Although there are still no indicators of the effectiveness of the implementation of cybersecurity measures and the reporting of cyber incidents according to the EU’s NIS2 directive as prescribed by the Cybersecurity Act (ZKS), there are currently 799 such obligated entities in Croatia – 162 key and 637 important entities, data on reported incidents is available. According to the National Cybersecurity Center (NCSC-HR), which operates within the Security and Intelligence Agency (SOA), the first reports were received in May 2025, and since then more than 380 reports of cyber incidents have been recorded – over 60 major and more than 320 other incidents and threats.
– In accordance with the implementation plan of the ZKS, the obligated entities are currently in the initial implementation phase of measures. The first broader indicators of their implementation will be available after the self-assessments and cybersecurity audits, which the obligated entities are required to conduct during the third year from receiving the categorization notification. Analyses of current incidents show that ransomware attacks remain a significant threat to critical sectors. At the same time, there has been an increase in state-sponsored cyber attacks, and supply chain attacks are also becoming an increasing threat – they note at the NCSC, which is responsible for implementing cybersecurity requirements according to the ZKS, while the CSIRT (the expert team responsible for preventing, detecting, and resolving cyber incidents and protecting information systems) is responsible for managing cyber crises and is a unique contact point for the European Union.
All the more complex and malicious
The NCSC estimates that the trend of increasing incidents will continue, along with further increases in their complexity and potential impact on society and the economy, but also that protection against supply chain attacks will improve over time as ZKS obligated entities are required to ensure the security of their supply chains, and their direct suppliers of managed ICT services also become ZKS obligated entities. According to the NCSC, by implementing the prescribed basic level of measures according to the ZKS, or priority recommendations for protection against cyber attacks, the impact of most cyber attacks can be prevented or significantly mitigated. This is confirmed by analyses of reported incidents. At the same time, experience shows that absolute security is unattainable, but by implementing the basic level of measures, the greatest increase in the level of protection is achieved, significantly increasing the level of security and resilience of systems.
The Vice President of the Croatian Association of Security Managers Alen Delić claims that although many have finally awakened primarily due to fear of the law and penalties, rather than a real change in perception of the importance of security, there is a lack of understanding of the implementation of NIS2 at the management levels.
– We should be satisfied because it is still a step forward. But at the management levels, there is still a lack of understanding of what the regulation actually requires and what its true intention is. NIS2 and ZKS are not just a list of requirements that someone in the IT sector confirms, and then the project is finished, but rather a continuous risk management process. Security comes at a cost, and many individuals in organizations have both knowledge and willingness, but that alone is not enough without management support and resources – emphasizes Delić.
He points out positive aspects: the openness and accessibility of the NCSC and the financial assistance provided to smaller organizations by CARNET.
Reported incidents
Delić cites data from the NCSC indicating that by the end of June 2026, obligated entities reported a total of 87 cyber incidents, of which 23 were major and 64 others, predominantly in the public sector, with the most common causes being service outages due to technical failures, exploitation of web application vulnerabilities, and phishing attacks.
– The attacks are diverse, and some are quite creative. But what I would emphasize the most is that there are more and more of them year after year. This is directly confirmed by the National CERT (operating within the Croatian Academic and Research Network – CARNET) in the annual report for 2025, which shows a significant increase in the number of processed incidents in 2025 compared to 2024. A total of 1513 incidents were processed, which is an increase of 35.94 percent compared to the previous year, with the main types remaining phishing attacks (32 percent), spam messages (19 percent), and other types of financially motivated fraud (18 percent). It is particularly interesting that the number of reports in that last category jumped from just 12 to 277 cases – lists Delić.
He adds that the private sector is also publishing its data. According to the latest report from Marlink Cyber in 2026, as much as 69 percent of identified risks in monitored systems related to exposed or compromised credentials, while only 12 percent related to classic technical vulnerabilities, indicating that attackers are increasingly targeting people and access data, rather than exclusively software flaws.
