From Regulation to Implementation: What Companies Need to Strengthen Cyber Resilience

New European cybersecurity requirements, AI-powered attacks and growing dependence on digital infrastructure are presenting companies with major challenges. The key is not only to identify threats and comply with regulatory requirements, but also to remain operational in the event of a serious incident. Experts from business, politics and public authorities discussed how this can be achieved at the Internet Security Days @ it-sa 2026, organised by eco - Association of the Internet Industry on 28 October for the first time as part of the it-sa Expo&Congress in Nuremberg.

Regulation must be effective in practice

With NIS2, DORA and the Cyber Resilience Act, requirements for risk management, reporting procedures and secure digital products are increasing. Cybersecurity is therefore becoming an increasingly important factor in competitiveness and market access. At the same time, companies must implement new obligations without overlapping requirements and additional bureaucracy tying up resources needed for concrete security measures.

The opening keynote by Hans de Vries, Chief Cybersecurity and Operational Officer at the European Union Agency for Cybersecurity (ENISA), demonstrated what the transition to practical implementation could look like. The Cyber Resilience Act represents a fundamental shift in product security: manufacturers must consider security from the development stage onwards and take responsibility throughout the entire product lifecycle. ENISA supports implementation through technical guidance, assistance for small and medium-sized enterprises (SMEs) and a European vulnerability reporting platform.

Digital sovereignty is determined in practice

High-performance telecommunications networks, data centres, cloud platforms and redundant fibre-optic connections form the foundation for the availability of critical digital services. However, increasing interconnectedness also creates new dependencies and concentration risks.

Operators must balance performance, security and cost-effectiveness. Centralised infrastructure locations allow capacity to be consolidated efficiently, but can also concentrate the risk of outages. Greater geographical distribution, on the other hand, may increase costs, latency and operational complexity.

Digital sovereignty therefore involves more than questions of location or ownership. What matters is whether companies understand their dependencies, retain control over their data and processes, and can switch between providers when necessary. Solutions designed to address these needs are gaining visibility at it-sa 2026. Whether they gain widespread adoption also depends on their competitiveness and integration into existing infrastructure.

Preparing for powerful quantum computers must not be overlooked either. Since attackers can already collect encrypted data today with the aim of potentially decrypting it in the future, companies need to assess their cryptographic dependencies at an early stage and prepare for migration to quantum-safe methods.

AI is changing cyber defence and its risks

Artificial intelligence is transforming cybersecurity on both sides. While attackers can use AI to identify vulnerabilities more quickly and automate attacks, it also offers companies new opportunities to detect threats early and respond faster.

This raises a crucial question: Which security decisions should AI systems be allowed to make autonomously, and when must humans be able to intervene? In critical Internet infrastructure in particular, faulty defensive measures can have serious consequences.

A high detection rate alone is therefore not enough to assess the effectiveness of AI-powered security solutions. False positive rates, explainable decisions and the ability to reverse automated interventions are equally important. Companies must therefore integrate AI into auditable processes and clearly defined structures of responsibility.

From threat detection to effective response

The challenges associated with email security and combating DNS abuse also demonstrate the importance of coordinating technology, processes and responsibilities.

In email security, the problem often lies less in a lack of technical standards than in their implementation across an organisation. Protocols such as SPF, DKIM and DMARC can protect against forged sender identities. However, unknown third-party senders, inconsistent domain configurations and unclear responsibilities make it difficult to implement comprehensive protection. Security teams must therefore establish transparency regarding the domains and sending services in use, while ensuring that stricter protective measures do not disrupt legitimate business communications.

Similar trade-offs arise when combating DNS abuse. Detecting suspicious activity alone does not stop an attack. What matters is ensuring that reliable security information reaches the right parties quickly. Registrars, registries and hosting providers have different options for intervention. While a domain registered specifically for phishing may be blocked, action against compromised legitimate domains must also take account of potential impacts on lawful services. Effective countermeasures therefore require coordinated escalation procedures and targeted intervention at the appropriate infrastructure level.

Cyber resilience is becoming a strategic business responsibility

The different perspectives presented throughout the conference day highlighted a common challenge: Cyber resilience depends on the interaction of regulation, technology, resilient infrastructure and organisational responsibility. Companies must understand their dependencies, implement effective security measures and be able to respond in a coordinated manner, even during a serious incident.

Cybersecurity is thus increasingly becoming a prerequisite for digital competitiveness and value creation. For businesses and policymakers, the priority is therefore to manage the transition from regulatory requirements to genuine cyber resilience - through practical rules, investment in secure infrastructure and close cooperation across the Internet industry.