Cybersecurity in Slovakia: How to Protect Against Growing Threats?
30. marca 2025
Cybersecurity is currently a very important topic, especially in Slovakia. In recent months, the country has experienced an increased number of cyber attacks. The average record shows that organizations in the country faced approximately 1,443 attacks weekly. These attacks, which are often automated, use robotic tools to test vulnerabilities.
In discussion about these attacks, the need for protection and security against such threats also emerges. Various companies, from small businesses to large corporations, must take the protection of their data seriously. Cybersecurity representatives warn that attacks can lead not only to financial losses but also to damage to the reputation and credibility of organizations.
Slovakia faces thousands of cyber attacks weekly. Data protection is essential for business operations. Cybersecurity requires compliance with legislation and regulations.
Statistics and Vulnerabilities
In the last six months, Slovakia has recorded an average of 1,443 cyber attacks per week on one organization. These attacks are mostly automated, with attackers using various robotic tools and botnets to test system vulnerabilities. The attackers' primary goal is to obtain money or sensitive data that can be subsequently misused.
The profit from these attacks can include not only financial resources but also obtaining personal or business information. If an attack occurs, organizations often lose credibility and reputation by being unable to secure their employees' or clients' data protection.
Types of Attacks and Criminal Objectives
Cybercriminals target various organizations and use diverse methods. Common attack types include ransomware - where attackers encrypt data and demand ransom to unlock it. Phishing is an attempt to obtain confidential information through fraudulent emails. DDoS attacks overload servers to disrupt services.
Importantly, all organizations, regardless of size, are potential targets. Organizations can lose money, data, or even the trust of their clients, which has long-term negative consequences.
Reputation and Data Protection
Slovakia encounters a high number of cyber attacks, averaging 1,443 per week for one organization. These attacks are often automated and focus on testing vulnerabilities. Attackers have various objectives, including obtaining sensitive information such as employees' and clients' personal data.
It is crucial for organizations to protect their reputation and data. Information misuse can lead to loss of credibility and image, which is particularly serious for companies processing large volumes of personal data. For example, if a company were to change banks and an attacker sent a false email, it could cause significant damage to all involved parties.
Prevention and Remedial Measures
To protect against cyber threats, strong security is necessary. International guidelines like NIS2 create a framework for cybersecurity. Each state must adapt the requirements of these guidelines to its own legal regulations.
Slovak cybersecurity laws may differ from other countries, but their implementation was one of the best in Europe. Companies should regularly update their security procedures and employee training to prevent attacks and ensure data protection.
Comparison with Other Countries
Slovakia encounters an average of 1,443 cyber attacks weekly per organization. Attackers within these attacks often use automated systems that examine vulnerabilities in organizations. Every country faces cyber threats, but attack intensity varies. For example, in more developed countries like Germany and the United States, identity theft is much more common than in Slovakia.
Additionally, countries differ in their approaches to data protection and cybersecurity. In Slovakia, even though attacks are not as frequent, it is important for organizations to secure themselves against risks. Identity and well-managed data are key to protecting company reputations.
International Cooperation
The European Union attempts to unify cybersecurity approaches through the NIS 2 directive. Each country must adapt its laws according to this directive, leading to different implementations across states. Slovakia has a reputation for good transposition of this directive, which helps improve its cybersecurity.
By cooperating with other member states, Slovakia can share information and experiences, which strengthens collective defense against cyber threats. Given developments, Slovakia should remain flexible and current concerning new standards like NIS 3, which come with new requirements and norms.
NIS Directive and National Law Transposition
Europe introduced the NIS directive, which was replaced by an improved NIS 2 version. This measure is important for protection against cyber threats. Each state must create its own law that reflects NIS 2 directive requirements into national law. This means the Slovak cybersecurity law will differ from those in other countries like the Czech Republic or Austria.
