From guidelines to mandates: the era of security on-the-cheap is over
30th October 2025 • Radisson Blu Scandinavia, Copenhagen, Denmark
As governments react more decisively, organisations will be forced to invest more heavily in cybersecurity
Better late than never: the growing significance of cyber and digital issues in global affairs
Europe is under attack. There is no longer any attempt to disguise the severity of the threat to our digital and connected infrastructure and there is a scramble at all levels to secure our institutions, CNI, economies and democracies.
In Denmark that has taken several forms: last year, the Danish government relaunched the National Cyber Security Council (NCSC) with an expanded mandate to strengthen digital security across critical sectors while advancing AI capabilities. The NCSC will promote public-private partnerships, enhance data sharing between government, businesses, and academia, and protect critical infrastructure from rising cyber threats.
More recently, in what is technically the first public warning by a European government agency, the Danish Agency for Society Security (SAMSIK) has raised the threat of cyber espionage against the Danish telecoms sector from “medium” to “high” in its latest report.
And governments, including Denmark’s, are finally accelerating the incorporation of key European Directives into local law. So, in February this year the bills for implementing the NIS2 Directive and the CER Directive were presented by the Danish government to the Danish Parliament and came into force in July.
Compliance with this legislation will begin to transform security in Denmark – and the rest of the world.
First, large organisations in critical sectors will have to ensure that their technology and processes are sufficient to comply and, more importantly, deliver the security and resilience governments need in CNI.
Second, this is already forcing regulated entities to properly address their most significant gap: third-party and supply chain security. This in turn forces smaller firms, and those not explicitly caught up in regulation, to maintain the same security standards as those who rely on them. And third, this is
Third, governments themselves are realising that secure and resilient CNI means much more than regulations for the final providers. The entire ecosystem must be secure and they will realise that critical suppliers – regardless of size or location – will need to be subject to some form of oversight. And then what about their suppliers?
Once governments understand that CNI can only be assured by collective security across all sectors, we can expect to see a paradigm shift in their demands. Best-practice security will rapidly become compulsory, and enforcement will start to bite.
