Investment platform Wealthyhood has recorded a five-fold increase in investors and an eight-fold rise in client assets in Cyprus between June and September 2026, with data from its partnership with the Bank of Cyprus pointing to growing interest in local shares, exchange-traded funds and accessible long-term investing.

The figures, published in ‘Wealthyhood’s Cyprus Investor Pulse 2026‘ report, cover anonymised and aggregated data from clients resident in Cyprus between June 1 and September 30, with the findings highlighting how lower entry costs and simpler account funding can encourage participation in financial markets.

Alexandros Christodoulakis, co-founder and chief executive of Wealthyhood, told the Cyprus Mail that the response from Cypriot investors had exceeded expectations in terms of the quality of their engagement.

“People in Cyprus didn’t need to be convinced that investing matters. What they were missing was a simple, trusted way to start, and once that existed, they moved quickly,” he said.

The report found that 88.6 per cent of clients who deposited money went on to buy a stock or exchange-traded fund (ETF), compared with 80.4 per cent among clients who signed up in Greece during the same period.

Christodoulakis said the company was encouraged by the extent to which customers were continuing to invest after opening their accounts, rather than simply registering and leaving the platform.

“Of those who joined in June or July and invested, 88.9 per cent were still invested on September 30,” he said.

“Seven in ten (70.3 per cent) have never sold an investment, and six in ten (59.1 per cent) made a second deposit within 30 days of their first,” Christodoulakis continued. “People are not trying the app once and walking away; they are building a habit.”

He added that four months of activity remained an early snapshot, but that the quality of engagement had been particularly encouraging.

Low entry barriers foster early activity and habit-building

The report also found that 58.4 per cent of new investors made their first investment within 7 days of signing up, while 14.4 per cent invested on the same day.

The typical first deposit was €100, while the typical first investment amounted to €55. Almost two-thirds of investors, or 64 per cent, started with €100 or less, suggesting that many were entering the market with relatively modest sums.

More than half, or 56.8 per cent, made their first investment in an ETF, which allows investors to buy into a collection of companies through a single product.

The most popular first investment was the Vanguard S&P 500 ETF, accounting for 16.6 per cent of first investments, followed by Bank of Cyprus shares at 10.2 per cent.

Christodoulakis said traditional barriers to investing included high minimum investment requirements, fees that eroded smaller amounts, paperwork and complicated terminology.

“Faced with that, many people who could invest simply never start. Not because they don’t care about their future, but because the first step looks expensive, complicated and opaque,” he stated.

Wealthyhood aims to address these obstacles by allowing customers to invest in international and local markets from €1, with zero commission and fractional shares, alongside an education hub containing more than 50 guides.

The platform also offers Autopilot, an automated investing service through which users can make regular investments without having to manage each transaction manually. The typical Autopilot user invests €150 a month, according to the report.

Christodoulakis said access to financial markets needed to be accompanied by a better understanding of investment products and their risks.

“Access alone isn’t enough, though. People also need to understand what they’re buying and why, which is why education sits at the core of the app, not in a corner of it,” he said.

Investor demographics reveal mature and higher-earning profile

The report’s demographic findings challenge the assumption that investment applications primarily attract younger users.

The typical investor in Cyprus is 40 years old, works full-time and declares an annual income of between €30,001 and €50,000. The largest age group is 35 to 44, accounting for 31.7 per cent of investors, followed by those aged 45 to 54 at 25.9 per cent and those aged 25 to 34 at 25.3 per cent.

People under 30 account for 19.3 per cent of investors.

Income levels were also higher than those recorded among investors in Greece. Some 31 per cent of Cypriot investors declared annual incomes above €50,000, while 24 per cent reported incomes below €20,000, compared with 58 per cent of investors in Greece in the latter category.

Full-time employees account for 86.5 per cent of investors, while 4.7 per cent are self-employed.

