{"id":25541,"date":"2026-09-07T10:15:33","date_gmt":"2026-09-07T10:15:33","guid":{"rendered":"https:\/\/saga.rs\/?p=25541"},"modified":"2026-09-08T09:43:31","modified_gmt":"2026-09-08T09:43:31","slug":"cyberattack-on-romanias-cadastre-a-lesson-in-business-recovery","status":"publish","type":"post","link":"https:\/\/saga.rs\/en\/blog-en\/cyberattack-on-romanias-cadastre-a-lesson-in-business-recovery\/","title":{"rendered":"The cybersecurity paradox: you’re paying for protection, but is anyone actually watching?"},"content":{"rendered":"

[vc_row][vc_column][vc_single_image image=”25542″ img_size=”full” css=””][vc_column_text css=””]You have a firewall. You have antivirus, maybe EDR on every laptop. You’re paying for backup, VPN, and a pile of licences that show up on the invoice every month.<\/p>\n

So here’s an uncomfortable question: if something happens at 2 a.m. on a Saturday, who actually sees it?<\/p>\n

The paradox, put simply<\/strong><\/span><\/h4>\n

Security tools don’t stop every attack. Some of them only raise alarms. A firewall logs suspicious connections, blocks some, lets others through. An EDR agent notices odd behaviour on an endpoint. A SIEM collects thousands of signals like these every single day.<\/p>\n

None of it adds up to real protection unless someone is watching the dashboard and investigating the alerts.<\/p>\n

That’s the paradox: companies invest serious money in prevention: tools, licences, ticks on a checklist, and assume that’s the same thing as being protected. It isn’t always.<\/p>\n

What the numbers actually say<\/strong><\/h4>\n

According to IBM’s 2025. report “Cost of a Data Breach<\/a>” it takes companies an average of 181 days just to notice that a breach has happened, and another 60 days to contain it once they do. That’s roughly eight months in which an attacker sits quietly inside a network that was, on paper, “protected”.<\/p>\n

The regional picture is no more comforting. The most recent annual reports from CERT<\/a> Serbia show phishing incidents rising roughly 3.5 times year on year. Which means the entry points into your network are multiplying faster than most in-house teams can keep track of them.<\/p>\n

Fast attackers, slow response. The damage happens in that gap.<\/p>\n

Why the gap exists (it isn’t laziness)<\/strong><\/h4>\n

This usually isn’t a question of competence. It’s a question of arithmetic. A typical in-house IT team is sized to keep the business running: tickets, updates, projects, deadlines. Monitoring security alerts 24\/7, correlating them, and deciding which 3 of the day’s 300 notifications actually matter \u2014 that’s an entirely different job. It takes dedicated people, working in shifts, doing nothing else.<\/p>\n

Most companies never budgeted for that job. They budgeted for tools.<\/p>\n

What “actually protected” looks like<\/strong><\/h4>\n

The answer isn’t more tools. The answer is a person, or a whole team, whose only function is to monitor, correlate and respond. In practice, that means:[\/vc_column_text]

\"\"\/<\/div>