Cyber Attacks & Operational Shutdown: the Risk for SMEs

56% of Italian organisations hit: are we really this exposed?

The answer is yes, and the data leaves no room for doubt. Claroty's "The Global State of Operational Security 2026" report — based on interviews with 2,000 senior executives worldwide, including 150 in Italy — confirms that more than half of Italian organisations have already suffered an attack with direct operational consequences within a twelve-month period.

The problem is not just frequency: it is the nature of the attacks. 33% of Italian respondents identify ransomware as one of the main risks, and the same proportion cite unsecured or unmonitored third-party access. This second figure deserves particular attention: practice management software vendors, external IT consultants, system maintenance providers — all figures that a professional firm regularly works with — represent an entry vector that is often overlooked in risk assessments.

On average, Italian organisations in the research recorded 3.11 incidents originating from third-party access in the past year. This is not an abstract problem: it is the accounting software supplier who connects remotely, or the external consultant who accesses the firm's network without two-factor authentication.

How ransomware shuts down the firm, not just the data

Ransomware is often described as a tool for "stealing data". That definition is partial and misleading. The actual mechanism works differently: the malware gains entry to systems — via a phishing email, a compromised remote connection or an unpatched vulnerability — and encrypts the files on the affected devices and any servers connected to the network. It does not copy them externally: it makes them inaccessible from within.

For a professional firm, this means the client management system is locked, shared folders are unreadable, and documents in progress are unrecoverable without the decryption key. Work stops. Not partially: completely. Systems remain down until the ransom is paid — with no guarantee of receiving the key — or until everything is restored from a clean backup, an operation that takes hours or days.

The Claroty research confirms this dynamic: in Italy, cyber incidents caused an average of 2.3 hours of operational downtime, but 10% of cases recorded outages of three days or more. For a firm with weekly tax deadlines, three days of downtime is not an inconvenience: it is a professional emergency with real consequences for clients.

A further risk factor stems from the growing adoption of artificial intelligence in operational environments: approximately two in three Italian organisations report using AI technologies in their systems, and 27% of respondents consider AI-driven cyber attacks a significant threat. AI is not only a defensive tool: it can also be used to make attacks faster, more targeted and harder to detect.

Professional liability when client data is compromised

This is the point that many firm owners underestimate: a cyber attack is not just a technical problem — it is a professional liability problem. An accountancy practice or law firm handles sensitive client data — financial positions, disputes, tax records, confidential information — and has precise obligations regarding data protection.

The GDPR requires personal data breaches to be notified to the supervisory authority (the Italian Data Protection Authority, Garante) within 72 hours of discovery, and to the affected clients when the risk to their rights is high. A ransomware attack that encrypts a firm's files almost certainly falls within this category. Failure to notify is a separate infringement, independent of the attack itself.

Added to this are the implications of professional secrecy: unauthorised access to data covered by confidentiality — even if not intentionally disclosed — may constitute a breach of professional conduct obligations. It is not necessary for the data to be published online: it is sufficient that it has been accessible to unauthorised parties.

On the regulatory front, the NIS2 Directive — transposed into Italian law — extends cyber risk management obligations to a broader range of entities, including many that until now considered themselves exempt. In parallel, the AI Act introduces transparency and human oversight requirements for AI systems used in professional contexts. Those who automate processes with AI tools without adequate governance are accumulating regulatory risk, not just technical risk. The Ovia article on the AI Act for professional firms and SMEs examines this point in depth.

Operational resilience for a 5-to-20-person firm: what it really means

"Operational resilience" sounds like a term for large corporations. In reality, for a professional firm of 5–20 people, it means one thing: the ability to keep working — or to resume as quickly as possible — even after an incident. It is not a project costing hundreds of thousands of pounds: it is a set of process and configuration choices that can make the difference between 2 hours of downtime and 3 days.

The first pillar is a verified, isolated backup. Verified means periodically tested: a backup that has never been restored in a test is not a reliable backup. Isolated means physically or logically separated from the main network, so that ransomware encrypting the servers cannot also reach the backup copies.