Finance and insurance is the most common industry, employing 31.5 per cent of investors, followed by information technology at 10.5 per cent and the public sector at 8.1 per cent.

Nicosia district accounts for 50.5 per cent of investors, followed by Limassol at 25.6 per cent, Larnaca at 14.9 per cent, Paphos at 5.1 per cent and Famagusta at 3.9 per cent.

Christodoulakis said the available data was not yet sufficient to establish how the investor profile had changed over time or to draw reliable conclusions about customers’ previous investing experience.

However, he said the behaviour observed so far pointed towards a cautious, long-term approach, characterised by small initial investments, ETFs and limited selling.

“One number I’d like to see change: about one in six new investors is a woman. Closing that gap is one of the biggest challenges for retail investing, in Cyprus and beyond,” he said.

He added that the market was increasingly being shaped by working people seeking greater control over their long-term finances, rather than traders attempting to profit from short-term market movements.

“As cost and complexity keep falling, I expect that profile to broaden, especially to younger people and to women,” he said.

Domestic shares drive engagement alongside global ETFs

The availability of domestic shares has also helped attract investors to the platform, with the Bank of Cyprus emerging as its most-bought individual stock.

Cypriot and Greek shares became available through Wealthyhood on July 17, allowing customers to hold domestic investments alongside international stocks and ETFs.

Customers can access Bank of Cyprus shares and 8 other companies listed on the Cyprus Stock Exchange, namely Vassiliko Cement, Demetra Holdings, Logicom, Cyprus Cement, Petrolina, Atlantic Insurance, Pandora Investments and GlobalWealth Group.

Within less than 3 months of the launch, 29.2 per cent of buyers had purchased at least 1 Cypriot share.

The Bank of Cyprus was bought by 35.8 per cent of stock investors, ahead of US technology company NVIDIA at 21.3 per cent and SpaceX at 12.6 per cent.

Among investors who purchased Cypriot shares, 82.6 per cent chose the Bank of Cyprus, followed by Vassiliko Cement at 16 per cent, Petrolina at 12.3 per cent and Logicom at 8.2 per cent.

The report found that domestic shares were bringing new participants into the market. For 52.8 per cent of investors holding Cypriot shares, a local company had been their first investment on Wealthyhood, compared with just 1.8 per cent among other investors.

Those holding Cypriot shares also had larger portfolios, with a typical portfolio 1.8 times the size of those held by other investors and containing 3 investments rather than 1.

Christodoulakis said familiar domestic companies could provide an accessible entry point for people who were less comfortable with international markets.

“People invest more readily in companies they know, and familiar local names are often the bridge into the market,” he said.

However, he stressed that local shares were complementing rather than replacing international investments.

The report found that 8.6 per cent of money invested since July 17 had gone into Cypriot shares, while Greek shares accounted for 12.3 per cent. Some 18.9 per cent of buyers had purchased at least 1 Greek share.

Across portfolios, 37.6 per cent of invested money was allocated to the United States, 21.1 per cent to global ETFs, 16.5 per cent to the rest of Europe, 11.3 per cent to Greece and 8.9 per cent to Cyprus.

The figures also showed the importance of ETFs in investors’ portfolios. The Vanguard S&P 500 ETF, which tracks the 500 largest US companies, had been purchased by 42.7 per cent of ETF investors and was held by 24.4 per cent of all investors on September 30.

Other popular ETFs included the Vanguard LifeStrategy 80 per cent Equity fund, purchased by 13.6 per cent of ETF investors, the SPDR MSCI World at 13.1 per cent and the iShares Nasdaq 100 at 11.9 per cent.

Among investors who still held investments on September 30, 42.5 per cent held only ETFs.

Dual exchange listings and long-term literacy goals

The report also examined access to shares listed in Athens. On September 30, 25.6 per cent of investors held at least 1 stock listed on Euronext Athens, including the Bank of Cyprus, while 7.6 per cent held a stock listed on the Cyprus Stock Exchange and 4.2 per cent held shares listed on both exchanges.

