Greek firms report fewer security incidents of any kind than the EU average, 15.5% against 21.0%. Yet they report almost twice the EU rate of outages caused by attacks from outside, a rate that has risen from 5.0% in 2022.
Where Greek firms stand
All figures cover enterprises with 10 to 249 persons employed in 2024 and compare Greece with the EU average. They come from the Eurostat survey on ICT security in enterprises.
- 65.8% of Greek firms did not make staff aware of their ICT security obligations, against 39.0%. The highest share in the EU.
- 17.7% had documents describing their ICT security measures and procedures, against 34.1%. Third lowest in the EU.
- 54.4% backed up data to a separate location, including the cloud, against 78.8%. Third lowest.
- 27.2% used multi-factor authentication, against 38.7%.
- 6.2% had an incident in which ICT services became unavailable because of an attack from outside, such as ransomware or denial of service, against 3.3%. Third highest in the EU, up from 5.0% in 2022.
- 15.5% reported any ICT security incident at all, against 21.0%.
The missing measures cost little
Security spending tends to be discussed in terms of tools. The Eurostat figures point somewhere less expensive. Four of the measures where Greek firms trail are also among the least costly to put in place.
- a briefing for staff
- a written page of procedures
- a copy of the data kept somewhere else
- a second step at login
None of them is a prohibitively large purchase. Each one is a habit a company has to adopt, though.
Two in three Greek firms of this size do not brief their people on their security obligations at all. No EU country reports a higher share, with Croatia next at 61%. Fewer than one in five have written down what they do about security. Just over half keep a backup away from the original.
The most expensive incident is often one that a briefing, a backup and a second login step would have contained.
What could explain the gap
Interpreting the data alone is not enough to answer why. Greek firms may be attacked less often but also hit harder when they are, because the defences that limit the damage are thinner. Or some incidents may simply go unnoticed until something stops working. Both readings point to the same place. What matters are the measures that turn an attack into an inconvenience rather than a stoppage.
What an outage costs a firm this size
For a firm this size, an outage can affect the full business. When email, files and the production system are down for a day, so is delivery. No offers go out and no invoices are issued. In our view, outside attacks that take services down are the incidents most likely to cost money directly. In the Eurostat data they are also where Greek firms stand out.
The order of work should be based on the gaps.
- First the people, with a short briefing on what the obligations are and what to do when something looks wrong, repeated regularly.
- Then one written page that says who decides what in an incident, who calls whom and where the backups are.
- Then the backup itself, kept separate and tested by actually restoring from it rather than assuming it works.
- Then a second step at login, starting with email.
So tools come after, and they work better once these mechanics exist.
What Eurostat cannot tell
Eurostat counts whether firms have each measure. How well it is applied is outside the survey. It does not measure the cost of incidents either. The survey reflects what firms report, so incidents that went unnoticed are not in it. No error margins are published. The rise from 5.0% to 6.2% is small, so part of it may be sampling noise. The figures cover 2024, the latest round of the security module. They do not separate firms covered by specific cybersecurity rules from the rest.
The Monday check
Answer four questions in writing and give each a date.
- When were staff last told what their security obligations are?
- Where is the one page that says what to do in an incident, and who owns it?
- Where is last night's backup physically kept, and when did someone last restore a file from it?
- Which accounts still open with a password alone, starting with email?
Any question without a date is the first job of the week.
Sources
- Eurostat dataset isoc_cisce_ra (security policy, measures, risks and staff awareness), indicators E_SECAWNONE, E_SECPOL2, E_SECMOSBU and E_SECMDUO, enterprises with 10 to 249 persons employed, 2024
- Eurostat dataset isoc_cisce_ic (security incidents and consequences), indicators E_SEC2IUSVA and E_SEC2IANY, enterprises with 10 to 249 persons employed, 2022 and 2024
Researched and drafted with AI tools from the sources listed; reviewed and edited by Meterknot.
