This article’s text was created with the help of AI systems and reviewed by the WIT ICT team, in accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689) on the transparency of AI-generated content. The featured image was also generated using AI.
In August 2026 ransomware attacks reached their highest level of the year, with more than a thousand organisations hit worldwide in a single month. For an Italian small or medium business this is not a headline to skim past: the odds of finding your files encrypted and your operations frozen are now as real as a breakdown in your management software. Making the moment sharper still is an approaching date, 31 October 2026, tied to the NIS2 directive. It is worth understanding what is shifting and what is worth doing right now.
Why 2026 is a turning point for SMB security
For years smaller firms reassured themselves that they were too minor to be worth targeting. The figures say the opposite: most breaches involving small companies run through a ransomware attack, and criminals pick the weakest targets precisely because they promise quick returns for little effort. Whoever has the fewest defences is hit first.
This year’s jump has two faces. Attack techniques have become automated, letting a single campaign strike thousands of businesses at once; at the same time, the cost of an operational blackout — days of downtime, lost customers, exposed supplier data — weighs on a twenty-person company far more heavily than on a multinational.
The NIS2 countdown: the 31 October deadline
The European NIS2 directive has been in force in Italy since October 2024 through Legislative Decree 138/2024, but the step that touches many businesses arrives now. By 31 October 2026, organisations within its scope must have adopted the baseline security measures set out by the National Cybersecurity Agency.
What changed is the breadth. This is no longer about large operators alone: many SMBs in sectors deemed strategic now fall inside the perimeter, and as a rough guide, a company above fifty employees or ten million euros in turnover has a good chance of being covered. The first move, often skipped, is simply to check whether your business is among the obligated parties.
What an attack looks like today: AI-boosted phishing
The picture of a hacker forcing a system with sophisticated code is by now misleading. The most common way in is still the person: a well-written email, an attachment that looks like an invoice or an image, a link imitating a bank portal. Artificial intelligence has made these messages more convincing, stripping away the grammar mistakes that once gave them away.
Some recent campaigns hide malicious programs inside seemingly harmless files, such as a photo to download. The upshot is that technology alone is not enough: you need staff able to recognise the attempt before clicking. In this landscape, training is worth as much as a firewall.
The baseline measures every business should have
Getting compliant does not mean buying expensive, impenetrable tools. Most of the risk shrinks with ordinary practices, applied consistently:
- Multi-factor authentication on email, business systems and remote access.
- Regular updates of operating systems and applications, to close known vulnerabilities.
- Tidy account management, with minimal privileges and prompt removal of people who leave.
- Network segmentation, so a compromised device does not open the whole infrastructure.
- Monitoring of access and anomalous events.
These are within reach even for a small operation, provided someone takes ownership and keeps them under control over time.
Security is no longer just an IT matter
One of the least understood changes in NIS2 concerns responsibility. The rules require directors and senior management to approve security measures, to train themselves on the subject and to answer for any failure. Handing everything to the technician and considering the matter closed is no longer an option.
There is a clear logic to this shift: decisions on budget, suppliers and priorities sit at the top of the organisation. The penalties on the table, which can reach two per cent of annual turnover, exist precisely to make the topic a matter of company governance rather than an operational footnote. For the owner, it means giving cyber risk the same attention already devoted to workplace safety.
Backup and response plan: what to do when something goes wrong
No defence is flawless, which is exactly why the ability to react separates the company that recovers in hours from the one that shuts down for weeks. The cornerstone is backup: regular copies, kept off the main network and verified periodically, because a backup that has never been tested is likely to prove useless at the decisive moment.
Alongside backup you need a written procedure spelling out who does what during an incident: how to isolate systems, whom to contact, how and when to notify the authorities within the required timeframes. Having these answers ready before the emergency avoids improvisation, which is the real ally of the attacker.
Where to start: a realistic path for small businesses
The feeling of having to do everything at once is the first obstacle. It is better to move in stages, beginning with an honest snapshot of the situation: which data is genuinely critical, where it lives, who accesses it. That map produces an order of priorities and keeps you from spending on the wrong things.
Outside support helps most in the early phases, when the needed skills are missing in-house. At WIT ICT we guide SMBs along this path, from checking NIS2 obligations to configuring Microsoft 365, from backups to training people. The aim is not compliance on paper, but a business that keeps running even when something goes wrong.
Want to know more? Contact us for a free consultation.