Athens-listed stocks accounted for 17.1 per cent of invested money, while Cyprus Stock Exchange-listed shares represented 2.1 per cent.

After the Bank of Cyprus, the most widely held Athens-listed stocks were Eurobank, at 5.1 per cent, followed by Allwyn and Alpha Bank, each at 2.8 per cent. Half of the 10 most widely held names were banks.

Christodoulakis said the company’s priorities in Cyprus were to improve financial education, encourage customers to turn initial investments into regular habits and expand the role of automated investing.

He said Wealthyhood and the Bank of Cyprus shared a responsibility to help close the financial literacy gap, particularly among younger people and women, by improving understanding of risk, diversification and the importance of time in investing.

“Giving people access to markets is only half of the job; helping them understand risk, diversification and time is the other half,” he said.

The company also wants to build on existing customer behaviour through services such as Autopilot, which can make regular investment contributions easier to maintain.

Christodoulakis said the first months of activity had demonstrated a clear appetite for accessible investing in Cyprus, but that the next challenge was to turn the initial momentum into sustained participation.

“Four months in, Cyprus has shown us the appetite is real. Now the work is to turn that early momentum into a generation of long-term investors,” he said.

The Enterprise Europe Network (EEN) in Cyprus will hold an online information session on November 19, 2026, to present funding opportunities available to businesses and organisations under the European Innovation Council’s (EIC) 2027 work programme.

The event, announced by the Cyprus Chamber of Commerce and Industry (Keve), which coordinates EEN activities in Cyprus, will explain the main funding instruments available under the programme and outline the most important changes and new developments planned for 2027.

The session is aimed at businesses and organisations seeking European funding to support innovation, develop new technologies and scale up their operations.

Participants will receive information on the EIC Pathfinder, EIC Transition and EIC Accelerator programmes, as well as the Strategic Technologies for Europe Platform (STEP) Scale Up initiative.

These instruments support different stages of innovation, from early-stage research and the development of technologies towards commercialisation to the growth of businesses seeking to expand their operations.

The event will also feature EEN2EIC, which will present its activities, services and tools designed to help innovative small and medium-sized enterprises (SMEs) and start-ups access EIC funding opportunities.

The special session will also explain how EEN2EIC supports businesses in improving their investment readiness, helping them prepare to attract funding and pursue opportunities under the European innovation funding framework.

Interested businesses and organisations can register through the event’s registration link provided by the organisers.

Cypriot businesses need to organise their data, establish clear rules and train employees before adopting artificial intelligence (AI), according to Kyriaki Parmakki, co-founder and chief executive of Limassol-based solutions studio essere.ai, who hosted the first ClickUp event in Cyprus earlier this month.

The event, held on October 8, brought together business owners, directors and technology specialists to explore how companies can integrate AI into their operations, with demonstrations of practical applications and discussions on the foundations needed to make the technology effective.

ClickUp, an American software company valued at $4 billion and known for its project management, task management and AI capabilities, held its first event on the island in partnership with essere.ai, which is ClickUp’s official and certified partner in Cyprus and the only partner it works with directly on the island.

In an interview with the Cyprus Mail, Parmakki said that the event highlighted a growing gap between individuals’ willingness to use AI and the extent to which businesses have integrated it into their operations.

“In 2025, 44 per cent of people in Cyprus used generative AI, against an EU average of 33 per cent, while only 9 per cent of Cypriot companies used AI, less than half the EU rate of 20 per cent,” she said.

“People in Cyprus are ahead of their companies.”

She added that the event’s attendance and the questions raised by participants suggested that businesses were increasingly interested in practical implementation rather than simply debating whether to adopt the technology.

“Appetite is not the problem. The room was full on a Thursday evening, with owners and directors, and the questions were about how, not whether,” Parmakki said.

