Cybersecurity is increasingly being treated as a funded operational responsibility rather than an optional technology project.
Nigeria’s communications regulator is requiring telecom operators to create dedicated cybersecurity budget lines and appoint security leaders. In Europe’s German-speaking industrial economies, new threat data demonstrates how ordinary phishing emails can become gateways into operational technology. New York is directing grants towards municipal water systems, while a partnership between Cynomi and SPECTRA seeks to translate verified security controls into warranties and lower cyber-insurance costs.
Together, the developments show how regulators, infrastructure operators and insurers are converging around one principle: organisations must be able to finance, operate and demonstrate their cyber resilience.
Nigeria makes cybersecurity a distinct financial responsibility for telecom operators
The Nigerian Communications Commission has instructed telecommunications providers to allocate dedicated funding to cybersecurity under updated guidance for implementing the country’s Cyber Resilience Framework.
The requirement applies to operators including MTN Nigeria, Airtel Nigeria, Globacom and T2mobile. According to coverage from ITWeb Africa, providers must reserve an appropriate proportion of their operational budgets for cybersecurity and identify that expenditure through a standalone budget line.
The TechAfrica News report similarly places the measure within the NCC’s broader effort to protect communications infrastructure and subscriber data.
Separating cybersecurity expenditure from general IT budgets is more significant than it may initially appear. When security competes with network expansion, software upgrades and routine maintenance inside a single technology budget, defensive projects can be delayed because their benefits are less immediately visible.
A dedicated allocation gives boards, auditors and regulators a clearer view of whether security spending corresponds with the operator’s risk exposure. It also reduces the possibility that security funding will disappear into broader operating costs without evidence that appropriate controls were implemented.
The framework extends beyond budgeting. Operators must appoint dedicated chief information security officers responsible for risk assessments, incident response, security controls and resilience programmes. They must also submit quarterly reports covering cybersecurity incidents and breaches.
Existing requirements oblige providers to notify the NCC and the Nigeria Data Protection Commission within four hours of detecting an attack. That is an exacting deadline, particularly when an organisation may still be determining the scale and origin of an incident.
Operators are additionally expected to conduct cybersecurity awareness sessions for employees and board members twice a year, while educating customers about phishing, password theft and the compromise of one-time passcodes. Call logs, user identifiers and traffic information must be retained locally for at least two years, subject to lawful-access requirements.
The rules arrive as Nigeria’s dependence on digital connectivity continues to increase. NCC figures cited by ITWeb Africa show that internet users consumed 1.41 million terabytes of data in April 2026, compared with approximately 983,000 terabytes in April 2025. Nigeria’s National Information Technology Development Agency estimates that the country loses more than $500 million annually to cybercrime.
Telecommunications networks support mobile banking, digital identity, government services and emergency communications. A disruption at a major operator can consequently spread well beyond the communications sector.
The NCC’s challenge will be to ensure that dedicated budgets become a minimum capability requirement rather than an accounting exercise. Regulatory audits should assess whether spending produces measurable improvements in areas such as asset visibility, identity protection, network segmentation, recovery testing and incident-detection times.
DACH industrial systems remain exposed through conventional IT entry points
Industrial organisations in Germany, Austria and Switzerland may be comparatively well prepared, but their control systems remain exposed to ransomware, espionage and targeted intrusion.
A DACH industrial cybersecurity situation report drawing on Kaspersky ICS CERT data identifies Austria as a particular area of concern. During the fourth quarter of 2025, the proportion of industrial-control-system computers on which ransomware was blocked increased by a factor of 2.71. Malicious documents increased by a factor of 1.49.
Austria also recorded Western Europe’s highest proportion of email threats blocked on ICS computers, at 2.28%. Germany registered the region’s highest rate of blocked malicious documents, at 0.91%, while Germany and France recorded spyware levels of 1.17%. Switzerland was the only country covered by the report to experience a continuous quarterly increase in spyware.
The figures demonstrate why operational-technology security cannot be separated from conventional corporate cybersecurity.
Attackers do not necessarily begin by directly compromising a programmable logic controller or supervisory control and data acquisition system. They can enter through an employee’s inbox, establish persistence in the office network and then search for remote-access services or insufficiently protected connections leading towards operational environments.
The report points to a campaign that distributed the XWorm remote-access Trojan through files presented as job applications. An employee in human resources may appear far removed from a factory control system, but a compromised administrative workstation can provide the initial foothold for lateral movement.
Industrial operators therefore need to address the routes connecting their information-technology and operational-technology estates. Important measures include:
- Segmenting office, production and control networks.
- Requiring phishing-resistant multifactor authentication for remote access.
