Overview
In 2022, the cybersecurity market was valued at $2.1 billion, 18% more than the previous year. Italy continues to rank fourth in the world and first in Europe for the number of cyberattacks. With the growth in remote work, attacks on PCs doubled, as cyber criminals shifted their focus to the weakest link in the chain: the endpoint and the employee’s PC. Ransomware threats have the greatest impact, increasingly targeting the manufacturing sector, the public administration, and healthcare facilities. According to the Italian Cybersecurity Association (CLUSIT), in 2022, the Postal and Communications Police (CNAIPIC) managed nearly 13,000 significant cyberattacks, more than twice the number in the previous year. CNAIPIC mostly engages when malware attacks, especially ransomware attacks, phishing, distributed denial-of-service (DDos) attacks, and advanced persistent threat (APT) campaigns are involved. There were over 113,000 security alerts involving IT services of institutions, critical IT infrastructures of national interest, sensitive infrastructure of regional interest, banks, and large companies operating in strategic sectors such as communications and defense. Russia’s war against Ukraine and the ensuing financial and energy crisis generated an unprecedented surge in cyberattacks, particularly DDoS attacks, which increased exponentially last year. Many attacks are traceable to Chinese and Russian hacking groups that operate transnationally.
Leading Sub-Sectors
Significantly more malware families were detected in 2022 (208) than in 2021 (163). Infection penetration has also become relevant in mobile, with the FluBot malware infecting mainly Android devices. The primary sectors targeted include finance, insurance, and public administration. Larger companies turned to tools such as firewalls or virtual private networks (VPN) to raise protection levels, providing employees with remote access to corporate VPNs while augmenting perimeter protection.
Large-company investments drive the Italian market for cybersecurity. According to the Cisco Readiness Index, 87% of Italian companies are expected to increase their IT security budgets by 10% in 2024. The financial/banking and utility sectors are the main end-users of IT security, followed by the defense, public (national and local), manufacturing, transportation, and telecommunication sectors.
More than 50% of SMEs are unprepared to face increasing threats. One in five companies lack a specific investment plan for IT security or only allocate resources as needed. Small firm managers perceive security as a cost rather than an investment and tend to show resistance in approving IT security expenditures. As this mindset slowly changes, sector analysts expect increased SME investments. Medium-sized companies and (to a lesser extent) small companies are increasingly choosing to invest in cybersecurity, often opting for advanced cloud security solutions.
Opportunities
Top market drivers include increased IT security awareness and enforcement of new government measures, while challenges include the increased sophistication of cyberattacks, a complex regulatory landscape, and the need to reduce a highly fragmentated IT security infrastructure. Strong opportunities exist in the software, hardware, and service areas, including cloud and mobile security. Specific areas of opportunity include identity access management (IAM), customer identity and access management (CIAM), web application firewalls (WAF), DDoS mitigation services, and endpoint security solutions.
Cybersecurity is a key element in Italy’s digital transformation strategy. Government measures are being put in place to boost efforts to counter cyber risks. The National Cybersecurity Authority (ACN) was established in June 2021 to protect the national cyberspace. The agency promotes a coherent regulatory framework in the sector and exercises inspection and sanction functions. ACN ensures the implementation of Italy’s first-ever cybersecurity strategy announced in May 2022, which outlines the country’s digital roadmap. Security and innovation are priorities of the plan, which seeks to implement over 80 measures by 2026, some via public-private partnership. The government has allocated about $2.2 billion to implement the national strategy and earmarked additional funds for related operational management activities; $11 million for 2023, $55 million for 2024, and $77 million for 2025.
ACN is overseeing the creation of a unified cloud computing infrastructure, a $2.5 billion project, to increase security for public-administration data storage. In partnership with Microsoft, the consortium TIM-Leonardo-Cassa Depositi e Presiti-Sogei, won the tender for the project in June 2022. The goal is to have 75% of the Italian administration migrated to cloud services by 2026.
The National Cybersecurity Perimeter Law ensures a high level of security for networks, IT systems, and services used by government agencies, public administration, state-owned entities, and private companies that exercise an essential function of the state or services fundamental to the country’s interests and national security. It also provides the framework for providers of IT products and services that must meet certain requirements, such as data localization. The law also provides a legislative amendment on foreign investments in certain strategic sectors.
The certification of cloud computing infrastructure and services (SaaS, PaaS, and IaaS) for use by the public-administration cloud is the responsibility of the ACN. All firms, domestic and foreign, may register on the eProcurement Platform to begin the qualification process and proceed to operate on the electronic marketplace of the public administration (MePA). U.S. companies should ensure that they meet all requirements, such as having a legal entity or legal representative entrusted with the power to act on its behalf. In-country legal representatives may register. ACN has information on certification.
Relevant public-administration acquisitions that exceed thresholds are carried out via public procurement tenders published on the EU’s Tenders Electronic Daily (TED). For information on public procurement in the EU, see the relevant section of the Country Commercial Guide for the European Union.
Resources
Italian National Cybersecurity Authority (ACN)
Electronic Marketplace of the Public Administration (MePA)
Italian Official Gazette (public tenders)
European Union Country Commercial Guide article on cybersecurity
U.S. Commercial Service Italy:
Maria Calabria, Commercial Specialist
U.S. Commercial Service, U.S. Embassy Rome
Tel: +39 06 4674 2427
E-mail: maria.calabria@trade.gov