Ransomware is the EU's biggest short-term cyber threat

Ransomware remains the cyber threat with the biggest short-term impact in the European Union, according to a report by the European Union Agency for Cybersecurity, Enisa. The agency found that 57% of the incidents it analysed were driven by ideological motives. This points to a landscape where attacks are increasingly a tool of conflict, not just an economic activity.

A market worth 206 billion

Spending is rising in response. According to MarketsandMarkets, cited by CorCom, the critical infrastructure security market will grow from 160.28 billion dollars in 2026 to 206.31 billion in 2031. That represents a compound annual growth rate of 5.2% from 2025, when the value was 153.87 billion. Telecommunications is the most dynamic segment, growing 7.4% annually. Lockheed Martin and Thales are the main players in a sector currently undergoing consolidation.

The Italian case: OT under attack

For Italy, the most concerning data point concerns the manufacturing base rather than large operators. A whitepaper by a cybersecurity company, reported by CorCom, indicates that 90% of Italian manufacturing companies suffered at least one cyber incident in the past year. These events include ransomware, denial-of-service attacks, industrial espionage, and physical tampering with automation systems. These OT systems control production and were often not designed for network exposure.

The document identifies three structural issues: the difficulty of assessing risks accurately, regulatory and organisational constraints that slow down interventions, and a predominantly reactive approach where security is strengthened after an incident rather than before. It also notes that a lack of specialised OT security staff is a major obstacle, even when budgets and willingness are present.

"The industrial perimeter is today the weak point of the chain, because a plant standing still costs more than any ransom," is the message that emerges from the two documents.

The recommended countermeasure is organisational rather than technological: segment factory networks, inventory connected assets, define recovery plans tested periodically, and train production staff, not just IT staff.