Companies in Central and Eastern Europe (CEE), including Romania, prioritize “traditional” risks, i.e. economic instability, geopolitical situation and macroeconomic instability, to the detriment of digital, technological or cyber risks (such as ransomware, piracy and tracking), respectively to the PwC Digital Trust Insights Survey 2024. Only 27% of CEE companies prioritize digital and technology risks, compared to 51% globally, and 37% place high importance on cyber risks, compared to 43%. Instead, 47% of respondents consider macroeconomic volatility a priority (compared to 41% globally).

“Although they consider them alarming and have a strong impact on operations, companies in our region, including Romanian ones, still do not prioritize digital, technological and cyber risks. However, in recent years they have made significant strides in increasing and investing in cyber security. However, budgets will have to be increased both in the context of the increase in the number and complexity of cyber-attacks, and in the context of the European Union rules on strengthening the resilience of critical infrastructure to a number of threats, which increase the requirements for companies’ security systems,” said Mircea Bozga, partner in the risk audit department of PwC Romania.

When assessing cyber threats of concern in the next 12 months, the majority of CEE companies (44%) point to hacking and data breach operations, compared to a global average of 37%, highlighting the regional focus on data protection.

The consequences of a cyberattack that most CEE respondents worry about (54%) are the loss of customer, employee or transaction data, which is close to the global average (52%). Concerns about damage to a company’s brand, including loss of customer trust, are almost identical: 49% in CEE and 50% on average globally.

Increase your investment budgetnecessity

At the budget level, companies in Central and Eastern Europe appear to be looking for ways to increase investments in cybersecurity. Currently, there is disparity and uneven investment in cybersecurity solutions, tools, and training.

Only 7% of respondents (vs. 10% globally) expect a significant increase in investment budgets of more than 15%, and 21% of organizations expect budget increases of 6-10% (vs. 31% globally). Meanwhile, 23% of respondents in the region plan to keep their cyber budgets unchanged, compared to 9% globally and in Western Europe.

Interestingly, a significantly higher number of ECE participants reported a lack of awareness of the cyber budget.

Over the next 12-18 months, companies in the region will pay more attention to network security (40%), surpassing the global average of 28%, indicating a strong commitment to strengthening core infrastructure. In addition, organizations prioritize cloud security (34%) and identity and access management (30%) slightly higher than their global peers (33% and 21%, respectively).

In addition, in the budget category, most CEE companies expect increased compliance costs (globally: 75%). In general, the European Union is paying quite a lot of attention to this aspect, given the requirements of the NIS2 / DORA / Cyber ​​​​Resilience Act, which requires a high level of maturity and transparency regarding cyber practices.

Codes on using AI to detect cyber threats

Innovations are focused on better detection of existing cyber threats and improved security functions to compensate for the shortage of specialists and optimize costs. When we talk about innovation, artificial intelligence plays an important role in the fight against cyber attacks. The CEE region lags behind the world average in implementing cybersecurity initiatives and realizing their benefits. The use of large language models (LLM) and generative artificial intelligence for risk detection and mitigation is only 9% compared to 21% globally. In addition, 20% of CEE respondents do not plan to implement these initiatives, compared to 7% of respondents globally.

Article supported by PwC Romania