Cybersecurity is no longer just a matter for specialists. In Spain and the rest of Europe, digitalization is advancing at a pace that many organizations haven't been able to match with equivalent defenses, and this gap has become an opportunity for attackers . We're no longer just talking about large companies: government agencies, hospitals, ports, SMEs, freelancers, and essential infrastructure all share the same risk.
Recent incidents and industry analyses point in the same direction: the threat is growing, becoming more sophisticated, and increasingly reliant on automated tools . Artificial intelligence, the interconnection of industrial systems, and dependence on cloud services have expanded the vulnerable area. Experts and organizations agree that the response lies in investment, personnel training, regulatory enforcement, and improved public-private coordination.
More credible threats thanks to artificial intelligence
Artificial intelligence has changed the way scams are carried out. A few years ago, many scams were easily detected by spelling mistakes, poorly reproduced logos, or unnatural messages . Now it's possible to generate highly credible emails, messages, and even calls or video calls, tailored to the industry and the recipient. AI allows for translation, mimicking an executive's tone of voice, and cloning voice and image, reducing the telltale signs of fraud and solidifying AI and cybersecurity as central pillars of the digital fight.
Phishing remains the most common entry point. It arrives via email, SMS, phone call, or video conference, and typically simulates a problem with a bank account, email access, or cloud services to prompt the victim to act quickly. From there, they can steal credentials, install malware, or grant unauthorized access. Ransomware, which encrypts systems and demands a ransom, and impersonating suppliers, bosses, or colleagues complete an increasingly varied catalog of attacks. In the business world, terms like business email compromise, executive fraud, or payroll fraud are used to describe scams aimed at transferring money or obtaining sensitive information.
Data from the Galician region helps to put the phenomenon into perspective. More than 15% of Galician companies suffered a cybersecurity incident in 2025. External phishing was the most frequent, followed by internal identity theft, viruses, denial-of-service attacks, intrusions, and malware. The most common consequence was the unavailability of IT services , ahead of lost productivity and additional expenses. These figures reflect a widespread problem, not limited to any specific type of company.
The productive sector, especially SMEs and industry, is in the spotlight
SMEs are the backbone of the Spanish business sector, representing 99,8% of companies. They are also an attractive target because, in many cases, they lack specialized staff and large budgets . In micro-enterprises and among the self-employed, it's common for the same device to be used for both personal and professional life, which multiplies the risk. Alfredo DÃez, from the CEOE (Spanish Confederation of Employers' Organizations), emphasizes that digital security is no longer a dispensable expense, but rather a condition for business survival.
The impact of an attack isn't measured solely in euros. In addition to financial losses, there's reputational damage, a loss of customer trust, and the potential exposure of third-party data. Rebuilding reputation takes time, and increasingly, large companies are reviewing the security of their suppliers before making any contracts. Therefore, an SME that protects its systems also gains a competitive edge . Preparedness combines trained personnel, verification processes, and technical measures, based on a simple idea summarized by Jesús Cristóbal, professor at OBS Business School: it's not about believing it will never happen, but about being ready to react if it does.
In the industrial sector, digitalization has placed cybersecurity at the heart of functional safety. The new Machinery Directive, approved in 2023 and applicable in 2027, introduces requirements related to digital protection because a connected machine's behavior can be altered by unauthorized access. This approach is reminiscent of Royal Decree 1215/1997 in Spain, although the focus now extends to software and connectivity. CE Marking will require addressing three key pillars: security by design, security by default, and a secure lifecycle. This affects PLCs, HMIs, variable frequency drives, software, remote connectivity, and updates. Many older industrial protocols do not encrypt communications or verify who sends each command, so simply installing a firewall is insufficient: encryption, access control, and properly configured identities and permissions are essential . Responsibility is shared among manufacturers, integrators, and installation owners.
