Key takeaways
- Cybersecurity protects systems, networks and data from attack, damage and unauthorised access
- The discipline spans seven domains: network, endpoint, application, cloud, identity, data and AI security
- Confidentiality, integrity and availability are the three properties every security control is designed to protect
- Most successful attacks exploit basic failures: unpatched systems, reused passwords and untrained staff
- IBM's 2024 Cost of a Data Breach Report puts the global average breach cost at $4.88 million
- NIS2 and GDPR impose legal obligations on how European organisations protect data and report incidents
What cybersecurity covers
Cybersecurity is not a single discipline. Organisations face threats across multiple layers of their technology, each requiring different controls. Seven domains cover the full scope.
1
Network security
Protecting the infrastructure that carries data between systems and to the internet. Firewalls, intrusion detection systems, VPNs and network segmentation sit here. Network security controls what traffic enters and leaves your environment and limits what an attacker can reach if they get in.
2
Endpoint security
Protecting individual devices: laptops, servers, mobile phones and workstations. Endpoint detection and response (EDR) tools monitor for malicious activity at the device level. Every managed device is a potential entry point, making endpoint security a foundational layer for any programme.
3
Application security
Securing the software your organisation builds and uses. Penetration testing, secure code review, web application firewalls and dependency scanning address this layer. Many of the most significant breaches in recent years entered through application vulnerabilities that were publicly known and unpatched.
4
Cloud security
Securing workloads, data and identities in cloud environments. Misconfigured cloud storage buckets, over-permissioned service accounts and inadequate logging are among the most common sources of cloud exposure. Cloud security requires both the provider's controls and your own configuration decisions to be correct.
5
Identity and access management
Controlling who and what can access which systems and data. This covers both human user accounts and
machine identities: the API keys, service accounts and certificates that systems use to authenticate with each other.
Multi-factor authentication, single sign-on, privileged access management and role-based access control are the core tools. Compromised credentials appear in the majority of breaches, making identity management one of the highest-leverage control areas.
6
Data security
Protecting sensitive data at rest and in transit. Encryption, data loss prevention tools and access controls determine who can read, copy or transmit your most sensitive information. Data security is also where regulatory obligations such as GDPR and NIS2 have the most direct technical requirements.
7
AI security
Protecting AI systems and applications from attack, and using AI to strengthen defences. Attackers use prompt injection, data poisoning and model extraction to manipulate or steal from AI systems. According to IBM research, only 24% of generative AI initiatives are currently secured. AI security addresses both the protection of AI tools and the use of AI-driven analytics to detect and respond to threats faster.
Confidentiality, integrity and availability
Three properties underpin every security decision. Security professionals call this the CIA triad. Every control you implement is protecting at least one of these three properties, and understanding which one clarifies the trade-offs involved.
C
Confidentiality
Information is accessible only to those authorised to see it. Encryption, access controls and least-privilege policies protect confidentiality. A breach of confidentiality means data reached someone who should not have it.
I
Integrity
Data is accurate and has not been tampered with. Hashing, digital signatures and audit logs detect or prevent unauthorised modification. A breach of integrity means someone changed data without authorisation.
A
Availability
Systems and data are accessible when the business needs them. Backups, redundancy, patching and DDoS protection support availability. A breach of availability means your systems or data are inaccessible at the moment you need them.
The most common threats
$4.88M
global average cost of a data breach in 2024 (IBM)
68%
of breaches involve a human element (Verizon DBIR 2024)
25%+
of breach incidents involve ransomware (Verizon DBIR 2024)
1
Phishing and social engineering
Attackers manipulate staff into disclosing credentials, clicking malicious links or authorising fraudulent transactions. Phishing is the most common initial access vector because it targets people directly, bypassing technical controls. Business email compromise, spear-phishing and smishing (SMS phishing) are all variations on the same approach.
2
Ransomware
Malware that encrypts files and demands payment for the decryption key. Ransomware incidents have declined since 2023, partly because more organisations refuse to pay and law enforcement has taken down several major groups. Recovery is expensive regardless: restoring systems, notifying customers and managing the resulting disruption often costs more than the ransom. Clean, offline backups with tested recovery are the most effective defence.
3
Credential attacks
Brute force, credential stuffing and password spraying exploit weak or reused passwords. Attackers purchase credential dumps from previous breaches and try them against corporate login portals at scale.
Multi-factor authentication stops the majority of automated credential attacks.
4
Supply chain attacks
Compromising a trusted supplier, software package or managed service provider to reach downstream customers. A single compromise in widely used software can affect thousands of organisations simultaneously. Vendor risk management and software bill of materials (SBOM) practices reduce exposure here.
5
Insider threats
Employees, contractors and former staff with legitimate access can cause damage through negligence or intent. Insider threats are harder to detect than external attacks because the access is authorised. Least-privilege access, off-boarding procedures and user behaviour analytics are the main controls.
6
DDoS attacks
Attackers flood systems or networks with traffic to make them unavailable to legitimate users. DDoS attacks can disrupt operations without requiring any breach of the systems themselves. Cloud-based DDoS mitigation services absorb volumetric attacks before they reach your infrastructure.
