT standards officer Joseph Karis emphasised the growing role of European standards in turning the requirements of legislation such as the CRA and AI Act into technical specifications that businesses and manufacturers can use. The European Commission has requested 41 standards in support of the Cyber Resilience Act, covering both horizontal requirements and product-specific areas. For the CRA, Karis said “work covers common requirements as well as specifications for products including browsers, password managers, malware protection systems and VPNs.” Work linked to the AI Act is meanwhile focusing on areas including data governance, transparency, robustness and cybersecurity for high-risk systems. Compliance with harmonised standards can ultimately give manufacturers a presumption that the relevant legal requirements have been met. The subject will be back on the agenda in Nicosia on September 21, when the Cyprus Organisation for Standardisation (CYS), with the backing of the Digital Security Authority, hosts a conference on the standards being developed to support CRA compliance.