While the increasing digitalization has the potential to offer a number of benefits in the form of efficiencies, convenience, and new services, it also adds to the likelihood of cybersecurity incidents. Incidents such as cyberattacks are be coming more common across the globe, and Finland is no exception. Attempted data breaches and serious cybersecurity incidents have been reported to be on the rise and call for cost-efficient solutions available also for companies with more limited resources.
The Finnish Transport and Communications Agency Traficom has stated that attackers have become faster at identifying existing vulnerabilities in systems, and the technologies to conduct cyberattacks continue to evolve (Traficom 2025). In addition, the existing geopolitical tensions further contribute to cyber threats, targeting various institutions. If successful, these attacks have direct and possibly dire consequences for citizens, businesses, and societies as a whole.
While the efforts to prevent and counter cyberattacks have worked relatively well in Finland, business and operational continuity and resilience are nevertheless of growing importance. Organizations are faced with a range of cybersecurity challenges calling for solutions. Among others, there is a shortage of skilled cybersecurity professionals, while technological developments enable attackers to use increasingly sophisticated methods.
Furthermore ,more traditional challenges, such as a lack of resources and misconceptions about cybersecurity, continue to exist and are often seen as particularly pertinent in many small and medium-sized enterprises (SMEs). As systems are interconnected to one another, a vulnerability in one system may affect others, increasing the available attack surface for attackers and paving the way to supply chain attacks.
Many SMEs with their products and services form part of digital supply chains, providing, for instance, features or components for a software that other actors in the supply chain rely on. Thus, ensuring that SMEs are properly protected is not just important for the SMEs themselves, but also for many others. Similarly, solutions in this space not only benefit the SMEs, but larger group of actors, both directly and indirectly.
While technological developments create new avenues for malicious hackers to attack digital systems, it is worth noting that they can also be used to make systems and organizations more secure. To illustrate, digitalization does not only create security risks but also allows better security monitoring and facilitates the delivery of security training to employees.
Led by assistant professor Hadi Ghanbari, our focus at Aalto University School ofBusiness has been particularly in the latter, for instance, by producing teaching cases on known cybersecurity incidents and resources such as incident taxonomies. An essential part of this work has been the exploration of new ways to deliver cybersecurity training, such as creating escape rooms and virtual reality simulations. We expect that our work on this front will be further strengthened by our selection to join theIndustry-Academia Network, recently launched by the European Commission to bridge the cybersecurity skills gap in the EU.
In addition, the development of generative AI (GAI) offers interesting possibilities for research and for addressing cybersecurity challenges. In this respect, we have focused on users' privacy concerns and behaviour in the context of mobile health and GAI applications. We have also mapped Finnish companies’ approaches to data responsibility, an essential component of the development of AI models.Within this area, we envision a GAI-based tool that could help SMEs improve their information security. In essence, the tool would provide assistance for SMEs and other entities in areas such as cybersecurity policy development, threat landscape mapping, incident response, and business continuity.
We see that this kind of tool could offer a cost-efficient approach to enhance cybersecurity, particularly in organisations with more limited resources. In developing the tool, data on relevant issues ranging from incident response plans to actual incidents are required.
This may also act as a barrier for the tool’s development, since companies are occasionally less inclined to disclose this kind of data. Nevertheless, by being more open and sharing such data would enable collective learning and preparedness.
It is often noted that among the key actions after a cybersecurity incident is to see what could be learned from it. Having avenues to disclose this kind of information with other organizations would help to spread these learnings and improve the overall state of cybersecurity in an increasingly interconnected society. At the same time, it could ensure that organizations would not repeat each other’s mistakes, but learn from one another and avoid the associated costs that tend to follow cybersecurity incidents.
The CYCERONE project is a European initiative that aims to close the cybersecurity skills gap by offering accessible, high-quality training for professionals in SMEs and the public sector. As part of the consortium, Aalto University ExecutiveEducation and Professional Development (Aalto EE) is involved in planning the platform concept and course format offering, as well as designing the courses and their associated content. Aalto EE draws on its expertise in executive education and life wide learning to ensure the training meets the needs of both individuals and organisations.
Want to stay informed about the latest in AI and cybersecurity? Subscribe CYCERONE newsletter to receive updates on free CYCERONE training opportunities, industry insights, and more. Don’t miss out on the chance to upskill your team and stay ahead in the digital age!
Kari M.Koskinen
UniversityLecturer
AaltoUniversity
References:
Traficom (2025): Traficom and Supo: Cybersecurity threat level remains high – serious cases on the rise. https://www.kyberturvallisuuskeskus.fi/en/news/traficom-and-supo-cyber-security-threat-level-remains-high-serious-cases-rise.
