A Slovak cybersecurity expert examines how rapidly evolving digitalization is reshaping cybersecurity risks in the Western Balkans and Moldova.
Cybersecurity has become a defining issue of digital transformation, where rapid connectivity, critical infrastructure, and national security are increasingly intersected.
In this interview, Miroslav Pikus, a cybersecurity expert working on a regional project implemented by UNDP with the support of the Ministry of Finance of Slovakia, reflects on the key challenges facing the Western Balkans and Moldova. He also shares lessons that can be drawn from Slovakia’s experience in building digital security capacity.
Miroslav Pikus, UNDP cybersecurity consultant
What is the role of cybersecurity in today’s broader security environment?
For centuries, security mostly meant defense – protecting borders, people, and physical infrastructure, the domain of national security. As information itself became critical to how states and organizations function, information security emerged to protect it, and cybersecurity grew out of that field to address the risks created by our growing reliance on software and networks.
Cybersecurity is what keeps that invisible layer trustworthy. It is like the immune system of a digital society: when it works, nobody notices it; when it fails, everything else fails with it.
What has most changed your understanding of cybersecurity over time, and what do you think is the most overlooked risk for the future?
When I started in the 1990s, I believed cybersecurity was a technological problem with technological solutions. Decades of practice taught me it is primarily a human and organizational problem. Most successful attacks exploit people, processes and unclear responsibilities, not sophisticated technical flaws.
As for the most overlooked risk: our interdependence. We have built societies where energy, telecommunications, finance and logistics are so tightly interconnected that failure in one can cascade through all the others. With AI now accelerating both attacks and our dependence on automation, the speed at which things can go wrong is growing faster than our ability to respond.
What are the most important basic steps and precautionary measures that should be in place in cybersecurity today?
Before anything sophisticated, get the basics right. This is what we call cyber hygiene. That means a properly configured firewall, up-to-date protection against malicious software on every device, multi-factor authentication so that a stolen password alone is not enough, and secure, regularly tested backups kept where an attacker cannot reach them. None of this is glamorous, but most successful attacks succeed precisely because one of these basics was missing. Master the fundamentals first. They stop most attackers and make the advanced measures worth investing in.
You are currently contributing your expertise to Western Balkan countries and Moldova within a Slovak-supported project. What motivated you to get involved in this work, and what do you see as its most important value or impact?
IT security has long been my passion and working on projects that help states and communities become safer gives that passion a deeper purpose. The Western Balkans and Moldova are in a remarkable period of transition – digitalizing fast, moving towards the EU, and at the same time facing very real cyber threats. That combination means the need is urgent and the impact of every improvement is tangible. For me, the greatest value of the project is that it does not just deliver recommendations on paper; it builds lasting local capacity and connects people across the region who face the same challenges.
Recently, a workshop was held in Bratislava focused on strengthening the protection of critical energy infrastructure against growing cyber threats. Why is the energy sector such an attractive target for cyberattacks compared to other sectors?
All critical infrastructure, such as banks, mobile operators, and hospitals, is vital but every one of them struggles without electricity, which gives the energy sector a special role. At the same time, its level of automation and reliance on digital technology is extremely high. The combination of maximum dependency and maximum digitalization makes it a particularly high-risk, and therefore particularly attractive, target.
Based on your cooperation with experts from Albania, Bosnia and Herzegovina, Montenegro, North Macedonia, and Moldova, what are the most important cybersecurity challenges you observe across the region?
On the technical side, the issues vary, but in the energy sector one stands out: the need for stricter separation and controlled flow between IT and OT. Put simply, IT is the office world — e-mails, accounting, websites — while OT (operational technology) is the world of systems that physically control turbines, substations and grids. If the two are connected without strict controls, a phishing e-mail opened in an office can become a pathway to the equipment that keeps the lights on.
What surprised me most, however, was organizational: how many entities still do not have a dedicated CISO — a security chief separate from the IT department. That is where you start, because whoever runs the systems should not be the only one to grade their security.
Why does this gap between industrial systems and corporate IT networks remain so difficult to close in practice?
Industrial control systems were often designed decades ago for reliability, not for hostile internet, and they have been gradually connected to corporate networks for convenience and remote management. Without strict segmentation, monitoring and controlled data flows between the two worlds, an attacker who compromises an ordinary office computer can move towards the systems that physically operate the grid. Closing that gap is the single most important technical priority.