The NIS 2 directive provides a framework for cybersecurity in the EU. Each member state must submit its own law, with Slovak transposition being among the best in Europe.
Updates and Legal Norm Expansion
The NIS 2 directive expanded the number of organizations that must comply with security measures. Previously, this did not apply to manufacturing companies like automotive manufacturers, which are very significant in Slovakia. Currently, protection steps are needed in these sectors.
Key changes in NIS 2: more organizations are subject to regulation, industry specifics are considered (like the automotive sector), planned NIS 3 directive updates for adaptation to new threats.
Manufacturing and Automotive Sector
In Slovakia, cyber attacks also affect the manufacturing sector, primarily the automotive industry. This sector is one of the most significant in the country. Approximately 200 companies are involved in the manufacturing chain. These companies employ a large number of people and process numerous sensitive data.
Automobile manufacturers and suppliers are often targets of automated attacks. These attacks attempt to gain access to sensitive information or disrupt production processes. Attackers focus on system vulnerabilities to obtain financial or other advantages.
Consequences for Medium and Large Enterprises
Medium and large enterprises in the automotive industry face serious challenges due to cyber threats. Attack consequences can lead to loss of customer credibility and trust. When a security breach occurs, companies must face reputation damage, which can have long-term effects on their trading.
Moreover, companies must invest in protection against such threats. This can include implementing new technologies and training employees in cybersecurity. Although protection costs can be high, prevention of cyber attacks is essential for maintaining stability and success in this growing industry.
Upcoming Tools and Innovations
Slovakia faces frequent cyber attacks. On average, this involves 1,443 attacks weekly per organization. These attacks are mostly automated, with botnets testing system vulnerabilities. Attackers aim to obtain valuable data, money, or gain system control. Attacks can take various forms, including data encryption and ransom demands.
Organizations becoming victims lose credibility. Even small companies managing employee and client personal data are at risk. It is important to be aware of these factors and secure against potential threats.
European directives like NIS 2 define cybersecurity requirements. Each state implements these requirements differently, leading to diversity in regulations. New regulations expand obligations to the manufacturing sector, including automotive manufacturers.
New tools and approaches to threat protection are also being prepared. This process is essential for organizations to stay safe from continuously evolving cyber threats.
Source: Ministerstvo dopravy SR. 2025. “DOPRAVA BUDE BEZPEČNEJŠIA.” YouTube, March 23, 2025. https://www.youtube.com/watch?v=NrbPAns7o5A. Accessed: 27. 3. 2025
Cyber Attacks in Slovakia
Statistics and Vulnerabilities
In the last six months, Slovakia has recorded an average of 1,443 cyber attacks per week on one organization. These attacks are mostly automated, with attackers using various robotic tools and botnets to test system vulnerabilities. The attackers' primary goal is to obtain money or sensitive data that can be subsequently misused.
The profit from these attacks can include not only financial resources but also obtaining personal or business information. If an attack occurs, organizations often lose credibility and reputation by being unable to secure their employees' or clients' data protection.
Types of Attacks and Criminal Objectives
Cybercriminals target various organizations and use diverse methods. Common attack types include ransomware - where attackers encrypt data and demand ransom to unlock it. Phishing is an attempt to obtain confidential information through fraudulent emails. DDoS attacks overload servers to disrupt services.
Importantly, all organizations, regardless of size, are potential targets. Organizations can lose money, data, or even the trust of their clients, which has long-term negative consequences.
Securing Against Cyber Threats
Slovakia encounters a high number of cyber attacks, averaging 1,443 per week for one organization. These attacks are often automated and focus on testing vulnerabilities. Attackers have various objectives, including obtaining sensitive information such as employees' and clients' personal data.
It is crucial for organizations to protect their reputation and data. Information misuse can lead to loss of credibility and image, which is particularly serious for companies processing large volumes of personal data. For example, if a company were to change banks and an attacker sent a false email, it could cause significant damage to all involved parties.
