Poland recorded 31,200 cybersecurity incidents in July 2026, according to CERT Polska. That was 12% more than a year earlier and highlights how quickly cyber risk is becoming a board-level business issue rather than a purely technical one. At the same time, a majority of organisations surveyed internationally say regulation is improving security — but turning rules into durable operational resilience remains much harder than achieving formal compliance.
The regulatory backdrop is becoming increasingly important for companies operating in Poland and across the European Union. NIS2 expands cybersecurity obligations across a wide range of sectors, while DORA imposes detailed requirements on financial institutions and their technology suppliers. Both frameworks are designed to make organisations more resilient before a disruption occurs, not simply improve reporting after an incident.
Regulation is raising awareness — and exposing weaknesses
Data cited in the source material show that 74% of organisations take a positive view of cybersecurity regulation. More than half, 55%, say legal requirements have already improved security and reduced IT risk, while 58% point to higher awareness among management and employees as a key benefit. Around 30% also see stronger customer trust and brand credibility.
The difficulty begins when an organisation has to connect regulatory duties with everyday operations. Cybersecurity information is often spread across separate systems and departments. Without common data, ownership and escalation rules, companies may meet documentation requirements but still struggle to identify the real business impact of an incident.
Supplier risk is becoming part of the security perimeter
DORA in particular makes third-party technology risk a core governance issue. Organisations are expected to assess ICT suppliers before signing contracts, monitor them throughout the relationship and prepare exit strategies in case a critical provider fails or no longer meets security requirements.
This is a major shift for companies that have historically treated cybersecurity as something that ends at the edge of their own network. Cloud infrastructure, managed services, software vendors and open-source components can all become part of the operational risk chain.
In the survey data, 18% of respondents said ensuring that contractors meet regulatory requirements is already one of their main challenges. That figure is important because many high-impact cyber incidents begin not in the primary organisation, but through a supplier with weaker controls.
The skills gap remains one of the biggest obstacles
Regulation can force organisations to adopt new procedures, but it cannot instantly create the expertise needed to operate them. Around 17% of companies say they still struggle to understand how new requirements apply across the organisation, 16% point to limited internal resources and specialist knowledge, and 11% report difficulties implementing changes consistently between departments.
The gap is particularly visible among organisations with low digital resilience. In the data cited by the source, 34% of low-resilience companies described regulation as ineffective because of skills shortages, compared with just 6% of high-resilience organisations. More than half of low-resilience organisations — 53% — reported a lack of cybersecurity skills.
Compliance is not the same as resilience
The key business distinction is increasingly between formal compliance and operational resilience. A company can have policies, checklists and audit documentation while remaining poorly prepared for a real incident. Effective cybersecurity requires integrated data, clear accountability, tested continuity plans, supplier controls and employees who understand their role when something goes wrong.
For Polish companies, that challenge is becoming more urgent as the number of incidents continues to rise. The July data from CERT Polska show that cyber risk is no longer a scenario companies can plan for occasionally. It is becoming a constant operating condition — and regulation is most useful when it changes how organisations actually work, not only what they report.
Sources: CERT Polska, Global Cybersecurity Outlook 2026, NIS2 and DORA materials cited in the original analysis.
