VIDEO — 21 Feb 2026

Startups in the AI era, ISO 27001 and the few controls that stop most attacks

A Vikend popodne interview on Televizija E about building a startup with AI, ISO 27001 as a sales tool, phishing, privacy and simulated attacks.

Published in

Televizija E

Role

Guest

Watch on YouTube

On Vikend popodne on Televizija E, we talked about tech entrepreneurship and cybersecurity: how I got into the field, the ISO 27001 standard, building a startup in the AI era, the controls that stop most attacks, privacy awareness and simulated attacks on companies.

From neighbourhood computers to cybersecurity

I got into computers at 12 or 13, when we went from one neighbour’s home to another depending on who had the better Pentium and which games it could run, and we still paid for the internet by the hour. I opened the cases to see what was inside and caused a few short circuits, and I learned from relatives whose workshop full of parts and soldering irons was like Disneyland to me.

Once I enrolled at the Faculty of Electrical Engineering in Podgorica, it was clear I would work in information technology, and cybersecurity came up early, already at my first employer. It sounded advanced and was not developed enough here, so I saw that focusing on it could open doors much faster.

Information security, from family photos to ISO 27001

Our photos and videos are our history and our memories, and we probably value them above anything else on our phones and computers. A ransomware attack encrypts them and demands money, and many people have paid because they had only one copy. Information security means preparing for such attacks, starting with backups in several places, such as Google Photos, iCloud or an external hard drive.

For 12–13 years I have worked in compliance with regulations and international standards. The best known in Europe is ISO/IEC 27001, whose technical, people and process controls tell you what to implement to reach a high level of security and get certified. The certificate opens the market, so we present it to clients as a sales tool that raises a company’s value and its number of clients, and if you want to work with a big bank, it can decide whether you are selected for a tender or disqualified.

Starting a startup is easier and harder than ever

It has never been easier to have your own startup, and never harder. AI tools let one person be a solopreneur: with vibe coding, or programming with words, you tell the AI what to build and it writes the code, so you can make a complete mobile or web app on your laptop. That takes more than a 20-dollar subscription, around 200–300 euros a month in subscriptions and credits, and I would still call it extremely cheap.

The hard part is that everyone can do the same, so the competition is huge, and while I am still thinking about an idea, someone is already building it. People launch smaller, simpler products quickly and with very little money, without waiting for venture capital.

How we changed pace at Secfix

We started Secfix in Munich five years ago, before the AI craze. When the tools arrived and competitors could now build faster what we had developed the hard way, we had to choose between stubbornly keeping our traditional way of development and changing how the whole company works, with every employee using AI tools and spending the time saved on creative work. We chose the second to survive and stay in the race, and we are still in it, doing business successfully.

Email protection, invoice fraud and two-factor authentication

In my view, 5–6 of the controls in ISO 27001 protect you from more than 90% of attacks, because most attacks arrive by email as phishing.

The first is protecting your email with more advanced anti-phishing filters than the standard ones. Invoice fraud is where the human factor comes in, because such an email is essentially legitimate, with an invoice for some amount and no virus to catch, so what protects you is process control: checking the contract, account number and address before paying, especially when the account changes. This happened to Airports of Montenegro too, and luckily, thanks to how our payment system works with intermediary banks abroad, the payment to the attacker was stopped before the money was lost.

The second is protecting user accounts with complex passwords and two-factor authentication. Setting it up takes a few seconds, and companies can require it for every account through an identity management system. It is the first thing we check, and if you do not have it, please sort it out today.

Passion, daily learning and free courses

Sometimes a lot of luck is needed, but passion for what you do is the precondition for success, because it drives motivation, motivation drives action and action brings results. For me that passion is a hunger for knowledge, so every morning I spend an hour or two reading what is new, try every new tool as it comes out and tell colleagues which model is best for Excel, code or online research.

There is so much free material online that anyone can start a career in IT: UN1QUELY Academy’s introductory courses in information security are free and always will be, you can find free courses at Google and in IBM’s academies, a platform offers free courses from Harvard, MIT and other prestigious universities, and an AI tool can suggest ten free courses to start today.

Privacy awareness in Germany and in Montenegro

When I moved to Munich, I saw how highly Germans value data privacy. The GDPR grew out of German law, which was the most advanced in that field, and people there are so sensitive that if your website asks for data it does not need, they will email you to ask why.

Here, people will give everything, even a kidney if needed, just to get a service, especially in a prize game or when applying for something free. I think we have no filters, and awareness of how cheaply people trade their personal data is very low.

Training, simulated attacks and how phishing spreads

Education has to be continuous, because technology develops so fast. Security awareness training is part of the ISO standard, and we tailor it to each department, so finance learns about invoice fraud and management about fake emails that seem to come from partners, employees or a director’s assistant and try to take over an account.

A company can find out how vulnerable it really is through penetration testing or a red team engagement, in which certified ethical hackers simulate a complete attack through phishing and login screens and, if the company wants it, physical entry. Social engineering often works here because people want to help, so with a copied ID badge and a story about your first day, the security officer walks you in through the main door. Afterwards you document every entry point and how to close it, and run a re-test.

A phishing attack also does not stop with the first employee who falls for it:

01An email tells you to reset your Google password urgently, and the link opens a fake Gmail or Outlook login page whose address can use look-alike characters, even a Cyrillic O.
02You enter your password and even your two-factor code, and with that you hand your session to the attacker.
03From your real address the attacker targets colleagues, who are far more likely to fall for an attack from inside, or goes after the IT administrator with privileged access and, with that account, takes control of the company.

If that happens even though you had email filters and two-factor authentication, the third part of your defence, education, was not effective enough.

More conversations & talks