Why companies remain vulnerable despite their investments and what management must demonstrate under ZInfV-1
JULIJ BOŽIČ, Managing Director of Smartis
Over the past year, in conversations with management and IT teams, I have repeatedly come across the same paradox. Companies have invested heavily in cybersecurity, bought top-tier tools and strengthened the protection of individual parts of their IT environment. Yet they often have no clear answer to a simple question: would they detect a serious attack early enough and respond to it in time?
The question is particularly relevant this autumn. On 19 December 2026, the deadline expires for new essential and important entities to adopt the measures under Articles 21 and 22 of ZInfV-1. For entities obliged under the previous act and for operators under ZEKom-2, the deadline expired on 19 June 2026.
At Smartis, we see that the problem is often not a lack of technology, but the way it is integrated into the overall security system. When a new risk emerges, the easiest answer is to buy a new tool – for email, the network, identities or the cloud. An individual solution may be excellent, but on its own it does not guarantee greater security. Its value only becomes apparent when it has a clear role, connects with the existing environment and is embedded in defined response processes.
This is what I want to point out: more investment in security does not automatically mean more control. Technology increases security when it closes a specific gap and is meaningfully connected with other measures. If solutions are not connected and responsibilities are not clearly defined, additional tools may mainly increase complexity and costs.
More tools do not in themselves mean better visibility
Companies have often responded to new threats with additional technology. This has resulted in environments with separate solutions for the network, email, endpoints, the cloud, identities, logs, and IT and OT systems. Each monitors its own area, uses its own rules and generates its own stream of alerts. The problem, therefore, is not the number of solutions, but whether together they form a manageable security system.
An event that looks insignificant in one system can, together with an alert from another, reveal a serious attack. If systems do not exchange information, a human has to spot the connection among hundreds or thousands of daily alerts.
Security is therefore not measured by the number of licences, but by how quickly an organisation detects a deviation, understands its severity and takes action.
In a cyberattack, lost time is the most expensive thing
Security teams deal with a multitude of alerts every day. Many are duplicates, less important or false positives, so analysts spend a lot of time on events that require no action. Meanwhile, a real attack can continue.
Within a few hours, an attacker can gain additional privileges, move between systems and access sensitive data or prepare to steal or encrypt it. The difference between early detection and detection delayed by several hours is not a technical detail; it can be what separates a contained incident from a business crisis.
At Smartis, we tested a solution that learns the normal behaviour of an IT environment in the demanding environment of a large Slovenian company. It recognised an anomaly significantly earlier than the existing monitoring systems and processes. At another Slovenian company, the same type of technology detected an actual cyberattack in time and made it possible to stop it before it could cause major business damage.
Such an approach does not just look for known attack patterns; it also flags unusual access, a sudden transfer of large volumes of data, communication with an unknown destination or a message that deviates from normal correspondence. The technology does not replace experts, but helps them recognise real threats faster.
ZInfV-1 does not count the tools you have bought; it requires concrete, implemented and verifiable security measures
For obliged entities, a fragmented security environment is not only an operational shortcoming, but also a problem of demonstrable compliance.
ZInfV-1 has been in force since 19 June 2025 and transposes the European NIS 2 Directive into Slovenian law. The persons who manage, supervise or run an organisation’s business are responsible for implementing the measures under Articles 21 and 22. They must approve the measures and oversee their implementation.
Obliged entities must put their security documentation in order, know their information assets, implement appropriate security measures, maintain logs, verify the effectiveness of the measures and report significant incidents within the statutory deadlines.
The law does not prescribe a list of products. An organisation must show which assets and risks it manages, who is responsible for them, which measures it implements and whether they work. To do this, it needs well-organised data, clear processes and a link between technology, people and responsibilities.
Three questions for management
- Do you have an up-to-date overview of your key information assets and who is responsible for them? Do you know which IT assets support which business functions?
- Can you detect a threat early enough to limit its impact?
- Do you have control over who can access your most sensitive systems, data and digital keys?
If you cannot answer any of these questions with a clear “yes”, check the gaps in your existing environment before making a new purchase. A new solution makes sense if it closes a clearly identified gap, integrates with existing systems and contributes to faster detection, decision-making or response.
Smartis’ approach: three connected pillars
Comprehensive cybersecurity cannot be established with a single product, nor is it guaranteed by a larger number of tools. At Smartis, we build it in three pillars that can be introduced gradually according to the organisation’s actual gaps and priorities. The starting point is therefore not a list of technologies, but the question of which capabilities the organisation needs and how to connect them into a manageable whole.
The first pillar is the foundation: information assets, IT management processes and documentation. An organisation needs a clearly defined register of information assets and their link to business functions, as well as clearly defined IT processes for change, incident, problem and request management, so that it can establish visibility, traceability and evidence.
The second pillar is detection and logging. Anomaly detection solutions monitor the network, email and identities, while security event management systems centralise and correlate logs. With the support of managed detection and response services or a security operations centre, an organisation can detect, assess and handle an incident faster.
The third pillar is the protection of identities, access and sensitive data. This includes privileged access management and multi-factor authentication, digital certificate lifecycle management, and the protection of digital secrets and keys. The aim is not to add technology for technology’s sake, but to close specific gaps and connect these capabilities with the other two pillars.
Before your next purchase, review your existing environment first
The next security decision should therefore not start with the question of which tool the company still needs to buy. It should start with a review of whether existing technologies, data, identities, people and processes form a sufficiently clear and usable whole, and where the gaps are that are worth closing.
Smartis helps connect IT environment management, cyber threat monitoring, and identity and access protection into a traceable and manageable system.
The goal is not to add yet another console. The goal is to detect a threat early enough, understand its significance and act in time – so that management can sleep soundly, knowing the environment is under control.
The biggest security vulnerability is often not the technology you don’t have. It is the gap between capabilities, processes and responsibilities that should work as a whole.
Frequently asked questions about cybersecurity
Why do more security tools not mean more security?
Because each tool monitors only part of the IT environment and generates its own alerts. Security improves when solutions close specific gaps, exchange information and are embedded in a clear response process. If they remain disconnected, the security team finds it harder to recognise the wider context of an event and responds more slowly.
What is security alert overload?
It is a situation in which security systems generate so many alerts that analysts can no longer handle them in a timely and thorough manner. An important signal can get lost among false, duplicate or less dangerous events.
How can you tell whether the security tools in your company are sufficiently connected?
You need to check whether the solutions exchange data, whether events are collected and correlated in one place, and whether it is clear who handles each alert. It also matters whether the organisation can trace the entire path from anomaly detection to the decision, the response and the documentation of the incident.
What does ZInfV-1 require of an organisation’s management?
Management must approve risk management measures, oversee their implementation and ensure that the organisation manages information security systematically. Responsibility therefore cannot be fully transferred to the IT department or an external provider.
What should a company check before buying a new security tool?
First, it must determine which specific gap the tool addresses, how the new solution will connect with the existing environment, who will monitor the alerts and how the response will work. Well-chosen new technology reduces complexity or keeps it under control; a purchase made without these answers can increase it without improving security.
If you cannot answer any of the three questions with a clear “yes”, write to me at jakob.matek@smartis.si – together we will identify where your biggest gap is and what you need to address first by 19 December 2026.