- Routing privileged connections through monitored jump hosts.
- Prioritising patches for internet-facing and remotely accessible systems.
- Preventing unsigned executable files and scripts from running directly from email attachments.
- Continuously monitoring traffic moving between IT and OT environments.
- Maintaining tested procedures for operating safely when digital systems become unavailable.
This is not simply a data-protection problem. A compromised industrial system can interrupt production, damage machinery or create risks for employees and surrounding communities. HIPTHER has previously examined the physical consequences of this convergence through its analysis of evolving cybersecurity threats to hydropower dams.
New York funds cybersecurity improvements for local water systems
Municipal water and wastewater operators frequently face the same sophisticated threats as national infrastructure providers but have much smaller budgets and security teams.
New York is addressing part of that imbalance through its Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements programme, known as SECURE.
More than $200,000 has been allocated to projects in Tompkins and Cortland counties, according to 607 News Now. The funding will support cybersecurity assessments and help municipalities implement the state’s minimum standards for drinking-water and sewer systems.
Tompkins County awards include funding for Dryden, Freeville, Ithaca and Trumansburg. In Cortland County, projects cover the City of Cortland’s water and wastewater treatment plants and assessments for the Town of Virgil.
The local awards form part of more than $9 million distributed among 153 water-system projects across New York.
Cybersecurity assessments are a necessary starting point because many smaller utilities do not have a complete inventory of their connected equipment, remote-access routes and software dependencies. Operators cannot reliably protect assets that they do not know are present.
Assessments should nevertheless lead to practical remediation. High-priority improvements may include removing default credentials, restricting internet exposure, introducing multifactor authentication, isolating control equipment from business networks and maintaining offline backups of configurations.
Utilities should also preserve manual operating procedures. A well-defended system can still be compromised, and recovery may take longer than expected. Operators need to understand how essential services will continue while digital controls, communications or billing platforms are unavailable.
The New York grants illustrate the value of pairing cybersecurity requirements with financial support. Minimum standards without implementation funding can place unrealistic obligations on small municipalities. Funding without measurable standards, however, can produce fragmented technology purchases that fail to improve resilience.
Cynomi and SPECTRA connect security evidence with insurance access
Cyber-insurance underwriting has traditionally required organisations to complete detailed questionnaires describing their controls. The process can be slow, repetitive and dependent on statements that are difficult for insurers to verify.
Cynomi and SPECTRA are attempting to make that process more evidence-driven.
Cynomi provides managed service providers, managed security service providers and virtual CISO firms with tools for automating risk assessments, compliance processes and client reporting. SPECTRA operates a certification and cyber-resilience warranty platform.
Under their partnership, Cynomi will map information already collected through its platform against SPECTRA’s certification criteria. Channel Dive reports that this could reduce the need for a separate insurance assessment while helping managed providers demonstrate the effectiveness of their services.
Certified providers will be able to offer customers as much as $1 million in warranty coverage. Cynomi says qualifying customers could receive preferential cyber-insurance rates of up to 35%, while managed providers may reduce their own errors-and-omissions insurance costs by as much as 25%.
The partnership reflects a broader shift from periodic declarations towards continuously structured security evidence.
For insurers, verified information about controls can improve risk selection and pricing. For customers, certification can make it easier to determine whether a provider’s security claims are supported by repeatable processes. Managed providers can use the resulting warranty and insurance benefits to differentiate their services.
There are still limitations. Certification represents conditions at a particular point or across a defined assessment period. It cannot guarantee that an organisation will remain secure after its technology, workforce or threat environment changes.
The quality of the model will therefore depend on how frequently evidence is refreshed, how exceptions are handled and whether certification criteria reflect actual attack paths. Organisations should also examine exclusions and conditions carefully before treating warranty coverage as a substitute for incident preparation.
The bigger picture: cybersecurity must be funded, measurable and operational
These developments concern different sectors and regions, but they are responses to the same structural problem.
Nigeria is requiring telecommunications companies to separate security spending from general technology expenditure. The DACH industrial report demonstrates why protections must cover the path from an ordinary office email to critical operational systems. New York is providing smaller water operators with resources to meet minimum standards. Cynomi and SPECTRA are seeking to turn implemented controls into evidence that insurers and customers can evaluate.
The common direction is towards accountability.
A cybersecurity programme needs an identifiable budget, an executive owner, operational controls and evidence showing that those controls work. Insurance and certification can reinforce that structure, but they cannot create resilience where the underlying practices are absent.
The organisations best prepared for the next incident will be those that can answer four questions clearly: what systems matter, who is responsible for them, how their protection is funded and whether recovery procedures have been tested under realistic conditions.
