The current biotech sector relies on interconnected digital environments, and much of the research cycle depends on applications deployed in the cloud.

The legal sector handles a large amount of confidential information and sensitive data that must be protected, such as contracts, legal proceedings, corporate operations, financial data, negotiation strategies, and other personal and business information, making law firms a target for cybercriminals. The more valuable the documentation, the higher the reward and the amount attackers may demand for its recovery.

In an increasingly digital and technology-driven society, organizations, both public and private, must understand which regulatory frameworks and standards they are required to apply in order to protect information, comply with legislation, and build trust with customers and partners. Among these references, the National Security Framework (ENS) holds a central role in Spain, while other frameworks such as ISO 27001, those developed by NIST, or the General Data Protection Regulation (GDPR) have a broader or different scope.

Currently, most companies rely on their technological infrastructure and digital assets to operate smoothly: email, ERP, backups, remote access, cloud platforms, IT security, regulatory compliance, among other tools and software.

To ensure this software functions properly and the company remains operational, it is essential to have an IT department or provider. In most cases, organizations choose their IT provider primarily based on cost or proximity, without considering other important aspects such as cybersecurity or how it may affect business operations.

The agri-food industry is undergoing a profound transformation driven by the digitalization of its processes. Production management systems, traceability platforms, quality control, automation, and connectivity with suppliers and distributors have become key elements to improve efficiency, reduce costs, and ensure food safety.

Implementing the National Security Framework (ENS) in an organization is a rigorous process that requires planning, technical execution, and continuous control. The ENS is a mandatory legal framework in Spain for public sector entities and for private organizations that handle sensitive data or provide services to the government, aiming to ensure that information and electronic services are managed under clear and consistent security requirements.

The National Security Framework (ENS) is the Spanish regulatory framework that establishes the principles, minimum requirements, and security levels applicable to information systems in the public sector and to companies that manage sensitive information or collaborate with the government. The objective of the ENS is to protect information and digital services against threats, ensuring the confidentiality, integrity, availability, authenticity, and traceability of data.

Security tools are fundamental, but their effectiveness largely depends on how they are used day to day. In most incidents, cybercriminals do not break systems; instead, they exploit unsafe habits, weak passwords, open sessions, or clicked links without verification.

For this reason, it is essential to have employee cybersecurity policies, which establish clear rules to protect information, systems, and most importantly, business continuity in everyday actions.

Today, no organization that manages information, critical systems, or digital services can afford to ignore the security requirements mandated by regulations. The rise in cyberattacks, the outsourcing of technology services, and dependence on third parties have made compliance with cybersecurity standards a critical factor for business continuity.

The cybersecurity landscape in 2025 reflects a constant increase in the sophistication and frequency of attacks. Accelerated digitalization, reliance on connected infrastructures, and the exponential growth of sensitive data have made many organizations strategic targets for cybercriminals. Understanding which sectors are most vulnerable and why allows businesses and public administrations to anticipate risks, prioritize defenses, and ensure business continuity against increasingly targeted threats.

In this context, 2025 data show that attacks are not evenly distributed: certain sectors concentrate most malicious activity, while others, although less visible, are not exempt from risk.

Cyberattacks on law firms increased by 57% in 2025, with professional services (mainly legal firms) accounting for 22% of ransomware attacks. These figures demonstrate that protecting information and ensuring business continuity must be a priority to maintain firm operations and prevent data breaches.

The 2024-2025 period marked a turning point in the cybersecurity landscape. The sustained increase in cyberattacks, along with greater technical sophistication, raised the risk level for public and private organizations worldwide. Accelerated digitalization, cloud dependency, and interconnection among vendors significantly expanded the attack surface.

Next, we analyze the data, incidents, and trends that shaped the cyberattack landscape during this period.