A cyberattack is in 2026 the most probable operational crisis an EU company will face. ENISA statistics and reports from national cybersecurity authorities show that every third mid-sized company in the EU experienced a serious security incident in 2025, and 12% of them suffered a financial loss exceeding 50,000 €. A large portion of these incidents was completely preventable with standard measures at a fraction of the cost of the damage.

This pillar article guides the business owner and IT manager through the entire spectrum of cyber defence — from basic concepts (virus, malware, phishing, ransomware) through concrete technical measures (2FA, SSL, VPN, EDR, backups) to procedural aspects (training, incident response, regulatory notification). Not abstract theory, but concrete steps that work in practice at mid-sized EU companies.

For broader regulatory context, see the pillar Security and Compliance in Cloud ERP 2026, which focuses on ISO 27001, GDPR, NIS2, and DORA.

The Threat Landscape in 2026: What Has Changed

Cyber threats for EU SMBs have qualitatively shifted over the past three years. Before the pandemic, 80% of attacks were opportunistic — automated vulnerability scans, mass phishing campaigns without targeting. Today the picture is different:

  1. Targeted ransomware groups (LockBit, BlackCat, Cl0p) systematically target mid-sized EU companies with revenue of 10–100 million.
  2. AI-generated phishing campaigns can mimic a company’s writing style, a specific manager’s language, and adapt the attack to context — grammatical errors and suspicious URLs are a thing of the past.
  3. Supply chain attacks targeting ICT suppliers affect companies that are not themselves interesting targets.
  4. Insider threats are growing with remote work and higher employee turnover — a former employee with active accounts is a real problem in 2026.
  5. Regulatory pressure (NIS2, DORA, GDPR) increases the cost of failure — to the direct damage are added fines and statutory notification obligations.

For the business owner, this means that cyber hygiene is no longer optional — it is an operational minimum comparable to fire prevention or occupational health and safety.

Threat Dictionary: What Is What

In the media, terms such as virus, malware, ransomware, and phishing are often used interchangeably, but technically they represent different threat classes with different defences.

Malware (Umbrella Term)

Malware (malicious software) is the umbrella term for any malicious code. Under it are:

  • Virus — a programme that spreads by attaching to other files and requires user action (opening). The classic PC virus from the 1990s is today a marginal phenomenon.
  • Worm — self-propagating, needs no host file. Spreads via network vulnerabilities. Example: WannaCry (2017).
  • Trojan — disguised as legitimate software. Once executed, performs a malicious action. The most common entry point into companies.
  • Ransomware — a special type of malware that encrypts files and demands a ransom for the decryption key. The dominant threat in 2026.
  • Spyware — collects data about the user (credentials for other accounts, confidential documents).
  • Rootkit — hides its presence at a deep OS level, often persists even after reinstallation.
  • Keylogger — captures keystrokes, especially passwords and payment card details.

A more extensive overview is in the cluster article Viruses and Malware in Business: How to Defend.

Phishing and Social Engineering

Phishing is an attempt to obtain credentials (typically login) via a fraudulent message — email, SMS (smishing), phone call (vishing), or even social media. The attacker impersonates a trusted entity (bank, IT support, company director).

Advanced variants:

  • Spear phishing — targeted phishing at a specific person with personalised content.
  • Whaling — phishing targeting senior management (CEO, CFO).
  • Business Email Compromise (BEC) — the attacker impersonates a manager’s email and instructs the accountant to transfer money. The average BEC attack loss in the EU in 2025 was 45,000 €.

Infrastructure Attacks

  • DDoS (Distributed Denial of Service) — overloading a website/service with fake traffic. For B2B ERP-using companies this is usually not the primary threat (unlike e-commerce).
  • Man-in-the-middle (MitM) — intercepting network communication. Main risk on public Wi-Fi networks and in poorly encrypted channels.
  • Brute force / credential stuffing — automated password guessing or trying leaked username+password combinations from other services.

