Reflecting on Cybersecurity Readiness for Organizations: From Awareness to Action

In a recent panel discussion hosted by Beetroot, our guest experts spoke on the escalating importance of cybersecurity readiness for organizations in the face of an increasingly hostile digital landscape. The panel, led by Beetroot’s Chief Growth Officer, Sebastian Streiffert, explored the need to move from general awareness to actionable strategies in mitigating cyber threats.

We were happy to welcome Per-Olov (Peo) Humla, the Chief Executive Officer at Redigo AB, a cybersecurity expert and startup mentor Artem Mykhailov, Detectify’s VP of Product, Danwei Tran Luciani, and Noel Duarte, the Chief Growth & Product Officer at Beetroot Academy. The discussion covered a range of critical topics, including:

• The importance of cybersecurity readiness for businesses of all sizes
• Challenges organizations face in implementing effective cybersecurity strategies
• The role of AI in cybersecurity, both in terms of its potential benefits and risks
• Current cyber attack patterns and vulnerabilities
• Practical steps for transitioning from awareness to action
• Tools and resources for improving cybersecurity resilience, and more.

What Is Cyber Readiness?

In the past few years, the situation in Europe has changed dramatically in terms of cybersecurity due to the ongoing hybrid war and the constant targeting of critical infrastructure. Cyber readiness refers to an organization’s ability to predict, avert, respond to, and recover from cyber threats. The task of keeping our tech and digital assets safe has become more important than ever.

The Importance of Cybersecurity Readiness

With increasing cyber threats, businesses can no longer afford to treat cybersecurity as an afterthought. We asked our panelists whether the companies they encounter are generally as ready and prepared to solve a problem within cybersecurity as they think they are. Answers varied.

In Artem’s practice, there were companies confident they’ve got everything covered and only needed some “final touches” that were, in fact, far from cybersecurity maturity, and there were the opposite examples.

Danwei acknowledged that many of Detectify’s customers are extremely knowledgeable in the field, some of them being pioneers and ethical hackers themselves. At the same time, while being professionals, they are aware that the wisdom window gets bigger, and they need to be continuously ready for things that can happen.

Peo’s answer is “maybe.” He explained that while many engineers and security professionals are highly aware of risks, the real issue lies in the disconnect between technical teams and C-level decision-makers, especially in larger organizations that often prioritize time-to-market over security. This gap between knowledge and execution means that while companies may believe they are prepared, their actual security posture is often weaker than they assume.

To sum up, cybersecurity readiness is a process. As Artem put it, at some point, “you finally realize that you’re far away from perfect, but you’re already not the basic. With the nature of cybersecurity, there’s always room for improvement.“

Current Cyber Attack Patterns and Vulnerabilities

Artem Mykhailov cautioned against the rising threat of supply chain attacks, where adversaries target entire ecosystems rather than individual vendors. He also noted the increasing sophistication of social engineering tactics fueled by advancements in AI.

Regarding the evolution of threats over the years, what once was the work of individual hackers has now become a full-fledged industry. Cybercrime has been commercialized, with services like ransomware-as-a-service allowing even those with minimal technical skills to launch sophisticated attacks. 

The introduction of machine learning and automation has further escalated the situation, enabling attackers to launch between 20,000 and 50,000 cyber attack attempts every second. This level of efficiency and scale underscores the urgency of the issue.

How should companies respond to that, you ask?

• Be pragmatic and proactive

Too often, security companies rely on scare tactics to navigate cyber threats and responses, warning businesses that disaster is inevitable if they don’t take immediate action. Peo Humla highlighted this, arguing for a shift in mindset: one that acknowledges the reality of modern cyber threats without resorting to alarmism. 

In reality, in many cases, attackers are already inside networks, so organizations can no longer assume their systems are secure; they must work under the assumption that breaches have occurred and take proactive measures to detect and contain threats.

Rather than reacting with fear, organizations must embrace cybersecurity knowledge and educate themselves about modern threats, understand how cybercriminals operate, and adopt proactive defense strategies. 

• Ramp up the collective force

Another important observation is that while a lot of the defense initiatives in Europe are country-based or Union-based, malicious actors couldn’t care less about country borders. What Danwei Tran Luciani finds important is the collaboration between governments, private sectors, and international organizations to ramp up their collective forces. 

Playing by the rules, especially in defense, is much harder than playing offense because “as a defender, you have to succeed every time. As an attacker, you just have to succeed once.”

• Embrace accountability and transparency

Artem Mykhailov highlighted the growing legal obligations surrounding cybersecurity, particularly in Europe. Organizations can no longer choose whether to disclose breaches — when critical infrastructure or personal data is affected, reporting is now mandatory by law. This regulatory landscape is only becoming stricter, making it increasingly difficult for companies to swerve from these obligations. 

• Turn urgency into action

From Noel’s perspective, the widespread awareness of the risks in Europe and North America creates an opportunity to seize the momentum and channel concern into meaningful action. Rather than fueling fear, organizations should use this urgency to drive change in human behavior — encouraging engineering teams to adopt secure practices and ensuring employees at all levels take cybersecurity seriously.

If you’re looking to build a strong cybersecurity team in your organization, check out our recent article for essential best practices on where to start.

The Role of AI in Cybersecurity

The integration of AI tools into cybersecurity was a major point of discussion. While AI can enhance threat detection and response, the panelists acknowledged its potential for misuse by malicious actors. The accessibility and responsible use of AI in cybersecurity for organizations of all sizes were also explored.

How can AI be used to aid the defenses?

Both the market and organizations in research fields have started to see substantial AI models that are well-tuned and very skilled to enhance defense mechanisms. As Artem explained, there are numerous areas where AI could shine, for example, in functions of a Security Operation Center (SOC), being one step before substituting the layer-one analyst.