Prevention and Remedial Measures
To protect against cyber threats, strong security is necessary. International guidelines like NIS2 create a framework for cybersecurity. Each state must adapt the requirements of these guidelines to its own legal regulations.
Slovak cybersecurity laws may differ from other countries, but their implementation was one of the best in Europe. Companies should regularly update their security procedures and employee training to prevent attacks and ensure data protection.
Global Cybersecurity Context
Slovakia encounters an average of 1,443 cyber attacks weekly per organization. Attackers within these attacks often use automated systems that examine vulnerabilities in organizations. Every country faces cyber threats, but attack intensity varies. For example, in more developed countries like Germany and the United States, identity theft is much more common than in Slovakia.
Additionally, countries differ in their approaches to data protection and cybersecurity. In Slovakia, even though attacks are not as frequent, it is important for organizations to secure themselves against risks. Identity and well-managed data are key to protecting company reputations.
International Cooperation
The European Union attempts to unify cybersecurity approaches through the NIS 2 directive. Each country must adapt its laws according to this directive, leading to different implementations across states. Slovakia has a reputation for good transposition of this directive, which helps improve its cybersecurity.
By cooperating with other member states, Slovakia can share information and experiences, which strengthens collective defense against cyber threats. Given developments, Slovakia should remain flexible and current concerning new standards like NIS 3, which come with new requirements and norms.
Regulations and Legislation
Europe introduced the NIS directive, which was replaced by an improved NIS 2 version. This measure is important for protection against cyber threats. Each state must create its own law that reflects NIS 2 directive requirements into national law. This means the Slovak cybersecurity law will differ from those in other countries like the Czech Republic or Austria.
The NIS 2 directive provides a framework for cybersecurity in the EU. Each member state must submit its own law, with Slovak transposition being among the best in Europe.
Updates and Legal Norm Expansion
The NIS 2 directive expanded the number of organizations that must comply with security measures. Previously, this did not apply to manufacturing companies like automotive manufacturers, which are very significant in Slovakia. Currently, protection steps are needed in these sectors.
Key changes in NIS 2: more organizations are subject to regulation, industry specifics are considered (like the automotive sector), planned NIS 3 directive updates for adaptation to new threats.
Industry Impact
In Slovakia, cyber attacks also affect the manufacturing sector, primarily the automotive industry. This sector is one of the most significant in the country. Approximately 200 companies are involved in the manufacturing chain. These companies employ a large number of people and process numerous sensitive data.
Automobile manufacturers and suppliers are often targets of automated attacks. These attacks attempt to gain access to sensitive information or disrupt production processes. Attackers focus on system vulnerabilities to obtain financial or other advantages.
Consequences for Medium and Large Enterprises
Medium and large enterprises in the automotive industry face serious challenges due to cyber threats. Attack consequences can lead to loss of customer credibility and trust. When a security breach occurs, companies must face reputation damage, which can have long-term effects on their trading.
Moreover, companies must invest in protection against such threats. This can include implementing new technologies and training employees in cybersecurity. Although protection costs can be high, prevention of cyber attacks is essential for maintaining stability and success in this growing industry.
Future of Cybersecurity
Slovakia faces frequent cyber attacks. On average, this involves 1,443 attacks weekly per organization. These attacks are mostly automated, with botnets testing system vulnerabilities. Attackers aim to obtain valuable data, money, or gain system control. Attacks can take various forms, including data encryption and ransom demands.
Organizations becoming victims lose credibility. Even small companies managing employee and client personal data are at risk. It is important to be aware of these factors and secure against potential threats.
European directives like NIS 2 define cybersecurity requirements. Each state implements these requirements differently, leading to diversity in regulations. New regulations expand obligations to the manufacturing sector, including automotive manufacturers.
New tools and approaches to threat protection are also being prepared. This process is essential for organizations to stay safe from continuously evolving cyber threats.