Insider Threats

  • Malicious insider — a dissatisfied employee with access deliberately causes damage (data theft, sabotage).
  • Negligent insider — unintentional breach (sending a sensitive document to the wrong address, weak password, clicking on phishing).

According to ENISA statistics, 40% of security incidents involve an insider component, mostly negligent.

Seven Pillars of Corporate Cyber Defence

No single technology suffices. A resilient company builds on seven layers, each addressing a different threat.

Pillar 1: Identity and Authentication

The most common cause of a successful attack in 2026 is not a sophisticated hack but a compromised password. Defence:

  • Password manager for the entire company (1Password, Bitwarden, Dashlane). Generates unique 20+ character passwords, eliminates reuse.
  • 2FA / MFA mandatory for all users, ideally passkey/WebAuthn for critical accounts (admin, finance, HR).
  • Single Sign-On (SSO) via Azure AD, Google Workspace, or Okta — one login point, one audit log, fast deactivation of a departing employee.
  • Principle of least privilege — a user has only the rights they genuinely need.
  • Regular access review (1× per quarter) — who has what access, is it still needed?

A detailed guide to 2FA implementation is in the cluster article Two-Factor Authentication (2FA): Why and How to Deploy It.

Pillar 2: Updates and Patch Management

70% of successful attacks in 2025 exploited vulnerabilities for which a patch had been available for more than 30 days. Disciplined patch management eliminates most of this.

  • Operating systems — automatic updates, monthly cycle for Windows, continuous for macOS/Linux.
  • Applications — especially browsers (Chrome, Edge, Firefox), Office suites, PDF readers, Java/Adobe runtime.
  • Network devices — firewalls, routers, VPN gateways. Often forgotten, often targeted.
  • Specialised software — ERP, CRM, email server, web server. Monthly inspection cycle.
  • End-of-Life (EOL) software — older OS versions, outdated runtime environments. Replace without exception — no patches, full attack vector.

Cloud SaaS solutions (including Modulario) remove this task from the company — the provider patches infrastructure and application continuously.

Pillar 3: Endpoint Protection (EDR)

Classic antivirus from 2010 is insufficient in 2026. Modern endpoints need EDR (Endpoint Detection and Response) — continuous behaviour monitoring, anomaly detection, automatic response.

Difference:

AspectAntivirus (signature-based)EDR (behaviour-based)
Known threat detectionYesYes
Unknown (zero-day) detectionLimitedYes (heuristics, ML)
Forensic data after attackMinimalFull (complete timeline)
Remote endpoint isolationNoYes (1 click)
Cost (annual, per seat)30–6060–180

Recommended vendors for EU SMBs: Microsoft Defender for Endpoint (often included in M365), CrowdStrike, SentinelOne, ESET PROTECT, Bitdefender GravityZone.

Pillar 4: Email Security

90% of targeted attacks begin via email. Without quality email security, everything else is a compromise.

Layers:

  • SPF, DKIM, DMARC — sender authentication, eliminates domain spoofing.
  • Anti-phishing engine — content analysis, URL, attachments. Microsoft Defender for Office 365, Google Workspace Security, Proofpoint, Mimecast.
  • Sandbox for attachments — dangerous attachments are opened in an isolated environment before delivery.
  • URL rewriting — clicks in email route through a security proxy that checks the destination in real time.
  • Banner for external emails — visual marking of emails from outside the company.

Pillar 5: Backups and Recoverability

Backups are the last defence against ransomware. Without functioning, immutable, and tested backups, ransomware means a business exit.

The 3-2-1-1-0 rule:

  • 3 copies of data (1 production + 2 backups)
  • 2 different media / providers
  • 1 off-site (geographically separate)
  • 1 offline or immutable (S3 Object Lock, air-gapped)
  • 0 errors on recovery test (perform at least 1× per year)

For cloud ERP, the primary backup is the provider’s responsibility, but the company must have its own independent backup — data export to an S3 bucket under company control or an offline backup. Modulario provides native export of all data via API and via UI dump, so the company can create an independent backup automatically.