7
AI-powered attacks
Attackers use generative AI to produce convincing phishing emails, deepfake audio and fabricated business documents at scale, and to write malicious code faster than before. They also target AI systems directly: prompt injection manipulates AI tools into disclosing sensitive data or taking unintended actions. As AI adoption grows, so does the attack surface it creates.
The business and regulatory case
Two factors drive cybersecurity investment in most organisations: the direct cost of incidents and the legal obligation to prevent them.
IBM's 2024 Cost of a Data Breach Report puts the global average breach cost at $4.88 million, a 10% increase on the prior year and the highest recorded figure. That covers detection, containment, legal costs, customer notification and lost business. Organisations that pay ransoms add the ransom to that. For smaller organisations, the per-record cost is often higher than the average because fixed costs like legal fees and notification scale less efficiently. Globally, cybercrime is estimated to cost the world economy $10.5 trillion annually.
The security skills shortage compounds the risk. A World Economic Forum study found the gap between available cybersecurity workers and open roles could reach 85 million by 2030. IBM's breach data shows organisations with significant security skills shortages face average breach costs of $5.74 million, compared to $3.98 million for those with lower-level shortages. The gap between well-staffed and under-staffed security programmes is now measurable in dollars per incident.
Patching, MFA and backups stop most attacks. Organisations with these in place and well maintained have fewer incidents than those with more sophisticated tooling and less discipline around the fundamentals.
The regulatory picture in Europe is clear. GDPR requires organisations processing personal data of EU residents to implement appropriate security measures and report breaches to supervisory authorities within 72 hours of discovery. Penalties reach 4% of global annual turnover. NIS2, which EU member states implemented into national law by October 2024, extends mandatory cybersecurity controls and incident-reporting requirements across energy, transport, health, banking, water, digital infrastructure and managed services. Organisations in scope must implement risk management measures, conduct security assessments and notify authorities of significant incidents within 24 hours of detection.
NIS2 scope
NIS2 covers essential and important entities across 18 sectors. If your organisation operates in a covered sector or provides services to organisations that do, NIS2 likely applies. National authorities published their transposition into domestic law by October 2024. Penalties for non-compliance reach €10 million or 2% of global turnover for important entities, and €20 million or 4% for essential entities.
Common cybersecurity myths
Several persistent misconceptions lead organisations to underinvest or misallocate their security spending.
1
"Strong passwords are enough"
A 16-character password is vastly harder to crack than a short one, but passwords are stolen, not just guessed. Phishing, keyloggers, dark web credential markets and database breaches all hand attackers valid passwords without needing to crack anything.
MFA addresses what strong passwords cannot.
2
"We're too small to be a target"
Attackers do not choose targets by size. They choose by vulnerability. Automated tools scan the internet for unpatched systems, exposed credentials and misconfigured services around the clock. The Hiscox Cyber Readiness Report found that 41% of small US businesses experienced a cyberattack in a single year.
3
"Our industry isn't at risk"
Every industry faces cybersecurity exposure. Ransomware groups now target local governments, hospitals, schools and logistics firms alongside financial institutions. Supply chain attacks affect any organisation that uses software, which is all of them.
4
"We have antivirus, so we're protected"
Antivirus detects known threats by matching patterns in its signature database. Zero-day exploits, fileless malware and phishing attacks that redirect users to legitimate-looking pages bypass signature detection entirely. Antivirus is one layer; it is not a security programme.
5
"Cyber risks are well understood and contained"
The threat landscape changes faster than most organisations can track. Thousands of new vulnerabilities are disclosed each year. AI is creating new attack categories. Cloud, IoT and distributed work have extended the attack surface beyond the perimeter that older security models were designed to protect.
Where organisations start
Most breaches do not require sophisticated techniques. Attackers exploit gaps in basic controls that organisations have not yet closed.
Six controls that close the most exposure for the least cost:
1
One compromised password should not be enough to grant access to your systems. MFA blocks the majority of automated credential attacks and is the single highest-impact, lowest-cost control most organisations can deploy.
2
Patch management
Unpatched vulnerabilities are among the most commonly exploited entry points. A structured patching process with defined timelines for critical and high-severity fixes eliminates most of this exposure. The majority of successful exploits use vulnerabilities for which patches have been available for months.
3
Backups with tested recovery
Ransomware is neutralised by clean, offline backups and a recovery process that has actually been tested. Backups that have never been restored successfully are not reliable. Recovery tests belong on the calendar, not the wishlist.
4
Network segmentation
An attacker who reaches one system should not automatically have access to all others. Segmentation limits lateral movement and turns a potential full breach into a contained incident.
5
Security awareness training
Most attacks involve a human element. Staff who can recognise phishing attempts catch what technical controls miss. Regular training that uses realistic scenarios is more effective than annual compliance tick-boxes.
6
Attack surface management
You cannot defend what you cannot see. Attack surface management involves continuously discovering and monitoring internet-facing assets, identifying exposures and prioritising remediation. Many breaches enter through forgotten assets: old servers, shadow IT or misconfigured cloud storage that security teams did not know existed.
How Cyvra helps
Cyvra provides cybersecurity consulting across assessment, implementation and managed services. We help organisations identify where their exposure sits, meet NIS2 and GDPR obligations, and build controls proportionate to their actual risk. If you are looking for a starting point, a cybersecurity assessment is the fastest way to understand what needs attention and in what order.