Source: Ministerstvo dopravy SR. 2025. “DOPRAVA BUDE BEZPEČNEJŠIA.” YouTube, March 23, 2025. https://www.youtube.com/watch?v=NrbPAns7o5A. Accessed: 27. 3. 2025
The Critical Infrastructure Association of the Slovak Republic continues its series of articles introducing both the public and the professional community to the individual sectors of critical infrastructure as defined by Act No. 367/2025 Coll. on Critical Infrastructure and on Amendments to Certain Acts. Following sectors such as energy, transport and finance, we now turn to a sector that is part of the daily life of citizens as well as the functioning of the state – postal services.
Asociácia kritickej infraštruktúry Slovenskej republiky pokračuje v sérii článkov, ktorými verejnosti aj odbornej obci predstavuje jednotlivé sektory kritickej infraštruktúry definované zákonom č. 367/2025 Z. z. o kritickej infraštruktúre a o zmene a doplnení niektorých zákonov. Po sektoroch ako energetika, doprava či financie sa tentoraz venujeme sektoru, ktorý je súčasťou každodenného života občanov aj fungovania štátu – poštovým službám.
Until recently, the security of critical infrastructure was associated mainly with the protection of physical facilities, energy sources, or state systems. Today, however, it is increasingly clear that the real vulnerability often lies outside the organisation itself: in its supply chains, technology partners, and external services.
Ešte donedávna sa bezpečnosť kritickej infraštruktúry spájala najmä s ochranou fyzických objektov, energetických zdrojov či štátnych systémov. Dnes však čoraz jasnejšie vidíme, že skutočná zraniteľnosť sa často nachádza mimo samotnej organizácie: v jej dodávateľských reťazcoch, technologických partneroch a externých službách.
V januári 2024 zamestnanec finančnej spoločnosti v Hongkongu uskutočnil prevod v hodnote 25 miliónov amerických dolárov. Urobil tak po videokonferencii s finančným riaditeľom a kolegami z centrály, ktorá pôsobila úplne autenticky. Na konferencii však bol jediný skutočný človek on sám. Ostatní účastníci boli deepfake repliky vygenerované generatívnou umelou inteligenciou na základe verejne dostupných záznamov. Tento prípad, zdokumentovaný hongkonskou políciou, neoznámil príchod novej hrozby. Oznámil, že hrozba je už tu a funguje v produkčnom režime.
The Critical Infrastructure Association of the Slovak Republic is proud to present the success of two of its members, Decent Cybersecurity s. r. o. and FREQUENTIS Solutions & Services s. r. o., which have jointly secured funding for the four-year research and development project COSMOS-SECURE. The project, with total eligible expenditures of EUR 4,144,273.37 and a requested non-repayable financial contribution of EUR 2,981,048.65, focuses on an area that, until recently, belonged mainly to major space agencies: secure voice communication between ground stations, satellites, and spacecraft crews in an era when quantum computers are beginning to challenge the existing foundations of cryptography.
Asociácia kritickej infraštruktúry Slovenskej republiky s hrdosťou predstavuje úspech dvoch svojich členov, spoločností Decent Cybersecurity s. r. o. a FREQUENTIS Solutions & Services s. r. o., ktoré spoločne získali financovanie pre štvorročný výskumno-vývojový projekt COSMOS-SECURE. Projekt s celkovými oprávnenými výdavkami vo výške 4 144 273,37 € a požadovanou výškou nenávratného finančného príspevku 2 981 048,65 € sa zameriava na to, čo bolo donedávna doménou veľkých vesmírnych agentúr: bezpečnú hlasovú komunikáciu medzi pozemnými strediskami, satelitmi a posádkami vesmírnych lodí v ére, keď kvantové počítače začínajú spochybňovať existujúce kryptografické základy.
