Security culture, cybersecurity as a source of revenue and education in schools

October is Cybersecurity Awareness Month, and at UN1QUELY we wrapped it up with a candid conversation between two cybersecurity professionals: my colleague Damjan, an expert in offensive security and ethical hacking, and me. We started with what drives today’s attacks and moved on to defence: why governments lag behind, why security culture matters most, how security brings in revenue and why awareness should start at school.

State-sponsored attacks have huge budgets behind them

State-sponsored attacks have been happening a lot around the world. The motivation behind them is political, and they have huge budgets: large teams of probably highly experienced people, with plenty of tools at their disposal and a huge infrastructure behind them.

Warfare is moving online fairly quickly. In the latest conflict in Ukraine we saw highly technical attacks, while satellite internet such as Starlink brought in infrastructure that was entirely new to the game, and the direction this is taking is frightening. We have seen many such attacks in the Balkans and in Europe too, where governments were not ready to respond, and that uncovered some bad practices in cybersecurity.

Governments should be the role model

I have seen plenty of pain points in private companies, but the gap between how governments and the private sector approach security is big. Private companies have more motivation and money, and a smaller scope, to build a truly comprehensive cybersecurity programme, while governments need to step up, lead and be the role model for the private sector in every country.

The complexity in government is huge, but it is hard to find excuses for what was not set up properly. There is still not enough awareness of how important cybersecurity is, and digital transformation is far behind, even though we have been talking about it for about ten years. Government is still lagging behind in it, including the move to the cloud. In the United States, for example, the Pentagon signed an agreement with Azure to move at least part of its infrastructure to the cloud, which had been considered insecure, and we have since seen that its security depends on how you use it.

They say that the further east you are, the later you get the latest security updates, although I think we in the middle suffer the most.

Make peace with the fact that a breach will happen

Defence starts with people, and then come processes and technology. The news covers who got hacked and what they did wrong, while I still miss technology-agnostic discussions about how to protect yourself, free of vendors claiming the attack would never have got through with their solution. After the recent Uber incident there was a huge backlash, and cybersecurity professionals started defending Uber because they understand that being hacked like that is quite natural.

I agree with a breach-oriented approach, which means making peace with the fact that a breach will happen and being extremely well prepared to react to it as quickly and efficiently as possible. The aim is to minimise the impact on the organisation and to detect the breach within minutes if possible, or even faster.

Security culture is the Holy Grail

I see two bad approaches to cybersecurity in companies:

• —Some companies do nothing until it is too late, and even then they do only the absolute minimum.
• —Others do the bare minimum to meet someone else’s requirements. When you want a deal with a big company, such as a bank, that has security requirements, you do just enough to show you have something, win the deal and then sweep security under the rug, which is an extremely common approach.

Culture is the Holy Grail of good security practice. That means training employees to be security aware and also communicating from the top that security matters: that leadership loses sleep over it and that everyone should think about the security side of whatever they do.

Security ambassadors in every team

Security ambassadors can exist in any department, whether finance, HR, engineering, DevOps or IT. They are enthusiastic about cybersecurity and share management’s vision for it, and within their circle, among the people they work with every day, they correct behaviour over long periods and keep reinforcing good practice.

Continuous education and communication are the key, because security is part of the culture and you have to stick with it over the long term.

Cybersecurity is not a cost centre

What stops companies from acting on security proactively is a myth, and an extremely wrong one: that cybersecurity is a cost centre, something that wastes money and does not contribute to revenue.

Earning revenue through cybersecurity is heavily proven in the West, where companies that are not in the security business market their security, use it as a feature and compete on how well they protect user data. I see this most in B2B SaaS and B2C companies, in healthcare, fintech and other highly regulated industries.

Where security pays off

• —In sales, security becomes the main tactic, winning big deals and more customers and building trust in the brand.
• —Security also helps with recruitment. There is a huge skills gap in cybersecurity, and people in IT, development and DevOps want to add security to their skills by moving into DevSecOps or application security, so a company where security is a primary topic, from the leadership down, is a great place for them to grow.

Why phishing and ransomware still work

Although zero trust is hardly a social way of doing security, not trusting systems, computers and accounts by default has so far proved the most modern and best way to protect an environment.

Even so, attackers keep using the same vectors, with phishing still the top way into systems and ransomware most often delivered through phishing and other social engineering.

I asked Damjan why we still fail to fight ransomware, even though modern ransomware has been actively around for about ten years. When someone fails a phishing test, there should still be mechanisms that stop it from spreading.

Social engineering fascinates me, because the same scams, by text message, phone, email or social media, still hit their targets, and we still have a long way to go before we can really fight them.

I believe the root cause is that the way we teach security awareness today keeps failing. Only some companies do it right, and even for them the question is for how long, while most companies and governments, and the citizens at home we keep forgetting, are not doing it at all.

Cybersecurity belongs in schools

I strongly believe that cybersecurity, at least basic awareness, should be part of regular education in schools. When Damjan mentioned my daughter, who already uses a phone, I admitted that I am trying to delay it as long as possible, although I think I am already losing that battle.

Primary school is not early at all, and children need guidance even before that, as soon as they start using devices. The entire internet should not be accessible to children, and I would argue that the same goes for some adults. Apps now have parental controls, and I think YouTube Kids is one of the more successful ones, although I don’t think parents actually use it. They should use it to filter what children can watch for their age.

Education needs to improve a lot, and we need to build a community that brings this into schools, which would also help close the skills gap later. Young people who are comfortable with cyber from an early age, and who know about protective controls on top of consuming media, are more likely to become cybersecurity professionals, and we are missing millions of them. I recommend joining a cybersecurity academy near you or talking to us, since I think we have something to teach you.

Culture first, then technology

Damjan asked whether, if we started today, everyone could be at least a little security aware in 10–15 years, and I told him that is the future I would like to live in.

A strong security culture comes before any highly technical defence mechanisms. Anyone can be a target, whatever the motive, and a strong culture with educated employees protects against phishing, ransomware and the other most common attacks. In the end, education has to go beyond the private sector and into schools, so that all children learn cyber literacy from a very early age.

• Cybersecurity, children online and Skenify’s road to first place at AIM 2026RTV Herceg Novi
• Leaving Montenegro, lessons from abroad and coming home as an entrepreneurRTV Budva
• Online privacy, account theft, AI scams and what to do when you are targetedUdruženje za odgovorni i održivi razvoj
• The road to Secfix, Skenify’s pivot and leading startups with calm and transparencyScale SEE Podcast