You said that the Western Balkan countries digitalize fast. Does this rapid digital growth automatically translate into stronger cybersecurity and resilience?
Unfortunately, not, and that is precisely the risk. Digitalization and connectivity without security is not an asset, it is a liability: every new online service is also a new attack surface. We need a shift of paradigm — to stop talking about digitalization in general and start talking about resilient, secure digitalization.
What is driving the increasing importance of cybersecurity in those countries?
The motivation comes from two directions. First, as EU candidate countries they are harmonizing their legislation and institutions with European frameworks such as the NIS2 Directive. Second, the region has experienced a wave of devastating cyberattacks. Think of the 2022 attacks that paralyzed Albania’s government e-services, or the ransomware attack that crippled Montenegro’s public infrastructure the same year. Those incidents moved cybersecurity from a technical footnote to a political topic. That said, the urgency is not yet universally shared across all institutions and sectors. Priorities still compete with many other pressing economic and infrastructure needs.
So, one could say that countries in the Western Balkans and similar regions are investing sufficiently in cybersecurity?
Not yet. Our survey showed that a third of energy companies in the region invest less than 1% of their budget in cybersecurity — far below what the threat level demands.
What are the main reasons behind this?
Part of the problem is genuinely financial: cybersecurity requires expensive capital expenditure, and NIS2 compliance is not a cheap exercise. But it is also a question of prioritization and management. Spending wisely on the right controls, people and processes matters as much as the size of the budget.
How would you compare cybersecurity readiness in Slovakia with that of the Western Balkans and Moldova, and what are the main similarities and differences you see?
The situation in Slovakia is not ideal either. The latest 2024 statistics from our National Security Authority show energy entities are on average 88% compliant with the NIS framework — and NIS should not be seen as the ultimate goal, but rather as a basic floor. from our National Security Authority show energy entities are on average 88% compliant with the NIS framework — and NIS should not be seen as the ultimate goal, but rather as a basic floor.
On the other hand, NIS was transposed in Slovakia back in 2018, the situation keeps improving year by year, and I believe we are on a good track. The most obvious difference is that Slovakia can draw on EU-funded cybersecurity projects, which the candidate countries cannot yet fully access.
Beyond that, we honestly keep ourselves busy with very similar issues — talent shortages, legacy systems, and the gap between regulation on paper and security in practice.
What practical lessons from Slovakia’s cybersecurity experience could realistically be applied in the Western Balkans, and what cannot be easily transferred due to structural differences?
What transfers well is the journey itself. Slovakia went through exactly the transition these countries are starting now: transposing the NIS Directive into national law, building a national cybersecurity authority and incident-response capability, and teaching critical-infrastructure operators what compliance means in practice. We made mistakes along the way — underestimating implementation costs, treating compliance as paperwork rather than real security — and sharing those mistakes is at least as valuable as sharing successes. What cannot be copy-pasted is the context: access to EU funding, the size and maturity of the local cybersecurity market, and institutional capacity all differ. So, the lesson is not “do what Slovakia did,” but “learn from how Slovakia did it and skip our detours.”
Miroslav Pikus, UNDP cybersecurity consultant
During your presentation at the workshop, you mentioned that people and expertise are the key “battlefield” in cybersecurity. What did you mean by that, and what led you to that conclusion?
Technology can be bought; expertise cannot. It has to be grown, and that takes years. A firewall is only as good as the person who configures it, and the most sophisticated monitoring system is useless if nobody can interpret what it shows. That is why people are the real battlefield: attackers and defenders are ultimately competing for the same scarce talent.
For smaller countries this is compounded by a brain drain – skilled specialists are recruited by the private sector and by wealthier markets abroad, and public institutions with rigid pay scales simply cannot compete. The answer is not only higher salaries but building attractive professional communities, continuous training, and giving experts meaningful missions, which is exactly what regional cooperation projects like ours try to support.
About Miroslav Pikus
Miroslav Pikus is a Slovak cybersecurity expert with three decades of experience, including managerial roles at ESET, Avnet, Websupport and Deutsche Telekom. He currently provides his expertise for the Slovak-UNDP regional project “Cybersecurity for a Resilient Digital Future”.