The Slovak Republic is in the final phase of a process that is fundamentally changing the approach to the protection of critical infrastructure. In accordance with Act No. 367/2024 Coll. on Critical Infrastructure, the list of entities that will be officially identified as critical for the functioning of the state is to be completed in July 2026. This step represents one of the most important milestones in the implementation of the new regulatory framework, the aim of which is to increase the resilience of key systems to crises, cyber threats and service outages. A new framework of responsibility Inclusion among the critical entities will not be of a merely formal nature. For the organisations concerned, it will mean the introduction of precisely defined obligations in the area of risk management, security measures, incident management and the very continuity of the provision of essential services within the meaning of the Act. For many entities, this represents a fundamental change in the approach to security, which will require systematic preparation even before the actual inclusion in the list. Growing interest of companies in the regulation Already in this period it is evident that potentially affected entities are beginning to intensively follow the development of the legislation and of the implementing rules being prepared. The reason is the need to set up internal processes in good time, so that the transition to the new regime can take place without major operational complications. The growing demanding nature of the requirements is at the same time increasing the demand for expert guidance and methodological support. The role of the Critical Infrastructure Association of the Slovak Republic In this context, the Critical Infrastructure Association of the Slovak Republic (AKI SR) plays a significant role, as it has long been creating a professional platform for cooperation between the state sector, regulators and operators of essential services across all sectors of critical infrastructure, such as for example energy, transport, healthcare or digital infrastructure. As Tibor Straka, President of AKI SR, states: “The process of identifying critical entities is not merely a legislative obligation. It is the moment that determines how resilient the state will be in real crisis situations.” The Association points out in this connection that the period before the final inclusion in the list is the most important one for organisations from the point of view of preparation and adaptation. Room for timely preparation Companies that may be part of the list of critical entities currently have a unique opportunity to prepare for the new obligations systematically and well in advance. In this area, AKI SR provides expert support, methodological guidance and a platform for the sharing of experience between the individual sectors. Cooperation as the foundation of resilience The implementation of the new system for the protection of critical infrastructure will be successful only if it is built on close cooperation between the public and the private sector. In this respect, AKI SR is developing a systematic dialogue with the central bodies of state administration that exercise state administration in the individual segments of critical infrastructure. With many of them, the Association has concluded memoranda of cooperation, which makes possible a more effective interconnection of expert capacities, the exchange of information and coordination in addressing key security topics. In the process, AKI SR thus acts as a natural communication and expert bridge between the regulator and the entities of critical infrastructure, while helping to connect legislative requirements with their practical implementation in the individual sectors. A new stage in the protection of critical systems The finalisation of the list of critical entities in July 2026 represents a fundamental step in the modernisation of the system for strengthening the resilience of critical infrastructure in Slovakia. The new legislative framework sets clearer rules, but at the same time significantly raises the demands placed on the preparedness of the organisations concerned. The outcome of the entire process will depend on how well it is possible to align the regulation with the reality of the operation of critical entities.
