Ciardi (Acn): “More reports on cyber risk: notifications up by 310 per cent”

Exactly. The companies that have done so voluntarily have chosen to report incidents to us precisely in order to seek support from the ACN. This is an important step forward – first and foremost, a cultural one. With the entry into force of NIS 2, the number of organisations that regard the Agency as a point of reference has increased.

What are the most common types of attack?

DDoS and ransomware – the former bring a service to a standstill by flooding it with traffic, whilst the latter lock or encrypt data and demand a ransom – remain the most common forms of attack, but both are on the decline. Without wishing to sound overly triumphant, the figures tell us that we are heading in the right direction. Over the six-month period, we recorded 181 ransomware incidents – 12 per cent fewer than the 206 recorded in the same period of 2025 – and 407 DDoS attacks, down by 32 per cent. This is a sign that defences are now more effective. The peak occurred in February, during the Milan-Cortina Olympics, due to the actions of activist groups often sponsored by states. However, only 6% of the incidents recorded that month resulted in a website being taken offline, and even then for no more than 15 minutes. The impact, therefore, was virtually nil.

Have IT systems been compromised?

They have fallen to 1,560 from 4,408 in the corresponding period of 2025, representing a decline of 64.6 per cent – which is no small matter.

A general decline, then.

The trend in these indicators reflects the effectiveness of our alert system, despite the ever-increasing digital footprint. Reports are becoming increasingly widespread and timely, enabling us to identify and rectify vulnerabilities sooner. This leaves attackers with fewer opportunities. And the figures confirm this.

However, one weakness remains: all it takes is for an employee to click on the wrong link in an email to put the entire company – and perhaps even the supply chain – at risk?

It must be clear that, in every context, cyber security is a shared responsibility: the greatest share certainly lies with the institutions and those who deal with these issues professionally, but a share of the responsibility rests with each and every one of us.