Cyberattacks are on the rise one in three businesses in Austria has already been affected

A growing number of businesses in Austria have fallen victim to cyberattacks, with one-third of companies affected over the past five years, according to a recent survey conducted by EY Österreich. The findings reveal a concerning trend: while the frequency of attacks has increased, many business leaders perceive the risk as lower than before. This discrepancy raises questions about how effectively organizations are preparing for and responding to digital threats. The survey, which included responses from 200 executives and IT security professionals from Austrian firms employing at least 20 people, highlights that 36 percent of companies had experienced specific signs of cyberattacks within the last five years, a four percentage point increase compared to the previous year. Despite this rise in actual incidents, the perceived threat level among decision-makers dropped from 47 percent in 2025 to 38 percent in 2026, nearly matching the 35 percent recorded in 2024. Phishing remains the dominant form of attack, while malware-related incidents have seen a notable increase. Companies utilizing artificial intelligence in their cybersecurity strategies reported significantly higher rates of detected attacks, approximately 65 percent, compared to those without AI integration, which stood at around 29 percent. Gottfried Tonweber, partner and head of cybersecurity at EY Österreich, emphasized that the declining perception of risk amid rising actual threats represents a dangerous misconception. He noted that organizations leveraging AI tend to detect more attacks, underscoring the importance of visibility in effective defense mechanisms. In terms of protective measures, there is a positive shift in adoption. Nearly all surveyed companies employ firewalls and antivirus software, with usage reaching 97 percent. Regular security updates are used by 92 percent of respondents, and multi-factor authentication is implemented by 88 percent. Emergency plans and incident response teams have seen substantial growth, increasing from 57 percent in the prior year to 73 percent. Automated monitoring systems and regular security audits have also gained traction, with 70 percent and 68 percent of companies respectively adopting these practices. Organizational preparedness includes efforts to raise employee awareness, with 83 percent of companies focusing on staff education. Awareness campaigns and infrastructure modernization are each supported by 80 percent of respondents. Approximately half of the surveyed firms consider current threats such as deepfakes and AI-based attacks in their strategies, while another quarter plan to do so in the near future. Larger enterprises, particularly those generating over €51 million annually, lead in addressing these emerging risks, with 100 percent incorporating them into their cybersecurity frameworks. Despite these advancements, financial constraints remain a challenge. More than 40 percent of companies allocate less than €25,000 annually to cybersecurity, six percent lack a dedicated budget entirely, and 32 percent cannot quantify their expenditures. Only about a quarter (28 percent) anticipate a slight increase in spending over the next two years, indicating that the majority of budgets will remain unchanged. Bernhard Zacherl, director of cybersecurity at EY Österreich, acknowledged the encouraging expansion of security measures but stressed the necessity of adequate funding to maintain the achieved protection levels. He pointed out that without sufficient resources directed toward targeted initiatives, the progress made could be undermined. As businesses continue to navigate an increasingly complex digital landscape, the balance between perceived and real threats will remain critical in shaping effective cybersecurity strategies.