Slovenská republika sa nachádza v záverečnej fáze procesu, ktorý zásadne mení prístup k ochrane kritickej infraštruktúry. V súlade so zákonom č. 367/2024 Z. z. o kritickej infraštruktúre má byť v júli 2026 dokončený zoznam subjektov, ktoré budú oficiálne identifikované ako kritické pre fungovanie štátu. Tento krok predstavuje jeden z najdôležitejších míľnikov implementácie nového regulačného rámca, ktorý má za cieľ zvýšiť odolnosť kľúčových systémov voči krízam, kybernetickým hrozbám a výpadkom služieb. Nový rámec zodpovednosti Zaradenie medzi kritické subjekty nebude mať len formálny charakter. Pre dotknuté organizácie bude znamenať zavedenie presne definovaných povinností v oblasti riadenia rizík, bezpečnostných opatrení, incident manažmentu a samotnej kontinuity poskytovania základných služieb v zmysle zákona. Pre mnohé subjekty ide o zásadnú zmenu prístupu k bezpečnosti, ktorá si bude vyžadovať systematickú prípravu ešte pred samotným zaradením do zoznamu. Zvyšujúci sa záujem firiem o reguláciu Už v tomto období je zrejmé, že potenciálne dotknuté subjekty začínajú intenzívne sledovať vývoj legislatívy a pripravovaných vykonávacích pravidiel. Dôvodom je potreba včas nastaviť interné procesy tak, aby prechod do nového režimu prebehol bez zásadných prevádzkových komplikácií. Rastúca náročnosť požiadaviek zároveň zvyšuje dopyt po odbornom vedení a metodickej podpore. Úloha Asociácie kritickej infraštruktúry SR V tomto kontexte zohráva významnú rolu Asociácia kritickej infraštruktúry Slovenskej republiky (AKI SR) , ktorá dlhodobo vytvára odbornú platformu pre spoluprácu medzi štátnym sektorom, regulátormi a prevádzkovateľmi základných služieb naprieč všetkými sektormi kritickej infraštruktúry, ako je napríklad energetika, doprava, zdravotníctvo či digitálna infraštruktúra. Ako uvádza prezident AKI SR Tibor Straka: „Proces identifikácie kritických subjektov nie je len legislatívna povinnosť. Je to moment, ktorý určuje, ako odolný bude štát v reálnych krízových situáciách.“ Asociácia v tejto súvislosti upozorňuje, že obdobie pred finálnym zaradením do zoznamu je pre organizácie najdôležitejšie z hľadiska prípravy a adaptácie. Priestor na včasnú prípravu Firmy, ktoré môžu byť súčasťou zoznamu kritických subjektov, majú v súčasnosti jedinečnú príležitosť pripraviť sa na nové povinnosti systematicky a s dostatočným predstihom. AKI SR v tejto oblasti poskytuje odbornú podporu, metodické usmernenia a platformu na zdieľanie skúseností medzi jednotlivými sektormi. Spolupráca ako základ odolnosti Implementácia nového systému ochrany kritickej infraštruktúry bude úspešná len vtedy, ak bude postavená na úzkej spolupráci medzi verejným a súkromným sektorom. V tomto smere AKI SR rozvíja systematický dialóg s ústrednými orgánmi štátnej správy, ktoré vykonávajú štátnu správu na jednotlivých úsekoch kritickej infraštruktúry. S mnohými z nich má asociácia uzatvorené memorandá o spolupráci, čo umožňuje efektívnejšie prepájanie odborných kapacít, výmenu informácií a koordináciu pri riešení kľúčových bezpečnostných tém. AKI SR tak v procese vystupuje ako prirodzený komunikačný a odborný most medzi regulátorom a subjektami kritickej infraštruktúry, pričom pomáha prepájať legislatívne požiadavky s ich praktickou implementáciou v jednotlivých sektoroch. Nová etapa ochrany kritických systémov Finalizácia zoznamu kritických subjektov v júli 2026 predstavuje zásadný krok v modernizácii systému zvyšovania odolnosti kritickej infraštruktúry na Slovensku. Nový legislatívny rámec nastavuje jasnejšie pravidlá, ale zároveň výrazne zvyšuje nároky na pripravenosť dotknutých organizácií. Výsledok celého procesu bude závisieť od toho, ako dobre sa podarí zosúladiť reguláciu s realitou prevádzky kritických subjektov.
In August 2023, something happened on the Polish railways that until then had belonged to the realm of scenarios, not reality. Unknown actors abused the radio system for emergency stopping (radio-stop) and transmitted a signal that brought more than 20 trains to a halt in various regions of the country. The attack required no access to digital systems and no sophisticated malware. A radio transmitter and knowledge of publicly available tones were enough. It was a demonstration of why rail transport ranks among the most complex categories of critical infrastructure. It brings together older analogue and radio technology with contemporary IT and OT systems, and each of these layers has its own vulnerabilities.