“ClickUp choosing Cyprus for its first event here means international platforms now see this market too.”

The event featured a presentation by ClickUp guest speaker Mary Bornaghi, who outlined the platform’s approach to bringing work management and AI together, while Parmakki presented the fundamentals businesses need before introducing AI.

Neophytos Polydorou, senior AI engineer at essere.ai, demonstrated 5 live use cases using real systems and demonstration data, while representatives of 2 companies discussed how moving their work into ClickUp had changed their operations.

The evening concluded with an AI-readiness assessment that participants could complete on their phones, followed by networking.

A central theme was that businesses should focus on their operational foundations before investing in AI tools, with Parmakki arguing that the technology’s effectiveness depends on the quality and accessibility of the information it can use.

“Everything a company does is data. A call, an invoice, a message, an approval. AI can only work with what it can read, so the first question is never which tool, it is where the data lives,” she said.

She described 4 stages of business development according to how information is managed, ranging from data held in employees’ heads to information stored in separate files, then organised in systems, and finally supported by AI intelligence.

“Moving up one step always means the same thing, organising the data, and only then does AI have something reliable to work with,” Parmakki said.

Skipping this groundwork can result in AI producing generic responses or confidently delivering incorrect information, while employees may turn to personal AI accounts to handle company information because their employers have not provided suitable systems.

Businesses may also struggle to translate individual productivity gains into measurable commercial results.

Parmakki cited McKinsey research involving 1,700 executives, saying 80 per cent reported that AI made them personally more productive, while only 37 per cent of companies saw the benefits reflected in their results.

“The gap between those two numbers is the foundations,” she said.

The event also examined the growing use of AI by employees, including the security implications when individuals adopt tools without company oversight.

According to figures presented during the event, the proportion of employees regularly using AI on their work computers had increased from 15 per cent to 45 per cent in 1 year, while 2 thirds of those users signed in through personal rather than company accounts.

“The question is not whether your people use AI. It is whether the company knows,” the event’s presentation stated.

Parmakki said the most immediate returns tended to come from processes involving large volumes of unstructured information, including telephone calls, emails, invoices and documents.

Examples included answering calls in the caller’s language, recording the details and making bookings while other employees continued their work, as well as reading, checking and filing supplier invoices without requiring someone to open each email.

Other applications could prepare short morning briefings identifying tasks at risk of missing deadlines and suggesting how work could be reassigned.

“These are not pilots. Each one removes a chore that repeats every week, and a person can check the result in seconds,” she said.

However, she stressed that businesses must establish clear boundaries for AI agents before allowing them to operate.

“Before an agent goes live we write three things down, what it may read, what it may do on its own, and where a person decides,” Parmakki continued.

“Draft yes, send no. Suggest yes, pay no. No decisions about people or payments without a person.”

She added that every action should be logged and the records reviewed weekly, allowing companies to monitor whether AI systems are operating within their permitted limits.

The live demonstrations illustrated how these principles could work in practice, including a support call recognised and handled by an AI agent called Ciao, which helped the caller and made a booking.

Another demonstration showed an 8am briefing identifying a task at risk and proposing that it be reassigned, while an AI agent prepared month-end billing for approval by a person.

Other examples included filing a supplier invoice without anyone having to read the inbox and conducting a weekly security review in which an agent checked every action against established rules, including access it had been denied.

The event also addressed the distinction between developing bespoke software and configuring existing platforms, with the presentation arguing that although building software has become more accessible, maintaining it still involves logins, permissions, mobile applications, backups, security, updates and support.

The departure of the person who originally built a system can also create difficulties for the business.

The recommendation was to build technology where it creates a genuine competitive advantage and configure existing tools for other requirements.

Regulatory compliance was another key theme, particularly the European Union’s AI Act and the responsibilities it places on businesses.

“The EU AI Act already asks two things of every company, train your people on AI, and tell customers when they are talking to a machine,” Parmakki said.