Pillar 6: Network Security

  • Firewall — perimeter and host-based (Windows Defender Firewall on every endpoint).
  • VPN for remote access, ideally ZTNA (Zero Trust Network Access) instead of classic IPsec/SSL VPN. ZTNA verifies each access separately, not the entire network at once.
  • Network segmentation — separation of production, office, and guest Wi-Fi networks. IoT devices (cameras, printers) on a separate VLAN.
  • DNS filtering (Cisco Umbrella, Cloudflare Gateway) — blocks access to known malicious domains at the DNS level.

For VPN basics see the glossary entry /en/glossary/ssl.

Pillar 7: Employee Training

The weakest link is almost always a person. Regular training turns them from the weakest link into the first line of defence.

  • Onboarding training for every new employee (1–2 hours).
  • Annual refresher mandatory for all.
  • Phishing simulations 4–12× per year with personalised feedback (KnowBe4, Hoxhunt, other platforms).
  • Just-in-time training — when an employee clicks in a phishing simulation, they immediately receive a short lesson on why it was phishing.

Investment of 25–50/employee/year in quality training pays for itself with the first prevented incident.

Encryption: SSL/TLS, VPN, Data Encryption

Encryption protects the confidentiality (who can read) and integrity (who can modify) of data. Three contexts are most important in practice.

SSL/TLS for Web Communication

SSL/TLS secures communication between a browser and a server. In 2026, TLS 1.3 is the minimum for public websites; TLS 1.2 is tolerated for legacy clients.

Practical implications for a company:

  • Every company website must have a valid SSL certificate (HTTPS, not HTTP). Free Let’s Encrypt is sufficient for most use cases.
  • HSTS (HTTP Strict Transport Security) preload — enforces HTTPS even on the first visit.
  • Mixed content audit — no HTTP resources (images, scripts) on an HTTPS page.
  • Certificate transparency monitoring — alert if someone issues a certificate for your domain (possible attack).

Detail in the cluster article SSL Certificate: A Complete Guide for Your Business Website and in the glossary /en/glossary/ssl.

VPN and Zero Trust

Classic VPN gives a logged-in user access to the entire internal network. This is a security anti-pattern — a compromised account opens the door to everything.

Zero Trust Network Access (ZTNA) is the better approach in 2026:

  • Every access is verified separately (identity, device, context).
  • Applications are accessible individually, not through “the whole network”.
  • Default-deny — explicit permission, not implicit trust.

Vendors: Cloudflare Access, Tailscale, Twingate, Microsoft Entra Internet Access.

Data Encryption at Rest

  • Disk encryption — BitLocker (Windows), FileVault (macOS), LUKS (Linux). Mandatory for laptops.
  • Database encryption — TDE (Transparent Data Encryption) in PostgreSQL, MySQL, SQL Server.
  • Backup encryption — backup software encrypts before uploading to cloud, key held by company or managed KMS.
  • Email encryption (S/MIME or PGP) — for sensitive correspondence, especially legal or HR.

In Modulario, primary data is encrypted with AES-256 at rest and communication protected by TLS 1.3 in transit. Detail in security documentation.

Hardware, Software, and Networking: Technical Basics for the Owner

Some security decisions are made by the business owner even before the IT manager — for example, the selection of laptops, ERP, and cloud services. Here is a brief overview of the concepts needed. A deeper explanation is in the pillar article IT Basics for Business Owners.

Hardware

Physical devices: servers, laptops, mobile phones, network devices, IoT sensors, scanners, printers. Security aspects:

  • Lifecycle management — purchase, inventory, maintenance, disposal. Goal: a device never disappears from the inventory.
  • Disk encryption mandatory for all laptops.
  • MDM (Mobile Device Management) — Microsoft Intune, Jamf. Centralised management, remote lockout on loss.
  • Secure disposal — disk wipe or physical destruction, not second-hand sale.

Glossary: /en/glossary/ssl.

