Survey: State actors rank as the second most significant cybersecurity concern among Finnish companies

Concern about cybersecurity has remained high among companies for the second consecutive year. Finnish ICT decision-makers identify data breaches, leaks, and corporate espionage (32%), state actors (18%), and denial-of-service attacks (13%) as the most significant threats. The increasing use of artificial intelligence in organizations is also seen as a risk, particularly regarding the leakage of confidential information. Preparing for these threats is not just a challenge for individual companies but a serious issue from the perspective of Finland’s overall security.

“When there is war in Europe, it’s clear that side effects in the cyber domain are also possible. It’s extremely healthy that companies remain alert and aware of the broader security landscape and related threats. This shows that messages from authorities have reached companies and that responsibility must be shared,” says Kaapro Kanto, Vice President, Network & Cloud at DNA Corporate Business.  

Preparedness has not kept pace with threats

Although the number of companies with preparedness plans has slightly increased compared to last year, practical exercises still lag behind. The study reveals that just over half (54%) of companies have a preparedness plan, up from 47% last year. Nevertheless, only just over a quarter practice cyber crisis scenarios, and 26% feel fully prepared for the current cyber threat landscape. About one-fifth of companies report having purchased cybersecurity insurance.

Good situational awareness has not led to comprehensive reform of critical cybersecurity processes. According to Kanto, Finnish companies still have significant room for improvement in their level of preparedness for cyber threats.

“The current geopolitical situation pushes us toward a higher level of preparedness, which requires not only investments and good planning from companies but also genuine practice for real-life scenarios. I find the lack of practice revealed in the results concerning, because without it, preparedness is essentially only halfway there. At the same time, nearly half of Finnish companies still lack a plan altogether, which represents a noteworthy risk from the perspective of national security preparedness.”

There is a clear factor slowing down progress: as many as 74 percent of companies cite the ongoing shortage of cybersecurity professionals as a barrier to achieving strong cybersecurity. The skills shortage is particularly pronounced in small and medium-sized enterprises, where limited resources make it harder to identify and manage risks. The survey results indicate that the talent shortage is primarily being addressed through partnerships. A total of 94 percent of respondents report utilizing external partners for support in information and cybersecurity matters, representing a slight increase from the previous year.

Investments continue and focus is on staff cybersecurity skills

According to Kanto, the NIS2 Directive and the national cybersecurity law that came into force in April 2025 have increased companies’ awareness of cybersecurity obligations.

Half of the companies plan to increase their overall cybersecurity investments next year. Nearly one-third believe these investments will provide a competitive advantage. The most significant planned investments are in staff cybersecurity awareness, business continuity and incident management, and process development. Additionally, 66 percent of respondents plan to invest to some extent in new cybersecurity services in the coming year.

“It’s clear that the imposed obligations are forcing organizations to consider cybersecurity from more angles and take more concrete actions. This is reflected in the continued investment in cybersecurity and the realization of technology implementations,” Kanto adds.

*DNA’s cybersecurity survey examined how companies operating in Finland perceive information security and cybersecurity. The survey was conducted via online and telephone interviews in August 2025 and included 156 ICT decision-makers from companies and public sector organizations with at least 10 employees. Twenty percent of respondents represented organizations or companies with at least 250 employees. The survey was carried out by Dagmar Oy.

Top 5 findings from the survey:

1. Cybersecurity concerns remain high, but preparedness is still lacking
70% of decision-makers are concerned, but practical readiness still needs improvement. Only just over a quarter of companies practice cyber crisis scenarios and business recovery. Preparedness planning has become slightly more common, but nearly half of companies still lack a plan.

2. Talent shortage is a critical challenge – its significance has grown since last year
74% of respondents see the lack of skilled professionals as a barrier to achieving strong cybersecurity. This figure has increased by 7 percentage points since last year. Companies are increasingly relying on external partners.

3. Cybersecurity is increasingly seen as a competitive advantage
Already 28% of decision-makers believe cybersecurity investments provide a competitive edge. This figure has grown by 8 percentage points since 2024.

4. Cybersecurity investments continue to grow, though more moderately
Companies plan to invest especially in staff cybersecurity training, business continuity, and process development.

5. AI usage rules have been defined in more companies
Nearly half of companies have now established rules for AI usage (2024: 34%), but concerns about data and trade secret leaks remain high.

The survey report is available here (in Finnish).

Media enquiries:

Kaapro Kanto, DNA Vice President, Network & Cloud, Corporate Business, tel. +358 40 059 9020, kaapro.kanto@dna.fi  

DNA Corporate Communications, tel. +358 44 044 8000, communications@dna.fi