The event presentation stressed that businesses should provide AI training and retain evidence of that training, while making clear to people when they are interacting with AI.

It also highlighted the heavier requirements for AI systems making decisions about people and money, which Parmakki said were due to arrive in December 2027.

Beyond regulation, she argued that a lack of expertise and uncertainty about legal requirements and data protection were more significant obstacles to adoption than the price of the technology.

“The gap is not technology, and it is not money. It is knowledge, and fear,” she said.

“Most companies do not know where to start and do not know where this is going, so they wait.”

She referred to Eurostat findings on businesses that had considered AI but decided against adopting it, saying the most frequently cited reason in Cyprus and across the EU was a lack of relevant expertise, followed by legal uncertainty and data protection concerns, while cost ranked considerably lower.

Parmakki said essere.ai aimed to bridge that gap through education before technology, helping business owners understand what AI could do within their own operations, where it was appropriate and what needed to be in place first.

For companies seeking to move beyond experimentation, she identified 3 priorities, beginning with establishing a reliable operational system that the business owns.

This should provide a single source of information for clients, tasks, documents and figures, rather than relying on employees’ memories, inboxes and spreadsheets.

The second priority is to establish written rules governing what AI can access, which actions it can perform independently and when human approval is required, with every action logged and a designated employee responsible for oversight.

The third is to train employees, move them away from personal accounts towards company accounts and select a single recurring process in which AI can be introduced and tested.

“Pick one process that repeats every week, put AI inside it, run it for four weeks with a clear yes or no at the end, and only then take the next one,” she said.

“That is the difference between experimenting and integrating.”

Parmakki argued that businesses did not need to begin with an extensive strategy document or bespoke software, but rather with sound preparation and a disciplined approach to implementation.

“None of it needs a strategy document or custom software. It needs the groundwork done properly, and the discipline to start small,” she said.

The event also presented Gartner’s expectation that 60 per cent of AI projects lacking AI-ready data would be abandoned, reinforcing the importance of preparing business information before introducing additional tools.

The broader message was that AI adoption should be treated as an operational change rather than simply a technology purchase, with the potential benefits depending on how well companies organise their work, protect their information and equip employees to use the technology effectively.

Cyprus has the potential to become a regional innovation hub, but turning that ambition into globally successful companies will require startups to look beyond the domestic market, stronger corporate partnerships and easier access to international customers and investors.

In an exclusive interview with the Cyprus Mail, director at Plug and Play Cyprus, Filippos Kyprianou, discussed how the global innovation platform is connecting Cypriot founders with more than 600 corporations across over 60 locations, while helping them develop the commercial skills needed to scale internationally.

He also examined the role of local corporate partners, the challenges facing startups and what success should look like over the next five years.

Plug and Play has a global network spanning more than 60 locations. What does bringing that network to Cyprus mean in practical terms for a startup based on the island, and what can founders access through Plug and Play that they could not easily access before?

In practical terms it means a founder in Limassol is one introduction away from a decision-maker at a bank in Frankfurt or a shipping company in Singapore. Plug and Play works with more than 600 corporations across 60-plus locations, and those are not logos on a wall. They are relationships where the corporate has a team, a budget and a mandate to work with startups. Until now a Cypriot founder who wanted that kind of conversation had to get on a plane and hope.

The second thing is people. Every week of the programme we bring in mentors from across the network: operators who have scaled companies, investors, people who have run innovation inside large corporations. They would not normally be in Cyprus on a Tuesday morning, and our founders get time with them, one to one, on whatever is actually broken that week.

The third is capital. Plug and Play’s venture arm is one of the most active early-stage investors in the world. It hasn’t invested in Cyprus yet but our investment team sees every company that comes through the programme, and we want the first Cypriot startup in the portfolio to be the first of many.

