I begin this article with an uncomfortable truth: assuming that a company can avoid any security incident is unrealistic. Attack surfaces are constantly growing, environments are becoming more complex and cyberattacks more difficult to detect.

Therefore, the challenge in cybersecurity is no longer just to prevent, but to be prepared to respond when it happens. Because in a cybersecurity crisis, the impact is not defined by the attack itself, but by how it is managed during the first hours. Let’s take a look.

Imagine that one Saturday morning, the SOC team detects suspicious activity on a server. Nothing particularly alarming at first, but within minutes there are signs of unauthorized access. It is not yet clear whether information has been stolen, but the risk is there.

As the investigation progresses, questions begin to arise that go beyond the IT team: Do we stop the affected server and assume the operational impact? Do we wait until we have more information with the risk of the attacker moving forward? Do policies, such as NIS2, require us to notify the appropriate authorities? What do we communicate, and when?

It is at this point that it ceases to be just a security incident and becomes a business decision.

Therefore, from our experience in Softeng managing incidents in medium and large companies, we have extracted three lessons that often make the difference between a controlled incident and one that generates a crisis with business impact.

1. The business context is key to making decisions in the event of a security breach.

Returning to the previous scenario, the SOC service has confirmed the unauthorized access, although the situation is now under control: it has been detected quickly and the corresponding response measures have been implemented.

But detecting unauthorized access is not enough to understand the impact it can have on the business.

In effective crisis management, the following more strategic questions must be answered:

1. Which critical processes depend on the affected systems?
2. Is there an obligation to notify the competent authorities if we are subject to GDPR, NIS2 or DORA regulations?
3. What could be the reputational impact if the breach becomes public?

At this point, no further technical information is needed. Business context is missing.

And without that context, decision making becomes complicated: either you overreact and stop systems unnecessarily, or you underestimate the risk and give the attacker room for maneuver.

That’s why managing a security crisis well is not just about detection. It is being able to connect, almost in real time, what is happening at the technical level with its impact on the business.

When that connection exists, the organization can prioritize judiciously. And in a crisis, that’s what really limits the impact.

2. The speed is not set by the attacker, it is set by your decision-making capacity.

Continuing with the example, while the SOC team continues to investigate, the attack does not stop.

Today, with attackers using AI to be much faster and more effective, time is against them. We see it all the time: recognition of the entire internal network in minutes, persistence in hours, and theft of sensitive information before there is full visibility.

Meanwhile, within the organization, another type of complexity begins. IT, legal, communication and management teams have to be coordinated to make non-trivial decisions together:

Is a production environment isolated? Is a critical operation stopped? Are the relevant authorities notified? Are customers informed?

And therein lies the real problem: the time that elapses between detecting and deciding.

Many organizations detect the incident well, but take too long to act. And that delay is, in many cases, what amplifies the impact.

The organizations that respond best are not necessarily those that have the most technology, but those that have reduced that decision time. Because they have already defined who decides what, when and with what criteria.

3. Crisis plans that are not trained fail when they are most needed.

Here is an idea that summarizes very well what happens in these cases: “The more you sweat in training, the less you bleed in combat.”

Almost every organization has some kind of incident response plan, but every day we see that very few have tested whether it actually works under pressure.

The difference is quickly noticed when a real incident occurs. In untrained organizations, very clear situations arise:

• Doubts about who has the authority to shut down systems.
• Blockage in decision making due to lack of shared information.
• Delays in notification due to doubts about legal issues.
• Inconsistent messages to customers or employees.
• Excessive dependence on suppliers without clear coordination.

In contrast, organizations that have previously worked through these scenarios operate very differently. For example, one way to do this is through TTX-type exercises, where a real crisis is simulated, such as a ransomware or data leak, and teams must make decisions in real time as if the incident were occurring, without executing technical actions.

This type of exercise makes it possible to detect failures that do not appear in a document: coordination problems, poorly defined roles or decisions that are blocked at the critical moment.

The most mature organizations have already gone through this process: they have tested their plans, involved management and aligned all teams, including suppliers.

That generates something that cannot be improvised on the day of a real incident: trust.

Going back to that Saturday morning, it all started with an early detection by the SOC team. That first alert was key to narrowing the scope of the incident from the outset.

But from then on, what happened next made all the difference.

If the organization was able to understand the real impact, make decisions quickly and act with coordination, that incident was probably contained. If not, that’s where it started to escalate.

Because in cybersecurity, as important as detecting is knowing how to respond. And this ability is not improvised, it is worked on beforehand.

Any company can be the victim of a cyberattack. However, there are five main causes that make companies even more vulnerable, leaving the door wide open to be attacked very easily. Do you identify any of them in your company?

According to Microsoft’s Data Security Index, 83% of organizations have suffered more than one data breach in their history. This makes it clear that cybercriminals are constantly looking for vulnerabilities in enterprise systems and launching attack attempts, usually successfully.

They just need a lucky day.

And companies, even knowing the risk they run, become easy targets because many do not invest enough in cybersecurity to protect their business assets and anticipate cybercriminals.

