Cyber and physical convergence, the new frontier of corporate security
Italian companies are moving beyond the traditional separation of physical and IT security, facing cultural and regulatory challenges to protect the entire operational ecosystem
For years, corporate security was treated as a vertical function: on the one hand cybersecurity, on the other the protection of sites, people and assets. Today, that distinction is rapidly losing its meaning, and the convergence of the cyber and physical components (plus data analysis) is in fact redefining not only the security market, but also the way companies manage business continuity, supply chain and industrial risk. This is a substantial evolution, driven by the growth of cyber attacks, regulatory pressure (the NIS2 directive, the DORA regulation) and the progressive integration of artificial intelligence, sensor technology, intelligent video surveillance and OT (operation technology) systems into corporate infrastructures.
For CEOs and top management, the issue is no longer just 'protecting the company' but ensuring the resilience of the organisation's entire operational ecosystem, whose critical point no longer coincides with the internal perimeter but rather with the possible vulnerability of an extended and interconnected supply chain, where suppliers, partners, digital infrastructures and industrial plants share data, access and processes. For CISOs (Chief Information Security Officers), this paradigm shift implies a growing management complexity, linked to a set of converging factors - such as threat fragmentation, structural shortage of cyber skills and the need for continuous monitoring - that are accelerating the use of hybrid models and managed security services. The challenge is above all cultural: we need to move from single asset defence to a 'total resilience' model, capable of integrating cyber intelligence, physical security and data governance in a single decision-making architecture. It is on this transformation of an industrial nature that focuses the vision of Marco Bavazzano, CEO of Axitea, an Italia group with a turnover of around 100 million euro and 1,000 employees, created following the recent acquisition of Surveye, a system integrator specialising in physical security.
In one of your bylines you speak of 'perimeter illusion': what is today the main 'blind spot' that Italian companies underestimate in their supply chain risk management?
The blind spot arises from continuing to think that security coincides with the corporate perimeter. Today, risk moves along supply chains, crossing IT, OT and physical security environments seamlessly, and the separation between these domains generates grey areas that attackers exploit with great effectiveness. According to the Clusit Report, supply chain attacks in Italia are among the fastest growing, and in 2025 our country suffered around 10% of all cyber incidents worldwide, with 82% of them classified as 'Critical' or 'High'. As long as security remains within organisational or technological boundaries, resilience remains partial and fragile. This is why security can no longer be read as perimeter defence but as the ability to ensure business continuity throughout the supply chain.
Isn't there a risk that resilience remains a more stated than practised theme, especially when it impacts critical or strategic suppliers?
