Many companies picture an attack as someone breaking through server defences. In practice it starts with a message that looks perfectly ordinary: an invoice from a long-standing supplier with a new account number, or a request to log in urgently. CERT Polska recorded 260,783 incidents in 2025, 152 percent more than a year earlier, and 97 percent of them were fraud. That is why this page starts with people rather than a list of products.
We keep this separate from neighbouring pages so nothing is said twice. The network edge, the firewall and what is visible from the internet are covered under the secure company network. Backups and recovery sit with backup, endpoint protection with Sophos. What is here is what ties those layers together: people, the order of spending, and the response once something happens. In law firms we usually start with encrypting the laptops, because the hardware travels to court; more under IT for a law firm.
Three scenarios that recur most often in Polish companies. None of them requires breaking any defences; all of them need one person who happens to be in a hurry.
It arrives from a supplier you have worked with for years, inside a thread that was already running. One thing changes: the bank account number, with a note about a change of bank. The transfer goes out because everything else matches, and the money is gone before anyone notices.
A message about an expiring password or a held email, with a link to a copy of your mail panel. After the password is typed in, nothing bad appears to happen, which is exactly why nobody reports it. The mailbox is taken over and the attacker reads the correspondence for weeks.
A short message from the CEO or owner, usually on a Friday afternoon: confidential matter, a transfer needed quickly, contact by email only. What works here is time pressure and the fact that in most companies nobody questions a person at that level.
No software helps against this, because nothing breaks and nothing gets infected. Three simple things do: a rule that any change of account number is confirmed by phone on a number known beforehand rather than the one in the message; a second login factor, ideally a hardware key, so that a stolen password stops being enough; and visible tagging of external email, so that someone impersonating the colleague at the next desk is obvious at a glance.
A company with forty workstations will not deploy everything at once, and does not have to. The order matters more than the number of tools, because the first three items remove the largest share of the risk.
A second login factor on email and remote access, order in permissions, and removing local administrator rights where they are not needed. This is the cheapest step and at the same time the one that closes the most common way in, a stolen password.
A backup attached to the same network and the same passwords gets encrypted along with everything else. You need a second copy, cut off from the environment, plus the thing people forget: checking how many hours it actually takes to get back to work from it.
Endpoint protection, a firewall, mail filtering and monitoring are all needed, but bought first they create a sense of calm next to a door left open. We choose them after the two earlier steps, when it is clear what is actually left to protect.
We apply this order even when it means a smaller order for us, because selling a company a full set of tools without sorting out accounts is the simplest way to find out a year later that the money achieved nothing. If you have obligations under the national cybersecurity act or a security questionnaire from a client, we start there, because the deadline sets the order. We write about that under the new regulations.
Most of the damage happens not at the moment of the attack but in the first hours after it is found, when someone acting in good faith does something irreversible.
Do not delete suspicious files and logs, they are the only record of what happened and whether data left the building. Do not restore a backup onto an infected environment, it will come back together with the problem. Do not pay a ransom in the first hour of panic, payment guarantees nothing.
Disconnect the affected machines from the network, but do not switch them off. Change passwords and revoke active sessions, starting with privileged accounts. Write down the times and the symptoms, because in two days nobody will reconstruct them from memory and they will be needed for the report and the insurer.
If personal data leaked, the breach is reported to the President of the Personal Data Protection Office without undue delay, where feasible within 72 hours of becoming aware of it. Where the risk is high, the individuals have to be notified too. The clock starts when the breach is established, not when the analysis is finished.
Ransomware is not a mass phenomenon in Poland, CERT Polska recorded 179 such cases in 2025, but each one stops a company for several days. That is why we write the plan for those first hours down in advance, on two pages, with phone numbers and the order of steps. A sheet you can pull out of a drawer is worth more in that situation than the best tool whose password nobody remembers. Health data we treat separately, because it is a special category and an incident in a medical practice usually means two notifications rather than one.
None of them works on its own. Under each description there is a link to the page that goes into detail on that layer.
