--- title: "Cyber incidents on the rise in Italy? No — we're finally seeing them" description: "ACN's 2026 data shows spikes in cyber incidents, but the surge is mainly an effect of NIS2 making them visible: what the numbers say, and ACN's warning." url: https://csidia.com/en/notes/acn-incidenti-cyber-2026-nis2-visibilita/ lang: en date: 2026-07-20 label: "Security" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/acn-incidenti-cyber-2026-nis2-visibilita/ --- # Cyber incidents on the rise in Italy? No — we're finally seeing them In the early months of 2026, bulletins from the National Cybersecurity Agency (ACN, Agenzia per la Cybersicurezza Nazionale) recorded figures that look alarming if read too quickly: incidents up **+60%** in February on the previous month, **+81%** in March (313 incidents). The easy headline: “Italy under attack”. The right headline: **we are finally seeing what we previously could not**. The surge is largely an effect of NIS2, which made incident notification mandatory — and what gets measured, shows up. It is a distinction that completely changes what a company should do. ## Reading the numbers correctly ACN's Operational Summary reports tell a clear story: strong growth in February–March, then a levelling off (April and May both down). The Agency itself attributes the March increase “mainly to the greater visibility” resulting from the implementation of NIS2 (Legislative Decree 138/2024): not necessarily more attacks, but more attacks **notified**. The sectors hit hardest in the period — **telecommunications, healthcare, manufacturing** — are exactly the ones where NIS2 widened the perimeter of obliged entities. The recurring threats: data exposure, compromised email accounts, breaches of expected service levels. In other words: the rising number is not a thermometer for the threat, it is a thermometer for **our ability to notice it**. For years incidents happened just the same — they simply never ended up in any statistics. ## The ACN warning that matters more than the numbers There is one line in the commentary to the reports that matters more than any percentage: too many companies still treat cybersecurity as a **notification obligation**, not as **risk governance**. That is the mistake that defeats the whole point of the law: treating NIS2 as “who do I email within 72 hours” rather than “how do I avoid getting there in the first place”. Notification is the last link in a chain — and if it is the only one you have built, you will notify your disasters punctually. We made this point already when explaining [what NIS2 really requires](https://csidia.com/en/notes/nis2-aziende-settori-critici): the visible obligation (notification) is the easy part; the hard part — and the useful one — is the **ability to notice**. The tight deadlines (early warning within 24 hours, notification within 72) are unreachable without continuous visibility: you cannot notify within a day an incident that takes a month to discover. ## What the three hardest-hit sectors teach us Telecommunications, healthcare and manufacturing are not at the top by chance: these are sectors with **many connected systems, large volumes of sensitive data and critical operational continuity** — and now, with NIS2, also the obligation to look inside them. For a company in these sectors, the question is not “will we be attacked?” but “if we are attacked tonight, how long will it take us to notice?”. The three top threats — exposed data, compromised email, degraded services — can only be caught if someone (or something) is watching the right signals in real time. This is the ground on which [AI agents that read the data flows and alert the operator](https://csidia.com/en/operational-ai) make the difference between a contained incident and one that ends up in the news. ## What to do, beyond the headlines 1. **Stop reading the spikes as an alarm and read them as a mirror**: they measure your visibility, not the threat. If you have no internal numbers of your own, you are in the unmeasured part. 2. **Build detection before notification**: centralised logs, continuous monitoring, thresholds. Notification within 24 hours is a consequence, not a starting point. 3. **Treat cyber as a business risk**, with an owner, a process and a periodic review — not as a mailbox pointed at ACN. 4. **Take stock of what you have**: [you cannot protect — or notify — what you do not know you have](https://csidia.com/en/notes/cyber-resilience-act-segnalazione-settembre-2026). It is the first step for NIS2, the Cyber Resilience Act and the AI Act, all at once. *Want to know how long it would take you to notice an incident — and what it takes to cut that time down? [Half an hour with one of our experts](https://csidia.com/en/contact) for the first map.* ## Sources - [ACN — Operational Summary, March 2026: NIS2 increases the visibility of cyber incidents](https://www.acn.gov.it/portale/w/operational-summary-acn-marzo-2026-nis2-aumenta-la-visibilita-degli-incidenti-cyber) - [ACN — Operational Summary, April 2026](https://www.acn.gov.it/portale/w/operational-summary-acn-ad-aprile-2026-calano-eventi-e-incidenti-cyber-in-italia) - [NIS2 Directive/Regulation — Legislative Decree 138/2024 (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/acn-incidenti-cyber-2026-nis2-visibilita/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com