Software

Programmes and applications. Security aspects:

  • Inventory of installed software — what is running on company devices.
  • Allowlisting — explicitly permitted applications, others blocked (Microsoft Defender Application Control, AppLocker).
  • Open source vs. commercial — open source is not worse, but needs active maintenance (who monitors patches?).
  • SaaS shadow IT — employees register company email addresses for SaaS services without IT’s knowledge. CASB (Cloud Access Security Broker) helps map this.

Glossary: /en/glossary/ssl.

Networking: IP Addresses, DNS, Ports

Security-relevant concepts:

  • IP address — identifies a device on the network. Public (routable from the internet) vs. private (LAN). A company’s static IP can be used as an identity for whitelisting (e.g. “ERP access only from company IP”). Glossary: /en/glossary/ip-adresa.
  • DNS — translates a domain name to an IP. DNS poisoning is an attack where a malicious server returns a wrong IP. Defence: DNSSEC, DNS over HTTPS/TLS.
  • Ports — communication channels within an IP. An open port = an entry point. The firewall only opens those that are necessary.

Incident Response: When Prevention Fails

Regardless of the quality of prevention, something will happen eventually. A prepared incident response plan determines whether it will be a 24-hour episode or a 3-month operational crisis.

IR Plan Structure

  1. Preparation phase — contact list (internal + external: forensics expert, lawyer, PR, insurer, regulator), runbooks for the top 5 scenarios, role matrix (who does what).
  2. Detection and triage — reporting channels (internal #security-incident channel, email security@company.com, phone line), classification criteria (severity 1–4).
  3. Containment — immediate steps per scenario (endpoint isolation, account deactivation, key rotation).
  4. Eradication — threat removal (malware removal, patch, account reset).
  5. Recovery — system restoration, integrity verification, gradual restart.
  6. Lessons learned — post-mortem within 2 weeks, update of measures.

Key Decisions in Real Time

  • Pay the ransom with ransomware? Law enforcement and national cybersecurity authorities advise against it. 35% of companies that paid received a working decryption key. 65% received nothing or only a partial key. Better to invest in recovery from immutable backup.
  • Notify clients? GDPR Article 34: if there is a high risk to the rights and freedoms of data subjects, yes, within 72 hours. NIS2: notify the competent national authority with an early warning within 24h, formal notification within 72h.
  • Notify the public / media? Strategically — neutralise rumours, but do not disclose details that would help the attacker. A PR adviser on the IR team is an investment that pays off.

Cyber Insurance

Cyber insurance in 2026 typically covers:

  • Forensic and IT recovery costs
  • Legal and notification costs
  • Business interruption loss
  • Regulatory fines and sanctions (partially)
  • Ransom (with strict conditions)

Cost: 0.1–0.4% of insured sum per year. For a mid-sized EU company typically 5,000–25,000 per year for 1–5 € million coverage. Necessary for regulated sectors and B2B with large clients.

Compliance and Regulation: Context

Cyber hygiene does not rest on a single regulation. For EU SMBs in 2026, the relevant frameworks are:

  • GDPR — primary framework for personal data
  • NIS2 (Directive 2022/2555) — cybersecurity for 18 sectors
  • DORA — financial sector + their ICT suppliers
  • AI Act — high-risk AI systems (HR scoring, credit scoring)
  • eIDAS 2 — electronic signatures, digital identity
  • Sector-specific regulations — healthcare, energy, telecom

Detailed explanation of the regulatory framework is in the pillar article Security and Compliance in Cloud ERP 2026 and in the cluster articles NIS2 Directive, DORA Regulation, and ISO 27001 for SMBs.

