The 2024–2025 period confirmed phishing as one of the main global cyberattack vectors. After a slight decline in 2024, attacks in 2025 once again exceeded one million per quarter, reaching more than 1,130,000 in the second quarter and consolidating this figure as the new benchmark.

Beyond volume, its impact is structural: 37% of global breaches begin with phishing or associated malware, maintaining it as a primary entry point in critical incidents.

In the financial sector, between 59% and 66% of ransomware and extortion cases begin with phishing campaigns, while pretexting and BEC account for between 24% and 25% of financial attacks, reinforcing their role as a common source of significant economic losses.

The current biotech sector relies on interconnected digital environments, and much of the research cycle depends on applications deployed in the cloud.

Preparing for a compliance audit of the National Security Framework (ENS) requires proper planning, the real implementation of security controls, and a continuous improvement approach to information security management. An ENS audit not only verifies regulatory compliance, but also assesses the effectiveness of the security measures applied to an organization’s information systems.

The legal sector handles a large amount of confidential information and sensitive data that must be protected, such as contracts, legal proceedings, corporate operations, financial data, negotiation strategies, and other personal and business information, making law firms a target for cybercriminals. The more valuable the documentation, the higher the reward and the amount attackers may demand for its recovery.

Since the entry into force of the General Data Protection Regulation in 2018, the European regulatory framework has continued to evolve to adapt to digital transformation, the growth of online services, and the intensive use of advanced technologies. In recent years, the European Union has strengthened its digital strategy with new regulations aimed at ensuring responsible use of technology and stronger protection of personal data.

In an increasingly digital and technology-driven society, organizations, both public and private, must understand which regulatory frameworks and standards they are required to apply in order to protect information, comply with legislation, and build trust with customers and partners. Among these references, the National Security Framework (ENS) holds a central role in Spain, while other frameworks such as ISO 27001, those developed by NIST, or the General Data Protection Regulation (GDPR) have a broader or different scope.

Currently, most companies rely on their technological infrastructure and digital assets to operate smoothly: email, ERP, backups, remote access, cloud platforms, IT security, regulatory compliance, among other tools and software.

To ensure this software functions properly and the company remains operational, it is essential to have an IT department or provider. In most cases, organizations choose their IT provider primarily based on cost or proximity, without considering other important aspects such as cybersecurity or how it may affect business operations.

The agri-food industry is undergoing a profound transformation driven by the digitalization of its processes. Production management systems, traceability platforms, quality control, automation, and connectivity with suppliers and distributors have become key elements to improve efficiency, reduce costs, and ensure food safety.

Implementing the National Security Framework (ENS) in an organization is a rigorous process that requires planning, technical execution, and continuous control. The ENS is a mandatory legal framework in Spain for public sector entities and for private organizations that handle sensitive data or provide services to the government, aiming to ensure that information and electronic services are managed under clear and consistent security requirements.

The National Security Framework (ENS) is the Spanish regulatory framework that establishes the principles, minimum requirements, and security levels applicable to information systems in the public sector and to companies that manage sensitive information or collaborate with the government. The objective of the ENS is to protect information and digital services against threats, ensuring the confidentiality, integrity, availability, authenticity, and traceability of data.

Security tools are fundamental, but their effectiveness largely depends on how they are used day to day. In most incidents, cybercriminals do not break systems; instead, they exploit unsafe habits, weak passwords, open sessions, or clicked links without verification.

For this reason, it is essential to have employee cybersecurity policies, which establish clear rules to protect information, systems, and most importantly, business continuity in everyday actions.

Today, no organization that manages information, critical systems, or digital services can afford to ignore the security requirements mandated by regulations. The rise in cyberattacks, the outsourcing of technology services, and dependence on third parties have made compliance with cybersecurity standards a critical factor for business continuity.