Regulation, investment and talent: the Spanish and European response
Europe has broadened its approach. Cybersecurity is no longer understood solely as the protection of networks and systems, but as an issue that touches on industry, defense, diplomacy, competition, rights, and resilience. The Elcano Royal Institute argues that the current model, focused on critical infrastructure and incident management, falls short in a geopolitical context with highly active state actors . Its proposal involves incorporating greater coordination with defense, foreign policy, and intelligence, and balancing security with strategic autonomy, competitiveness, and technological development. Public-private partnerships emerge as a key element, although they are still losing ground in terms of trust and influence.
Investment is also on the rise. In Galicia, companies with ten or more employees allocated over €669 million to ICT security and €70,6 million to artificial intelligence systems. Micro-enterprises spent nearly €47,4 million on ICT security and €2,3 million on AI. Furthermore, one in five of the largest Galician companies employs ICT specialists , with data and cybersecurity profiles being the most sought-after. Around 30% of companies report that they will or expect to demand specialized personnel in the future, driving the pursuit of cybersecurity certifications to enhance their qualifications. The Galician government (Xunta) has strengthened training with 14 specialized IT and OT cybersecurity courses, offering 340 places for the 2026-2027 academic year. In Aragon, the IFP Campus Digital has announced openings for expert instructors to teach modules on cybersecurity, artificial intelligence, big data, digital transformation, and IoT, including secure deployment, computer forensics, and IoT data platforms and management.
Regulations act as a catalyst. NIS2 is pushing large companies and their suppliers to professionalize risk management, compliance, and information security. More and more organizations are choosing to delegate these responsibilities to external specialists. In Galicia, Inprosec grew from two to ten people in its Information Security division in just one year, and the group as a whole expanded from 48 to 65 professionals. There is a demand for professionals capable of understanding SAP security, risk management, compliance, and industrial cybersecurity. By sector, retail accounted for the highest percentage of companies affected by incidents, followed by construction and industry. The latter deserves special attention because an attack can halt production, disrupt the supply chain, or affect physical processes—a significant issue in the automotive, food, manufacturing, and energy sectors. Entities such as Igape, INCIBE, and INEO are promoting aid and support to improve companies' cybersecurity.
Consolidation, critical infrastructure and essential services
The Spanish market is also active. Aiuken Cybersecurity, a Spanish group belonging to the Allurity holding company, has acquired 4Elitech, a firm specializing in industrial cybersecurity with a significant presence in Navarre, Aragon, La Rioja, and the Basque Country. The acquisition strengthens its position in OT security, critical infrastructure, and the Internet of Things . 4Elitech works with hospitals, ports, pipelines, and essential infrastructure, and has quadrupled its revenue in the last five years. Although the price has not been disclosed, market sources place it at around €20 million. Aiuken, founded by Juan Miguel Velasco in 2012, was acquired by the Swedish fund Trill Impact in 2022 and operates in twelve countries, with a significant presence in Spain, Chile, Saudi Arabia, and Dubai. Allurity has 900 professionals in 18 countries, and the group protects more than a thousand corporate clients.
Protecting essential services remains another challenge. In the case of Renfe, technical evidence points to an origin in previously compromised Adif servers that were interconnected with the company's systems. The company activated its protocols, isolated the affected environments, and deployed extraordinary measures with the support of independent specialists. The investigation indicates limited access to users' names and email addresses, with no conclusive evidence of public disclosure so far and no indication of access to banking or financial data, payment methods, or national identity cards. The incident occurred after weeks of continuous attempts, which were detected and blocked. Renfe maintains its own certifications and standards for critical infrastructure, ongoing investments in monitoring and security, and is cooperating with the authorities while rail service remains operational.
The landscape paints a picture of a more comprehensive, more regulated, and more demanding cybersecurity environment. AI is making attacks cheaper and more sophisticated, while businesses and government agencies are responding with investment, training, and regulations . SMEs and industry need to close security gaps, essential services must strengthen their security measures, and specialized talent is becoming a strategic resource. The consolidation of the OT sector and cooperation between public and private stakeholders are paving the way to protect an increasingly digital economy.