How Modulario Addresses Cybersecurity

Modulario as an EU-native ERP/CRM platform provides security measures out of the box:

  • 2FA / SSO supported (TOTP, WebAuthn, SAML 2.0, OIDC) — administrators can enforce for the entire company
  • Role-based access control with field-level granularity for sensitive modules (HR, finance)
  • Native audit log of every change in every module, 12-month retention, SIEM export
  • Encryption AES-256 at rest, TLS 1.3 in transit, mTLS internally
  • EU hosting with ISO 27001 certification, no CLOUD Act risk
  • Standardised DPA with every contract, without the need for legal negotiations
  • Backup with hourly incrementals, multi-region replication, immutable storage 7 days
  • DSAR support — personal data export on request within 30 days
  • Incident response SLA 24 hours for security incidents

For a detailed description see the security page.

Cluster Index: Deeper into Topics

This pillar summarised the agenda at a high level. For specific topics see the cluster articles:

Summary and Recommendations

Cybersecurity for EU SMBs in 2026 is not a luxury — it is an operational minimum. Every company that has experienced a serious incident would, in hindsight, have invested more in prevention than it actually did. The pragmatic minimum standard:

  1. 2FA for everyone, passkey for administrators and the finance team
  2. Monthly patch cycle for OS and applications + EOL replacements without exception
  3. EDR instead of classic antivirus on all endpoints
  4. Email security with anti-phishing, SPF/DKIM/DMARC configured
  5. Backups 3-2-1-1-0 with annual recovery test
  6. Employee training annually + 4 phishing simulations
  7. Incident response plan with contact list and runbooks for the top 5 scenarios

Investment: 8,000–25,000 per year for a mid-sized company. Return: a single prevented incident.

A cloud ERP with primary data at an EU-native ISO 27001-certified provider (like Modulario) removes 50–60% of this agenda from the company — primary infrastructure, encryption, audit log, backup, and incident response are the provider’s responsibility. The company can focus on endpoint security, email, identity, and training.

If you would like to discuss specific cyber hygiene for your company or a Modulario deployment in a regulated environment, contact us via a free consultation.

Frequently Asked Questions

What are the most common ways attackers get into a corporate network? In 2026, three vectors dominate: phishing (approximately 60% of attacks begin with clicking on a fraudulent email), compromised login credentials (leaked passwords from other services reused at work), and vulnerabilities in unpatched software (especially VPN gateways, email servers, self-hosted ERP). Ransomware attacks almost always begin through one of these three entry points, not through “hacker-style” firewall bypasses.

Is antivirus enough, or do I need more? Antivirus is only one layer. Modern corporate defence rests on six pillars: (1) secure login via 2FA/SSO, (2) updated software and operating systems, (3) endpoint detection and response (EDR — more advanced than classic AV), (4) backups with immutability, (5) email gateway with anti-phishing scanning, (6) employee training. Without 2FA and updates, antivirus provides marginal benefit.

What is the difference between 2FA and a passkey? Classic 2FA (TOTP via Google Authenticator or SMS) is two-factor — password plus a one-time code. A passkey (FIDO2/WebAuthn) is passwordless — the password is replaced by a cryptographic key stored on the device, which cannot be phished or intercepted. Passkeys are the recommended standard in 2026 for critical accounts (administrator access, banking, email). 2FA via SMS is the weakest form and should be replaced.

How much does recovering from a ransomware attack cost for a mid-sized company? The real cost of a ransomware attack for an EU SMB with 50–200 employees ranges from 80,000 € to 350,000 €. It consists of: direct downtime (average 9 days × daily revenue), forensic analysis (15,000–40,000), legal and notification costs (10,000–25,000 for GDPR compliance), infrastructure reinstallation, regulatory fines (NIS2 up to 2% of turnover), and lost client trust. The ransom, if paid (which we do not recommend), is only 15–25% of total costs.

How often should I back up and where should I store backups? The 3-2-1 rule: 3 copies of data, 2 different media/locations, 1 offline or immutable. For EU SMBs in 2026 this means: primary data in cloud ERP, daily snapshot to a second cloud (different provider, different geography), weekly snapshot to immutable storage (S3 Object Lock or air-gapped tape). For critical accounting and HR data, hourly incrementals with 30-day retention are recommended. Backups MUST be tested at least 1× per year — an untested backup is unusable.