Many think it won’t happen to them or that it won’t be as serious and catastrophic as they usually tell… Or, worse, that, in case of an attack, they have it under control.

Until they are attacked.

It is at that precise moment that they remember cybersecurity.

In this article, we look at the top five causes that make companies easy targets for cybercriminals and how to address each of them to reduce risk.

Not keeping abreast of new cyber-attacks and their sophistication.

Technologies such as artificial intelligence have enabled attackers to design more sophisticated strategies, making threat detection more difficult. Methods such as ransomware attacks, which lock systems until a ransom is received, or Deepfakes, attacks that use AI to fake voices or videos, are becoming everyday problems for companies.

To address these threats, it is essential to have advanced systems in place to monitor and block attacks before they cause damage. Security technologies such as Microsoft’s, which analyze more than 78 trillion signals daily, enable companies to stay abreast of the latest attack trends.

Lack of awareness in the Management Committee.

A common misconception is that cybersecurity is solely the responsibility of the IT team. However, the strategic decisions made by business leaders directly influence the security posture of the enterprise.

When senior management does not prioritize cybersecurity, the investments needed to protect corporate assets are often put on the back burner.

To change this paradigm, leaders must understand that cybersecurity is a fundamental pillar of business continuity. Performing regular risk audits and actively participating in the definition of security policies are key steps to achieve a complete defense.

3. Poor employee training

A malicious email, a suspicious link or a weak password can be enough to compromise a company’s entire network. Employees, without proper training, are often the weakest link in the security chain. In fact, phishing attacks remain one of the main cyber-attacks.

That is why it is essential to invest in continuous employee training. Initiatives such as attack simulations and awareness campaigns help to create an organizational culture that is more resilient to cyber threats.

4. Not having a comprehensive cybersecurity strategy.

Many companies rely on ad hoc or disconnected solutions, leading to gaps in their protection. Without a comprehensive strategy, it is difficult to prevent, detect and respond to cyberattacks.

An effective solution involves implementing a strategy that combines advanced integrated tools and a strategic plan that includes processes, policies and continuous expert oversight.

For example, many companies choose a cybersecurity SOC for comprehensive protection, managing everything from early detection to automated incident response, combined with the support of a specialist who is up to date with all the latest developments and solutions.

Which brings us to the last point…

5. Not having the right specialists to manage cybersecurity.

Cybersecurity is not just a technology issue; it requires expertise and specialized skills. Without trained personnel, companies are at a disadvantage.

In these cases, outsourcing cybersecurity management to a specialized partner can make all the difference. Working with cybersecurity experts allows companies to benefit from proactive solutions, regular audits and constant monitoring, ensuring that they are always one step ahead of attackers.

How to reduce the chances of suffering a cyber attack

The companies most vulnerable to cyberattacks have one thing in common: they underestimate the importance of a sound cybersecurity strategy and delay taking action until it is too late.

If you are a business leader, prioritize training, strengthen your systems and seek support from cybersecurity experts to ensure your company is prepared to face increasingly dangerous cybersecurity challenges.

A cybersecurity strategy with cloud solutions, combined with advanced tools, is the only way to ensure cyber resilience.

In Softeng we have designed a service SOC / CSIRT, intelligent and proactive, combining Microsoft technology along with advanced security solutions themselves, to obtain and maximize a global defense against new threats.

Shall we talk?

Companies that understand cybersecurity as a business priority are convinced that a modern Security Operations Center (SOC) is no longer optional: it is an essential pillar to protect critical assets and ensure operational continuity.

However, not all SOCs are the same. To meet today’s demands, a SOC must be more than a security monitoring center: it must be an intelligent, proactive and agile entity.

When choosing an SOC, are you taking into account all the key features it should have to protect your business?

The 5 functions of a SOC that you should prioritize

Global threat prevention and detection

In cybersecurity, prevention will always be more efficient than reaction. A SOC must go beyond traditional solutions and combine advanced tools with expert knowledge to detect and block unknown threats at their source.

A good example is the ability to correlate seemingly isolated events to identify attack patterns and stop them before they can cause damage. In this context, reducing the attack surface, through secure configurations and robust policies, is as crucial as having state-of-the-art detection technologies.

2. Continuous risk assessment

Companies are living organisms, and what works today may not be sufficient tomorrow. A modern SOC must be constantly assessing risks, identifying vulnerabilities in real time and prioritizing their remediation according to potential impact.

This approach not only protects today’s systems, but allows organizations to stay one step ahead in an ever-evolving cyberattack environment.

3. Intelligence and active search for threats

Proactivity is a hallmark of a modern SOC. It is no longer enough to wait for alerts to be triggered. Technologies such as advanced analytics, artificial intelligence and machine learning make it possible to anticipate threats by actively searching for indicators of compromise.

In addition, user and entity behavioral analysis (UEBA) provides a level of accuracy that facilitates the detection of suspicious activity before it escalates. This, combined with threat intelligence, significantly improves responsiveness.

