Fabrizio Saviano : 7 November 2025 09:59
The same malware that yesterday blocked the servers of a major bank today encrypts Mrs. Pina’s photos on her home PC.
As?
With an innocuous WhatsApp message, sent by his nephew, whose wife works at that very bank, who contracted the same virus on his company PC, which spread automatically. This story is not a fairy tale, but the stark reality that demonstrates an uncomfortable truth: cybersecurity is profoundly democratic.
Threats make no distinctions, they target multinationals and small businesses, large corporations and individuals, exploiting the weakest link in the chain: the human factor. Organizations are not abstract containers, but networks of people. Each of us, unknowingly, can become a vector for a cyber attack.
Malware does its job regardless of your bank account: it uses the same techniques to paralyze the servers of a multinational corporation or the home devices of an ordinary person, with obviously very different effects. A misdirected click on a link or attachment from a seemingly trustworthy source can trigger a chain of infections that spreads from the personal to the professional sphere, bypassing firewalls and controls because the real gateway is in our hands.
The chain of infection is simple but ruthless:
Despite companies spending millions on defense technologies, the real flaw is the human factor. Criminals know this well and use deception: social engineering, urgent messages, false authority figures, family pressure, and fear are weapons that work on everyone, from the executive to the relative who can’t spot a suspicious link.
Therefore, cybersecurity is an issue that concerns everyone. The most visionary companies have understood this and are investing in security awareness programs that involve not only employees but also their families.
However, Italy still struggles. We are among the last EU countries in terms of basic digital skills: only 45% of Italians possess them, according to the European Commission’s DESI Digital Skills Report 2025. This gap slows the spread of a culture of safety, which should be as civil as road safety or sex education. For this reason, it’s time to introduce cybersecurity as a school subject.
Defense strategies must move from isolated technological silos to an integrated view of security, which considers how human behavior inside and outside the office directly impacts corporate security. The “zero trust” principle applies especially to people: never trust, always verify.
For those who want to delve deeper into the interconnection between training, human behavior, and risk management, the “CISO Security Manager Handbook” offers a detailed analysis and practical suggestions for transforming the human factor from a vulnerability to an asset.
Fabrizio Saviano