Detecting and blocking threats on computers and servers, with one console instead of twenty separate installations nobody can confirm are still running.
Firewall, splitting the network into zones and order in what is visible from the internet. Remote desktop exposed to the outside is still one of the most common ways in.
A local copy and a second one off site, with a restore test. What we check is not whether the backup ran, but how many hours it takes for the company to be working again.
Hardware keys and authenticator apps. A password can be phished in two minutes; a key is not physically present on the other side of the message.
Control over who holds administrative access and what they do with it, including access held by outside firms, often the widest and least watched door.
Checking what is actually switched on rather than merely bought, and how the environment looks from outside. Usually the cheapest way to establish where to start.
What we do not do: we do not run our own overnight monitoring centre or digital forensics after a serious attack, because each of those needs a team of a different size. In a major incident we help bring the situation under control and work with a firm that specialises in post-breach analysis. We say so upfront rather than discovering the limits of what we can do at the worst possible moment.
Four steps. The first one is free and ends with a list that stays with you regardless of what you decide next.
We check accounts and permissions, the state of backups, what is visible from the internet and what has been bought but left switched off. The result is a list of risks ordered by severity, with a cost next to each item.
We start with what requires no purchases: a second login factor, removing unnecessary permissions, closing off what does not need to be visible from the network. This is usually where the largest share of the risk drops away.
We add what is missing: endpoint protection, a second copy off site, order at the network edge. We split it into stages so the cost can be split too and so the team has time to adjust.
We write down who does what in the first hours and which numbers they call, and once a year we test a restore and review permissions. Security is not a project with an end date, it is something you maintain.
Pages that come up in any conversation about security.
Nobody in particular, and that is the problem. Most of what reaches Polish companies is not aimed at anyone by name: it is mass messaging and automated scanning for services exposed to the internet. A small company is not a target, it is a chance hit, and the consequences are often worse because it is less likely to have a tested backup and someone who knows what to do in the first hours.
For the scenarios that dominate today, no, because there is nothing to detect. When an employee types a password into a spoofed page or sends a transfer to a swapped account number, no software reports a threat, because nothing was installed. Endpoint protection is necessary, but as one layer among several rather than as the whole of your defences.
We will not give a single figure, because the first and most effective steps usually cost nothing but work: turning on a second login factor, removing unnecessary administrator rights, closing off what is needlessly visible from the internet. Spending starts with protection licences and a second copy off site, and we give the scale of it after the review, which is free.
Change that password immediately and sign out all active sessions, because the password alone is not enough if the attacker already has a session open. Then check the mail forwarding rules, because the first thing after a mailbox takeover is often quiet copying of correspondence to an outside address. And do not punish the person who came forward, or the next one will not.
Not every one. The duty to report to the Personal Data Protection Office covers personal data breaches and falls away where a risk to individuals is unlikely, for example where the data was effectively encrypted. The assessment still has to be made and documented, and a report is subject to the 72-hour deadline from becoming aware of the breach. It is a legal call, so for anything serious it is worth having a lawyer at the table.
Yes, provided it is not an hour-long presentation once a year. What works better is a short rule people can remember, for instance that a change of account number is always confirmed by phone on a number known beforehand. An open route for reporting suspicious messages matters too, because the worst case is an employee who noticed something and preferred to stay quiet.
We review what is visible from the internet and check configuration, but we do not run full penetration tests with an auditor-ready report ourselves. Where that is required, usually by a client security questionnaire, we work with an external team and help implement whatever they find. Buying a test before accounts and backups are in order is usually money spent at the wrong time.
No. Some companies order only the review and the set of recommendations, which their own team or current provider then implements. If the review shows that a few fixes are enough, we say so plainly instead of using the occasion to sell an ongoing contract.
The first meeting takes 30 minutes and commits you to nothing. We will tell you straight whether we can help and what we would propose.
2019 - 2024 Interactive Workspace Ltd. - All rights reserved.