The SME Cyber Shield – Resilience as a Business Value

Cyber threats continue to rise. According to the CRIF Cyber Observatory, nearly 2.25 million alerts concerning personal and business data were sent in 2025. About 2.2 million were linked to the Dark Web, where stolen information, such as individual and business account credentials, can be published following ransomware attacks or large-scale phishing campaigns. More than 43% of users received at least one alert.

The figures reflect a reality in which digital exposure is no longer just a cybersecurity concern, but a broader business risk and resilience issue. As a result, cybersecurity is moving beyond its traditional place within IT and becoming a strategic concern for companies and their financial partners.

From Data Exposure to Financial Risk

The large volume of information circulating on the Dark Web gives criminals a starting point from which to plan and execute attacks. Account credentials exposed after ransomware incidents or extensive phishing campaigns can be used to access systems, impersonate legitimate users or make fraudulent communications appear credible.

When employee email addresses and passwords are already available, part of the work required to target a company has effectively been completed. A cybersecurity weakness can lead to operational disruption, lost revenue, higher costs, and reputational damage, transforming cyber risk into financial risk. Nearly 60% of companies have experienced an increase in fraud losses, showing the growing financial relevance of stolen data. 

A business that cannot prevent or respond effectively to an attack may also face greater difficulty maintaining its financial stability.

Generative AI is adding further urgency. It is significantly reducing the cost of conducting an attack while improving the quality of scams. This is contributing to increases in both the number of attempted attacks and their success rates.

Cybercriminals can therefore operate at greater scale while producing more convincing messages and interactions. For businesses, this increases the likelihood that exposed data will be transformed into operational and financial harm.

Why Cyber Resilience Matters to Lenders

A bank’s primary concern is whether a borrower will remain able to meet its financial obligations. If a cyberattack interrupts business activity, reduces revenue, and creates unexpected costs, it can weaken that ability.

Cyber risk is consequently becoming relevant to the same financial question that underpins traditional credit assessment: how likely is a company to remain stable and solvent?

A landmark study by the Bank of Italy suggests that financial institutions are moving towards treating cyber risk as a core operational risk. They are examining how digital resilience could be included in credit-merit evaluations, creating a stronger link between cybersecurity and access to finance.

Banks are also looking for a systematic way to assess a company’s digital security, as this can provide an indication of management quality. If a business uses outdated software with security vulnerabilities, has exposed credentials, and lacks a remediation plan, a bank may view this as a sign of weak overall risk management.

In the near future, a company’s cyber posture could directly influence its interest rates or even its access to capital. To support these decisions, banks will need new types of data that measure each company’s cyber exposure and the potential impact of an attack. In Europe, however, a common assessment standard has not yet been established.

The Human Firewall – Cybersecurity Starts with People

Technical vulnerabilities are only part of the threat. As criminal methods evolve, attackers are increasingly targeting people rather than attempting to penetrate systems directly.
The CRIF Cyber Observatory has identified a rise in quishing, a form of phishing conducted through QR codes, and in the Like Scam. In a Like Scam, a victim is offered a small reward for completing a simple task. The interaction then develops gradually, allowing the criminal to build trust and manipulate the person until they become trapped in the scheme.
Exposed credentials can make this manipulation more effective. Information obtained from the Dark Web may allow criminals to personalise their approach, appear familiar or create a more credible pretext for contacting an employee.

AI can make these techniques even more convincing through emotionally intelligent bots and deepfakes. A bot, for example, can use information found on the Dark Web to establish rapport with an employee. A deepfake can then imitate a CEO’s voice and request an “urgent” wire transfer.

The leading obstacle is not software but the skills gap. Technology can detect vulnerabilities and block certain attacks, but it cannot eliminate every risk created by human interaction.

This is why the necessary response is a “Human Firewall”: employees who understand how manipulation works and apply strategic scepticism when something appears unusual.
In 2026, scepticism is a core business competency. If a request involves a QR code or an unusual wire transfer, they must verify it through a second, independent channel. This human layer is what ultimately protects financial stability.

Cyber Resilience - Preparing for What Comes Next

In the emerging relationship between digital security and creditworthiness, much remains to be defined. Europe has no common assessment standard, and banks are still examining which data can reliably measure a company’s cyber exposure.

This period of development also gives businesses an opportunity to prepare before cyber resilience becomes a more established part of credit assessment. Technology provides only part of the defence. A company’s resilience also depends on how it addresses vulnerabilities and whether its employees are empowered to recognise and verify suspicious requests.

Want to learn more? Listen to the CRIF Talks podcast episode The SME Cyber Shield: Resilience as a Business Value on Apple Podcast and Amazon Music.