• Automated threat detection 

LLMs can process hundreds of alerts each day with large volumes of technical data potentially more effectively than humans because it’s physically challenging to maintain the full picture consisting of multiple parameters, regardless of one’s professional experience and skills. 

Compiled and categorized data can be further used for anomaly detection, predictive analytics,  and faster incident response.

• Personalized training support

Another cybersecurity realm where AI stands out is awareness training. Ideally, awareness programs should be integrated into teams’ workflows. By understanding employees’ behavioral patterns, an AI agent could ingest this necessary knowledge into a person’s daily activities, enhancing training quality. 

Risks & Challenges of Using AI in Cybersecurity

• While AI is being implemented everywhere, including in cybersecurity, it’s also used on the adversary side, and historically, adversaries are one step ahead of their potential victims.
• Vertical AI agents, where one master AI agent helps attribute data between smaller dedicated (micro) agents for specific tasks, seem a viable and future-proof option from Artem’s perspective. Their training, however, remains an obstacle.
• Unlike tech world behemoths such as Microsoft, Amazon, or Google, smaller companies have limited access to data about cyber attacks. Yet, even these giants struggle with ingesting this data into their LLMs for training because it is often unstructured, which keeps us from improving quicker than we probably could.

Challenges in Achieving Cybersecurity Readiness

• Resource availability and affordability

One of the biggest hurdles organizations face is a lack of resources and expertise. As Noel acknowledged, many companies believe they’re too small to afford cybersecurity measures. In reality, though, resources exist for organizations of all sizes.

Rather than over-believing in technology, Peo Humla suggests that the “combination of people, processes, and technology in a holistic way with distinct and benchmarked frameworks that you are using” works best for SMEs and smaller companies.

• Human factor

Another challenge is human behavior. A basic example is password hygiene. Unfortunately, users often use shared passwords to access some kind of service or account, even though many of them know they could do better. 

As Artem mentioned, this mistake comes up repeatedly during cybersecurity training and is what researchers are still struggling to eliminate as a single first point of error, according to Peo. 

From weak passwords to phishing scams, employees often are the most vulnerable link in an organization’s security system.

Measuring Organizational Security Readiness

The panel acknowledged the challenge of measuring cybersecurity readiness but suggested focusing on both technical and non-technical elements. Regular penetration testing, vulnerability scanning, and tracking adherence to security practices were highlighted as crucial metrics.

While many organizations and companies in the market are using a cyber maturity model (cyber maturity assessment), Peo also advocates for using CIS Controls (a set of 18 critical security controls) to organize cybersecurity efforts. These safeguards can be adapted to different levels of ambition and maturity, allowing businesses to quickly assess their security posture. CIS Controls provide a more immediate, actionable, and scalable starting point for organizations looking to improve their cyber preparedness vs. a full cyber maturity assessment.

Key Elements of Cybersecurity Readiness

The panelists agreed on several fundamental principles for cybersecurity readiness:

• Zero Trust architecture: Organizations should assume that no user or system is inherently trustworthy.
• Multi-factor authentication (MFA): As Peo advised, MFA should be mandatory across all accounts, especially for administrators.
• Incident response planning: Companies must have a predefined plan for handling cyber incidents.
• Security training and awareness: Noel emphasized the importance of buy-in across all levels, from engineers with production-level access to data to HR teams.
• Regular security audits and assessments: Self-assessment frameworks such as CIS Controls help organizations identify vulnerabilities.

Selecting the right cybersecurity partner might be a crucial step in strengthening your cyber defenses. Explore our expert guide to make an informed choice for your business.

Tools and Techniques to Evaluate Cybersecurity Posture

The number of cybersecurity frameworks and regulations makes it difficult for organizations to choose the right one without prior knowledge. As Artem noted, some frameworks are broadly applicable, such as ISO 27000 (widely used in Europe) and SOC2 (de facto standard in the US). Others are industry-specific, like PCI DSS (for financial services) and HIPAA (for healthcare). 

Companies in highly regulated industries oftentimes must comply with multiple frameworks, which often overlap in their requirements. He advises that smaller companies or startups shouldn’t rush into regulatory-heavy frameworks like ISO 27000 or SOC2 unless they are required. They could start with the already mentioned  CIS Controls and align these with industry-specific frameworks later. 

In Peo’s opinion, while cybersecurity professionals might be “framework geeks,” that’s not always practical. Instead of overwhelming companies with compliance and regulations, he suggests a more hands-on approach that starts with internal conversations about risk tolerance: What can we accept happening, and what can we absolutely not accept? 

The answer should come from stakeholders from all levels, from technical teams to executives. After that, they should proceed with a structured but manageable self-assessment session and take tangible steps toward better security based on their real business needs. His perspective is that understanding risk and defining priorities should come before selecting a framework.

Danwei Tran Luciani added another dimension, cautioning that organizations shouldn’t blindly follow regulations and frameworks without understanding their true purpose. She urged businesses to think beyond checking compliance boxes and instead focus on why they need security in the first place. That’s what her team is dedicated to: they want to be compliant to keep the internet secure. 

Her insight is that cybersecurity should start with self-awareness — knowing what’s valuable and vulnerable and what business-critical aspects you protect — before implementing rules and controls. A big step to start the security journey could be getting a certification.

Conclusion: The Need for Continuous Improvement

Cybersecurity is not a one-time fix, and companies must approach it as an ongoing commitment rather than a compliance checkbox. The panelists agreed that organizations must continuously adapt to emerging threats and prioritize security at every level. After all, we can’t afford to be reactive in today’s cyber reality; security needs to be proactive, collaborative, and ingrained in company culture. 

Think we might have missed something important? Visit the event page to get the full recording  and subscribe to our upcoming events to keep up with more industry insights and expert advice.