The snapshot taken by the Cybersecurity & Data Protection Observatory of the Politecnico di Milano reveals a fact that is now hard to ignore: the cyber risk in Italy has changed scale. The fact that 34% of large companies have already suffered at least one attack no longer represents an anomaly, but a condition to be dealt with structurally.
What is also changing is the quality of threats; the integration of Artificial Intelligence into attack techniques is making operations faster, more credible, and targeted. The evolution is already visible. Techniques such as phishing and social engineering are becoming extremely sophisticated thanks to the use of generative models. Credible emails, contextualized messages, vocal or video deepfakes reduce the margin of recognition even for prepared users.
Here, in this context, 71% of Italian Chief Information Security Officers (CISOs) report an increased risk precisely linked to the use of AI by attackers.
Companies, at least in terms of investments, seem to be reacting: 57% foresee an increase in cybersecurity budgets in 2026. An important signal, reinforced by a European regulatory framework pushing for greater accountability and resilience. The regulatory push, with NIS2, Cyber Resilience Act, AI Act, and Data Act, brings the topic to the direct attention of boards and helps structure more mature approaches. Not surprisingly, 83% of large companies now continuously manage cyber risk. However, almost 9 out of 10 organizations report a significant talent shortage, with the risk of not being able to adequately scale processes and response capabilities.
At the same time, the Italian cybersecurity market continues to grow and will reach a value of 2.78 billion euros in 2025, with a 12% increase. The data confirms the sector’s solidity, especially when compared to the much more contained growth of overall digital spending. Driving growth are particularly the Public Administration, finance, and sectors related to logistics and transport, while the weight of services, especially managed ones, is strengthening, also to respond to the widespread shortage of specialized skills.
Yet, the survey also reveals a constant element that worries 96% of CISOs… the human factor, indicated as the main critical area. It is not simply about inattention or lack of training; the increasingly widespread use of AI tools introduces new risk surfaces, often underestimated because they are perceived as harmless or even useful for productivity.
This is why today the real leap in quality concerns human risk management. Enough with episodic training, welcome continuous, measurable, and adaptive approaches that take into account the real context in which people operate. Security must (and can) become a widespread skill, integrated into daily behaviors and supported by tools capable of simulating realistic scenarios.
In this sense, Artificial Intelligence itself can become part of the solution. If used correctly, it allows for personalized training paths, identification of risk profiles, and adaptation of content based on users’ specific vulnerabilities. The goal is not to eliminate human error but to reduce its impact and increase the ability to recognize and manage threats.
Organizations, therefore, must move from a defensive vision centered on tools to a systemic vision where people, processes, and technologies operate in an integrated way. In this balance, the human factor is no longer just a weakness but an active element of resilience.
The challenge now is to transform these conditions into concrete actions capable of truly impacting the security level of organizations.