4. Surveillance beyond the company’s borders

Many of the threats affecting organizations today do not originate in their internal infrastructures. Phishing, sale of sensitive data on the Dark Web, fraudulent applications or credentials exposed on the Internet are just a few examples.

An advanced SOC should not only be aware of what is happening inside the company, but also of what is happening outside the company, identifying external risks that could indirectly impact employees, customers or partners.

5. Agile and effective response to incidents

The speed with which an organization responds to a security incident can be the difference between containing a minor problem or facing a major crisis. That’s why a modern SOC must have clear and efficient processes in place to handle any eventuality.

Automating responses through tools such as SOAR allows you to act with precision and significantly reduce mitigation time.

However, when automation is not enough, a well-trained team must take the reins to manage security incidents quickly and effectively.

That’s why…

Rapid incident response, the function that all companies are looking for

For business leaders, threat prevention is essential, but what really makes the difference is the ability to effectively respond to and manage incidents when they occur.

In Softeng, our cybersecurity service Max Global Defense covers both needs.

By integrating the capabilities of a modern SOC, focused on prevention and continuous detection, with the expertise of a CSIRT team, specialized in incident management and mitigation, we offer companies a complete defense that minimizes risks and reduces the impact of potential incidents.

Looking for a full-featured SOC to protect your business? Let’s talk about it.

Last month I had the pleasure of participating as a speaker at several events related to cybersecurity. Between speeches, coffees and brief talks with CIOs and CISOs, we agreed that everyone is looking to ensure business continuity, but few succeed because they are missing an essential piece. I’ll tell you what it is in this article.

Those of us who work in this field never tire of repeating it: in many organizations, cybersecurity is still underestimated, and is only given attention when they have already suffered a cyberattack that threatens business continuity.

The problem is that, by then, it is often too late.

Therefore, it is essential to understand that cybersecurity is not an extra of the business, but a fundamental part of it, as are administration, sales, human resources, and the rest of the business areas.

No one questions their value or investment in these areas, right?

This is the only way we can protect all our business assets so that in the event of a security incident, our company will continue to operate. This is the fundamental basis of cyber resilience: having the ability to withstand and recover from a security breach. But how do we achieve this capability?

Many companies think that having backup and disaster recovery solutions is enough.

But the reality is quite the opposite. These solutions will allow us to recover, but they will not provide us with the capacity to withstand the impact of security breaches. This is not to say that these solutions are not necessary, but they are just pieces, like other solutions, that are useless if they are not accompanied by the fundamental piece of the puzzle: a modern SOC/CSIRT.

Let’s imagine it this way.

A family decides to install the best video surveillance cameras (security solutions) in their home, but they never keep an eye on them. Believing that these security measures are enough, they don’t pay much attention to lock the doors and windows properly (vulnerabilities and weak points) every time they go out. What do you think will happen? They will surely end up suffering a burglary (security breach). And yes, they will have the recording of the security cameras, but what was stolen is unrecoverable.

And the bad moment will never be forgotten.

Isn’t there something missing in this equation? Yes, we are missing someone to continuously monitor the security cameras and, most importantly, to respond quickly and effectively if “intruders” break in. This is precisely the essential role of a SOC/CSIRT, a team of security specialists who, on the one hand, keep a constant watch and respond in the event of a breach and, on the other hand, identify vulnerabilities and weak points to reduce the chances of attack. In short, only those companies that understand the importance of cybersecurity as a fundamental part of the business will obtain a complete defense that guarantees cyber resilience. So, are you willing to take the risk of not having the essential piece in the complex puzzle of cybersecurity? I hope you found this article interesting and… don’t run the risk of missing the next one!

The NIS2 directive is the European Union’s guide for companies and member states to safely navigate the digital world, facing increasingly dangerous and sophisticated cyber threats due to the use of artificial intelligence. Find out how you can meet it quickly and efficiently in this on-demand event on NIS2 in Spanish.

Digitalization has blurred borders and distances, making it possible for a local cyberattack to endanger the whole of Europe. As a result, cybersecurity awareness has reached the European Union, which has developed its own strategy to address it: the NIS2 directive. To this end, the EU has introduced new cybersecurity legislation called the Network and Information Security Directive 2 (NIS 2), which represents a significant improvement on the existing NIS directive. This law obliges EU member states to require companies to adopt and rigorously comply with stricter cybersecurity standards or, failing that, to impose appropriate sanctions, and may ultimately lead to partially or totally suspending the activity of a company or removing managers from their responsible functions.

More stringent measures affecting most companies, and penalties for noncompliance

Within this framework, and as of October 2024, this law will require most companies to have a series of robust risk management policies, protection measures and efficient responses to incidents, which will be mandatory. All this, in order to protect digital assets and operational continuity.

• How do the new changes and responsibilities affect you?
• What new measures does NIS2 require?
• How to adopt NIS2 quickly and efficiently? What sanctions are foreseen in case of non-compliance?

Event on demand in Spanish | Our experts provide answers to the most important questions about NIS2, and explain how you can quickly and efficiently adopt the minimum requirements of the new law.