The Clusit Report published in March 2026 counts 5,265 serious incidents worldwide during 2025, a 48.7% increase in a single year and the sharpest rise ever recorded. In Italy the increase stops at 42%. These numbers come after a decade of security investment, not before it.
October is European Cybersecurity Month, and this year it lands on top of a real deadline: by October 31, NIS2 operational measures must be running for essential and important entities in Italy. We asked Marco, Head of Sales at CyberGrant, what he actually hears in the rooms where these decisions get made. His answer runs against the season: in the month when everyone talks about security, he would rather talk less.
How cybersecurity is understood inside private and public organizations has clearly matured over the past few years. Not every reason for that shift is a good one. On one side, organizations have adopted real security models, backed by regulation aimed at protecting information and the business itself, and that is genuine progress. On the other, we have seen an explosion of self-declared cybersecurity experts, and that upsets the delicate balance between what customers actually need and what the market puts in front of them.
So my view is that we should use fewer words and fewer concepts, and give weight to the ones that matter. Today you have to put the data at the center of every cybersecurity project, and protect it through its entire life cycle, wherever it sits and whoever holds or accesses it.
Sovereignty. On-premise. Data protection. AI.
Those are the words that dominate meetings, events, webinars and one-to-one conversations with the people responsible for securing corporate infrastructure.
These are well-informed people. They know what is happening inside their own area of responsibility, and every week we see reports with incident indicators. What they need is to move their budget from perimeter security to permanent security.
That is what security leaders are asking for: permanent protection of their assets, which means their data.
Because we keep measuring security with the wrong metric. Over the past ten years Italian companies have built very solid perimeters: firewalls, segmentation, access control, user protection, a SOC. All of it correct. All of it insufficient, because the work no longer happens inside the perimeter. It happens in a folder shared with a supplier, in an attachment sent to a law firm, in a file opened on a consultant's laptop at an airport. The moment the document leaves, none of those measures count.
This may sound off-center. The question CISOs and CIOs increasingly ask themselves is this one: how do I protect my company's business?
How sensitive information and confidential data get protected is now the real differentiator, the one that decides whether a company survives in its own market.
It is an out-of-the-box question when you set it against the daily work of a security leader.
And it is an uncomfortable question, because it calls for an honest answer, which in most companies turns out to be: I don't know. Files today live a life of their own, usually with no protection, no access limits and no classification that says how important they are.
At CyberGrant our answer to that question is clear, simple, and above all aligned with what CISOs and CIOs want: a file should be protected and classified from birth and for its whole life. FileGrant, the file-centric platform from CyberGrant, encrypts the document as it is created and carries that protection wherever the file goes, including outside the corporate network, with the ability to revoke access after sharing.
In meetings with security teams I often walk through scenarios, use cases and references where our platform protects sensitive corporate information.
At that point, with our positioning, our capabilities and our commercial terms on the table, the objection my counterpart raises is really with himself: how do I act on the two or three real use cases in my own company that just surfaced in this conversation?
Very often they are use cases that the technology already in place cannot deliver: encrypting and classifying files and folders in SharePoint or OneDrive; encrypting and classifying non-Office file types (CAD, signed PDFs, images, custom applications); protected and governed sharing with outside parties; data sovereignty, meaning where corporate files are actually stored; "no god admin", meaning only authorized people can open the file; a fully on-premise deployment.
For the SharePoint and OneDrive part, our answer is CyberGrant Connector: it brings encryption inside the existing libraries, with no migration, and it covers non-Office files too.
Real, current, and still underestimated in too many places.
An employee who pastes a contract, a quote, an invoice or an employment letter into an LLM to get a summary breaks no network policy, triggers no alert and shows up in no log. They have simply handed that content to a model that is not the company's.
The companies taking this seriously are not banning AI. They are doing the opposite, building it into their processes, from operations to the business itself. How? They bring it in-house. AIGrant, the private on-premise AI extension from CyberGrant, does exactly that: an enterprise RAG that lets you chat with, search and summarize internal documents without those documents ever leaving the organization.
I would not presume to give advice to professionals with proven experience in a field where I have always valued working relationships and treated people with respect.
That said, and not only because of the role I hold, I would encourage the person across from me to take a sheet of paper and a pen and split it into three columns: 1) sensitive data; 2) current level of protection for that data; 3) consequences of losing it.
I am convinced that a completed sheet of paper will be worth something to the CISO, and to the company they work for.
Being able to show you a stack of those sheets, filled in by CISOs, with a fourth column: what CyberGrant added.
File-centric data protection puts security inside the file instead of around the network. The document is encrypted the moment it is created, and that protection follows it anywhere: onto another computer, into a supplier's cloud, into a consultant's inbox. Unlike legacy DLP, which polices the exits, file-centric protection still applies after the file has left.
Legacy DLP watches channels: email, endpoints, uploads. It works while the data sits inside the perimeter and while the channel is controlled. Once an authorized user legitimately shares a document, perimeter DLP has no say. File-centric protection starts from the opposite assumption: the file will leave, and it has to stay protected afterward.
Yes. Connector is an extension of FileGrant, not a standalone product: it brings the quantum-safe encryption of CyberGrant's file-centric platform inside SharePoint and OneDrive.
No. CyberGrant Connector sits alongside Microsoft 365 and requires no migration: documents stay in the existing libraries and users keep signing in with their Microsoft credentials. It covers what Purview leaves exposed, in particular non-Office files such as CAD drawings, signed PDFs, images and application exports. The ToolShell case shows what happens when that cover is missing.
No. Files encrypted by Connector stay unreadable to any AI system that indexes SharePoint and OneDrive libraries, Microsoft Copilot included. The encryption is zero-knowledge: not even Microsoft tenant administrators can open them.
Shadow AI is the use of public AI tools with company data, outside any policy. It is hard to detect because it produces no security event: pasting a contract into a public assistant breaks no network rule, raises no alert and leaves no trace in the logs. The workable alternative is not a ban, it is bringing the capability in-house with an on-premise enterprise RAG such as AIGrant.
Quantum-safe describes algorithms designed to resist attacks from a future quantum computer. CyberGrant uses CRYSTALS-Kyber, standardized by NIST as FIPS 203 (ML-KEM) in August 2024. It answers the "harvest now, decrypt later" problem: data stolen today and stored until it can be decrypted, a concrete risk for information with multi-year value such as patents, clinical records and contracts.
Italian Legislative Decree 138/2024, in force since October 16, 2024, requires essential and important entities to have operational security measures running by October 2026. The most current reference for the detail of those measures is ACN Determination 127437 of April 13, 2026. Protecting data shared with third parties falls within scope.