Cybersecurity rises on company agendas, but basic practices still fall short

Cybersecurity has gained attention in company leadership, but many organizations still miss basic security measures, according to Klas Bergwall, chief security officer at Advania Sverige. He told Techtidningen that many cyberattacks could have been avoided through simple steps, and that everyday mistakes and routines that go unfollowed are often at the root.

Advania established Cyberhygiendagen Advania on October 20 to encourage companies and individuals to review their digital security habits. Bergwall compares cyber hygiene to daily routines such as handwashing: small actions that matter when done consistently.

He attributes gaps in basic security to limited resources, skills shortages and competing priorities. Smaller companies may lack their own security teams and rely on external consultants. Common shortcomings include systems that have not been updated and multifactor authentication that is not enabled everywhere. Even one system without multifactor authentication can leave a weakness an attacker might try to exploit.

Security also depends on workplace culture, Bergwall said. Employees should be able to report mistakes and raise risks, and organizations need to address them. He said geopolitical conditions and new regulations have raised cybersecurity’s profile among company leaders and boards, but greater awareness does not always lead to the decisions needed to improve security. Some organizations act more readily after an incident.

AI can help attackers improve phishing emails and map IT environments and vulnerabilities, Bergwall said, making basic security work more important. He recommends testing routines, running exercises and measuring progress regularly. Bergwall tracks indicators including system updates, vulnerabilities, security awareness and supplier risks each month. He cautioned that security levels can slip if organizations stop following up after an improvement.