Why subsidies alone won't solve cybersecurity problems

To help entrepreneurs improve their digital security, the government is offering a subsidy for measures against cyberattacks. Through the Mijn Cyberweerbare Zaak scheme, businesses can receive up to €1,250 in funding until November 30. Cybersecurity expert Patrick Jordens, owner of TheTrusted Third Party, calls the scheme a good idea but believes the government needs to look beyond financial support alone.

From separate initiatives to a single point of contact

According to Jordens, there are currently too many different tools and resources available. “There are simply too many different points of contact, initiatives, platforms, DIY tools, checklists and scans in the Netherlands. There are too many,” he says. As a result, it is not always clear to entrepreneurs where to start or where to go for help, such as applying for a subsidy.

Jordens therefore sees a role for the government in bringing these initiatives together. He points to Platform Veilig Ondernemen (PVO) as a possible hub. PVO already focuses on making businesses safer and, alongside cyber resilience, also addresses organized crime and financial crime. According to Jordens, an existing structure like this could help reach entrepreneurs through a single, recognizable point of contact.

Lack of awareness

In addition to a clearer support structure, Jordens believes greater awareness is essential. “Many entrepreneurs think it’s not their problem. They think: I’m not interesting. Why would anyone target me?” he says. According to him, that mindset is outdated. Cybercriminals are increasingly using technology to identify potential victims. “If your business assets, information and data are valuable to you, they are also valuable to a hacker.”

Jordens therefore argues that government funding should not be directed exclusively toward subsidy schemes, but also toward targeted campaigns that increase awareness of the risks. Only when the urgency becomes clear will digital security genuinely move to the top of entrepreneurs’ agendas.

It’s not just about technology

Alongside subsidy schemes, there are other important areas that businesses need to address, Jordens says. For example, they need to gain a better understanding of their digital environment. What systems and data do they have? What needs to be protected? And where are the remaining vulnerabilities? According to Jordens, such an assessment is often the starting point for developing a solid cyber resilience plan.

An IT provider cannot guarantee an organization’s complete digital security. “An IT company cannot protect you from a hack. At most, it can make sure you have the right IT tools in place to improve security,” Jordens says.

An IT company may secure office automation and computer systems, for example, but organizations often use many other types of technology. Think of camera systems, climate control systems or other operational systems connected to the network. These do not automatically fall under the responsibility of the IT provider. Taking responsibility for them internally is essential.

The employee is not the weakest link

Employees also play an important role in cyber resilience. Phishing, ransomware and social engineering exploit human behavior. Still, Jordens believes it is too simplistic to label employees as the weak link. “People are not the weakest link. People are the biggest area of attention. Management is often the weak link.”

According to Jordens, a significant part of the responsibility therefore lies with management. Management determines how much priority cybersecurity receives, which measures are implemented and how much is invested in, for example, training. Business processes also matter. An employee making an incorrect payment is not the only problem if clear procedures and checks are missing.

In short, financial support alone will not make a business digitally resilient. According to Jordens, this also requires greater awareness, insight into the organization’s own risks and clear responsibilities within the organization. His message is clear: “Guys, it doesn’t matter who you are anymore. You will be found. So prepare yourself.”