– The actual damage is almost always greater than management initially assumes because, at first, only the direct cost is calculated, and rarely does anyone factor in reputational damage or loss of partner trust in advance – explains Delić.
Impression and reality
According to him, consultants can help in almost every segment of security, but only if they truly dedicate themselves to the client and first understand their business, and only then apply their knowledge and experience to that specific context.
– When reporting security incidents, this means assistance in establishing clear internal procedures, early recognition of the incident, assessing whether it is a major incident according to the law, knowing deadlines and reporting channels, for example, through the PiXi platform, and in communication with the National CERT and NCSC during and after the incident. I would explicitly warn that consultants who come with a ready-made list of legal requirements and only color cells in a table for clients, while not understanding what that organization does, simply should not be doing this job. Such an approach creates a false impression of compliance on paper, while the actual resilience of the organization does not change at all – claims Delić.
Combis conducted a study on whether and how ready companies and institutions are for the implementation of NIS2, and the results showed partial readiness, with significant differences among organizations.
– In more than sixty gap analyses we conducted in the last two years, the average maturity score on a scale of one to five was – two. We are talking about the organizations we analyzed, and the findings show deficiencies both in technical protection and in the way security is managed – states Kristina Oršanić Kopić, a cybersecurity consultant at Combis.
According to her, some organizations have invested in security solutions, but implementations are not completed, systems are not monitored, or documentation does not reflect the actual state.
– We also encounter security backups from which data recovery has never been tested. In such circumstances, it is difficult to reliably assess how ready the organization is for an incident and business recovery – explains Oršanić Kopić, adding that banks and telecoms, which have been operating in a regulated environment for longer, behave more maturely.
Management question
She adds that in addition to technical deficiencies, the question of management arises: who monitors risks, who decides on investments, and who checks whether measures have been implemented.
– Consulting support is particularly useful where there is a lack of experts in the domain of information and cybersecurity management and compliance. The scope depends on the security maturity of the organization, as some need verification of existing approaches, while others need assistance from gap analysis to the implementation of measures. For the user, it is important that after the assessment, they have an actionable plan and support in its realization. Each measure requires a responsible person, a deadline, and ultimately proof of what has been done. It is important to know that security management is a process that goes hand in hand with the organization’s business and must stop being treated as an isolated technical discipline and must become an integral, equal part of organizational management, with responsibility at the management level – emphasizes Oršanić Kopić.
Combis connects compliance consulting with technical implementation and support in security management and compliance with the Cybersecurity Act. It helps the user determine where they are today, what deficiencies need to be addressed, and how to organize work to ensure that agreed measures are implemented and verified.
– Incident reporting is part of the management system. The organization needs to pre-determine how it will recognize and assess an incident, who collects information, and who notifies the relevant authority. The technical team provides data on affected systems, while those responsible for business processes assess the consequences for the business and service users. The assessment of the severity of the incident connects these two findings. Procedures should be practiced so that those involved know their tasks. The obligation to report remains with the organization – notes Oršanić Kopić.
Systematic support
NIS2 and ZKS impose greater demands on companies and institutions in the area of managing cyber risks, and CARNET, through the National Coordination Center for Industry, Technology, and Research in Cybersecurity (NKS), provides support in strengthening cybersecurity by financing investments, education, and informing to increase resilience. Within the first Call for Improving Cybersecurity of micro, small, and medium enterprises, 132 projects have been contracted, with a total of 2.9 million euros in co-financing. Although investments in security solutions and certification are an important part of the projects, there is also a significant emphasis on employee education. NKS is developing a cybersecurity education program aimed at entrepreneurs, public administration, and all interested users, from management structures and IT professionals to employees. The first content is planned for the beginning of 2027. Concurrently, NKS is preparing a new call for financing investments in cybersecurity, planned for the first quarter of 2027, worth about 1.9 million euros in co-financing. Additionally, CARNET manages the national PiXi platform for reporting and exchanging information about cyber incidents, which can only be accessed by categorized entities and fulfill the legal obligation to report major incidents, but through it, they can also report other incidents.
