None of eight audited critical infrastructure operators in energy, rail and water transport, and water supply ensured that their systems were resilient against breaches of data confidentiality, integrity, availability and authenticity, according to Poland’s Supreme Audit Office (NIK). Six routinely ignored critical alerts from their own monitoring and security systems, while some conducted no monitoring at all. National CSIRT teams handled almost 273,000 incidents in 2025, up 144.4% year on year.
Eight operators, the same conclusion
NIK examined eight essential-service operators under the National Cybersecurity System Act (KSC), alongside the ministries responsible for digital affairs, energy and infrastructure. Its conclusion applied to every operator inspected: none had ensured resilience of the systems supporting essential services against actions compromising processed data.
The most concerning finding was not a lack of tools, but how existing ones were used. Six of eight operators systematically ignored critical monitoring alerts, and in some cases no security monitoring was performed. Warning signals that might have prevented incidents therefore went unaddressed even where detection infrastructure existed.
NIK also found that the KSC supervisory mechanisms, operating for more than seven years, had not effectively compelled operators to meet their statutory duties, although supervising ministries knew their safeguards were insufficient.
“This report shows something more important than a list of formal shortcomings: having a monitoring system guarantees nothing in itself. What matters is whether the organisation actually responds to its signals and treats security as a coherent policy covering the entire network, rather than a collection of separate, disconnected safeguards,” said Konrad Badowski, Business Relationships Manager at Axis Communications.
The consequences extend beyond compliance
A successful attack on water-treatment controls could disrupt disinfectant dosing, while an attack on energy infrastructure could cause prolonged power outages across large areas. Against that background, the almost 273,000 incidents handled by national CSIRTs in 2025, a 144.4% increase, represent a practical threat. Poland has long been among the countries most frequently targeted by cybercriminals.
The state is providing funding. The “Cybersecure Water Utilities” programme allocated PLN 602 million through 733 contracts to modernise water utilities’ IT infrastructure. A sectoral CSIRT for transport and water management has also been established at the Infrastructure Ministry.
But NIK’s findings show that funding and technology alone will not solve the problem unless operators change how they respond to what their systems detect.
Monitoring devices also require protection
Monitoring environments include sensors, cameras, access controllers and other edge devices. These operational-technology components provide information for detecting threats, but also connect to networks and can become attack vectors.
That distinction is sometimes overlooked in discussions focused on IT systems and procedures. Less attention is paid to whether the data-collecting device itself has been designed to avoid becoming another vulnerability.
“An edge device—a network camera, sensor or access controller at a power plant or water-treatment facility—is increasingly treated solely as a source of images or data, rather than as a full network component that must be secured as rigorously as a server or operator workstation. Without built-in integrity mechanisms, digitally signed firmware and security updates throughout its lifetime, such a device becomes the weakest link, regardless of how well the rest of the system is protected,” Badowski said.
What operators need to address
The audit exposes a gap that new tools alone cannot close: six operators had monitoring systems yet ignored their alerts. Critical infrastructure cybersecurity requires an integrated approach.
Every connected device, including cameras and sensors, forms part of the attack surface and requires the same discipline as servers and operator workstations: inventory, regular updates and an actual response to alerts, rather than formal compliance alone. Without that, a future audit could reach very similar conclusions.
Source: ManagerPlus, citing NIK; commentary from Axis Communications.