The second pillar is access control. Knowing who can access what — and quickly revoking access when staff or suppliers change — drastically reduces the attack surface. Claroty's research highlights that in Italy 47% of respondents report IT and OT security governance that is predominantly or fully integrated, while for more than half this integration is not yet complete. In a professional firm, access governance does not require complex systems: it requires a clear policy and correctly configured tools.

The third pillar is documentation of critical processes. If systems go down, it is essential to know immediately which deadlines fall within the next 48–72 hours, how to contact clients through alternative channels and who is responsible for each recovery action. A firm that depends entirely on its software to know what to do is more vulnerable than one that also has a documented Plan B. Tools such as Ovia Second Brain allow firms to maintain an operational memory that remains accessible even in emergency scenarios.

How to reduce the attack surface without overhauling the firm's processes

The good news is that the most effective measures do not require extraordinary technology investments. They require strategic choices about what to protect and how to measure the outcome — precisely the difference between buying a tool and building a system.

The starting point is mapping critical processes: which activities, if disrupted, cause immediate harm to clients? Managing tax deadlines, accessing documents in progress, communicating via certified email (PEC), electronic signing. Once these processes are identified, assess each one: where is the most vulnerable entry point? What is the maximum tolerable downtime? Is there a manual or analogue fallback for the first few hours?

The second step is reducing the number of open doors. Every piece of software that is installed but no longer used, every remote access that was never revoked, every account with a weak password is a potentially open door. No sophisticated scanning is needed: a systematic biannual review of active access rights and software installed on the firm's devices is sufficient.

The third step concerns automation: automated processes, if designed with security in mind, reduce the attack surface by decreasing the manual actions susceptible to human error — the leading cause of cyber incidents. A system that automatically manages document collection, such as Ovia Documents, reduces the number of manual emails with unverified attachments. A system that categorises and assigns incoming emails, such as Ovia Inbox, reduces the risk of a phishing email being opened absent-mindedly by a member of staff. Automation, in this sense, is not just about efficiency: it is also a security control.

Check: is your firm ready to withstand an attack?

• ✓
  Tested 3-2-1 backupYou have at least one copy of critical data on a medium not connected to the network, and you restore it in a test at least every quarter.
• ✓
  Two-factor authentication enabledAll access to the firm's systems — management software, email, cloud — requires a second verification factor.
• ✓
  Third-party access registerYou know who has remote access to your systems, for what purpose and with what expiry date.
• ✕
  Written response planA document exists (even one page) setting out what to do in the first 2 hours of an incident: who isolates the systems, who notifies the Garante, who informs clients.
• ✕
  Critical deadlines exportedThe deadlines for the next 7 days are visible in a format accessible without the main management system.
• ✕
  Annual phishing trainingEvery member of staff has received at least one briefing on how to recognise suspicious emails and what to do if they receive one.

NIS2 and the AI Act: what changes in practice for professional firms

Many firm owners feel they fall outside the regulatory scope of cybersecurity: "those rules are for large companies". That perception is becoming increasingly inaccurate. The NIS2 Directive — which significantly extended the scope compared with NIS1 — and the European AI Act introduce obligations that also apply to medium and small entities, especially those that process third-party data or use AI systems in professional contexts.

NIS2 requires entities within its scope to adopt cyber risk management measures, notify significant incidents within defined timeframes and demonstrate that active security policies are in place. The fact that a professional firm is not a critical infrastructure operator does not automatically exclude it: this depends on its classification as an essential or important entity within the supply chain.

The AI Act introduces transparency and human oversight obligations for AI systems classified as high-risk — including some systems used in legal and tax contexts. Those who use AI agents to process client documents or support decision-making must be able to demonstrate that the system is controlled, auditable and compliant. On this topic, the Ovia article on Italian Law 132/2025 and client disclosure provides an up-to-date overview for professionals operating in Italy.

The convergence of operational security and regulatory compliance is the key point: these are no longer separate compliance streams to be managed in silos, but a single system in which security choices inform compliance and vice versa. Those who build this integration today gain a competitive advantage — and those who defer it accumulate risk.