None of it costs the founder anything. We take no equity, and the programme is covered through the Research and Innovation Foundation’s voucher scheme. And we are not here only for the ten companies in a cohort. The centre is a front door for the whole ecosystem. If you are a founder in Cyprus and need to reach a corporate or an investor in our network, come and talk to us.

The Cyprus centre has been developed through cooperation between Plug and Play, the government, the Research and Innovation Foundation and corporate partners. How important is that collaboration to building a sustainable ecosystem, what does it look like in practice, and where is there room to improve?

I’d say the collaboration isn’t something that helps the ecosystem, it is the ecosystem. When people look at Silicon Valley they see the startups, but what they’re really looking at is a loop that has been turning for seventy years, where Stanford produces the talent and the research, the funds on Sand Hill Road put money behind it, the corporates buy from the startups and eventually buy the startups themselves, and all of it sits on decades of government research spending that nobody remembers paying for. Each part feeds the next, and if you took any one of them out you’d be left with a pleasant university town.

In practice, collaboration means each party puts something real on the table and is accountable for it, and you can see that happening across the island, not only in our programme. The government sets the direction and removes the obstacles, through the grants RIF puts into early-stage companies, the spin-off framework that lets researchers leave a university with their own work, and the visa schemes that bring talent in. The corporates are starting to treat startups as suppliers and partners rather than as a sponsorship line. The universities are beginning to see a company coming out of a lab as a success rather than a loss.

Local funds and programmes are backing companies at the stage before they reach us, and we bring the international network, the programme and twenty years of knowing how this is done. Our piece of it is funded by RIF and co-funded by our partners, the targets are public, and we sit down with RIF regularly to look at the numbers together, so anyone can see whether it’s working.

That’s what collaboration looks like when it’s real: everyone has something at stake and nobody can hide behind the others.

Plug and Play’s core business worldwide is helping large companies work with startups. What would you say to a Cypriot company that wants to do more of that?

Most of the Cypriot companies I speak to already want to do this. What they ask is where to start, and my answer is usually smaller than they expect, and with different people in the room than they expect.

The way we do it with corporates around the world – and we’ve been doing it for twenty years with more than six hundred of them – is to start from a problem the business actually has rather than from a general wish to innovate.

A bank might want to cut the time it takes to onboard a business customer from weeks to days. A ship manager might want better data coming off its vessels. We take that problem, go through the startups we know, which at this point is tens of thousands, and bring back the handful that have already solved something similar for someone else.

The company meets them, picks one or two, and runs a pilot with us helping on both sides. The difficult part is rarely the technology, it is getting a company of eight people through the legal and security process of a company of eight thousand, and getting the company of eight thousand to make a decision in weeks rather than quarters.

If the pilot works there is a contract, and sometimes the corporate invests as well. That is more or less how a navigation startup ended up in every new Mercedes vehicle.

Where it goes wrong is when it is treated as an event instead of as work. If the innovation team organises a demo day and the head of operations isn’t there, nothing comes of it no matter how good the startups are, and if a pilot starts without anyone having agreed what happens when it succeeds, it will finish without anyone deciding.

I have watched this happen in Germany and in Singapore, so it is not a Cypriot problem, but it is the main reason companies try once and give up.

So my advice to a Cypriot company would be to pick one problem that someone in the business is already losing sleep over, give that person a modest budget and the authority to run a pilot and let us find the startups. Do one properly and the second is much easier. None of it needs an innovation lab.

Plug and Play works with major corporations around the world. How do you see Cyprus-based corporates such as Tototheo Global, ASBIS, ECOMMBX and Mastercard contributing to the development of local startups beyond simply providing sponsorship or support for programmes?

The funding is the smallest part of what they do. Each of the four came into this for reasons of its own, and the longer I work with them the more I think that mix is one of the programme’s strengths.

What each of them brings is quite different. Tototheo Global started out in maritime technology and has grown well beyond it over the years, but what matters most for our founders is that it is a company that built itself in Cyprus and then scaled into international markets, which is exactly the road the startups in our cohort are about to go down.

ASBIS is headquartered here and operates in dozens of countries, so it offers the kind of reach into other markets that a Cypriot startup could never buy on its own, and it is also one of the few corporates on the island that already invests in technology companies, which gives it a very practical interest in what comes out of the programme..

ECOMMBX built its payments infrastructure in Limassol and sells it internationally, so it knows from its own experience what a regulator will ask and what a bank’s due diligence actually looks like, and that is knowledge a fintech founder would otherwise spend a couple of painful years acquiring.

Mastercard brings the view of a global network that sees where payments are going before almost anyone else.

Some of them are here because they want startups working on problems inside their own business, some because they want to invest, and some because they believe the island needs this and would rather be part of it than watch from the side. What they have in common is that they all committed before there was a cohort or a single result to show them, when it would have been very easy to wait a year and see how it went. In my experience that kind of early commitment is the hardest thing to get from corporates anywhere in the world, and here we had it from the first day.

The first Plug and Play Cyprus cohort includes ten startups operating in areas ranging from artificial intelligence and diagnostics to energy and digital platforms. What were you looking for when selecting the first cohort, and what have you learned from working with these companies so far?

We kept the first cohort open to every sector on purpose, because when you start somewhere new you don’t know where the talent is, and the quickest way to find out is to open the door and see who walks in. We spent time with the finalists and picked ten.

At this stage you are backing people rather than plans, since the plan will change several times before it works, so what I look at is what a team has managed to do with almost no money, whether they can explain what has changed in the world that makes this possible now, and whether they have a real reason for the decisions they’ve made on price, market and hiring or are telling themselves a story. I also pay attention to what has moved between our first conversation and the second, because two weeks is usually enough to tell.

What has struck me so far is that the technical quality here is better than people outside Cyprus assume, and we have companies in diagnostics, energy and AI that I would put in any cohort in our network. Where they need us is on the commercial side, pricing for a market bigger than Cyprus, building a sales process that doesn’t stop when the founder is on a plane, and turning a pilot into a contract, which is what the three months are for.

Cyprus has a growing technology community, but the domestic market is small. How important is internationalisation from the very beginning, and beyond funding, what are the biggest obstacles facing startups in Cyprus today?

It matters from before day one, from the moment you decide what to build. The question I ask every founder is: where do you want to be in five years? If the answer is Europe, build for Europe now. Price for it, hire for it, design for it and use Cyprus to test. You’ll hear me say this a lot. You’re not building a company for Cyprus. You’re building a company from Cyprus to serve global markets.

Estonia has about the same population as Cyprus and has produced around ten unicorns. It did that because nobody there could hide in a home market. A small market is only a problem if you let it set your ambition.

Beyond funding, the obstacles I see are distribution and ambition, in that order, and capital a long way behind. There’s more money looking at Cyprus than ever. What’s hard is the first international customer, the first salesperson who can close without the founder in the room, and being willing to fail in public. That last one matters more than people think. We have a culture, and it’s southern European more than Cypriot, where failure is something you hide. In Silicon Valley a founder who has failed once is easier to fund, not harder, because they learned something expensive and someone else paid for it. Part of what we’re here to do is bring that attitude with us.

Plug and Play has described Cyprus as having the potential to become an innovation hub in the Eastern Mediterranean. What would need to happen over the next five to ten years for that to translate into globally successful companies built from Cyprus, and how does Cyprus fit into the wider ecosystem?

The honest answer is that it needs a few Cypriot companies to make it internationally, because that is what sets everything else in motion. Once that happens, the people who built those companies go on to start new ones and invest in others, international investors begin to look at Cyprus seriously, and the next generation of founders can see that it is possible. Estonia is the clearest example: one exit, Skype, produced the founders and the capital behind most of the country’s startup scene today.

For that to happen here, a few things need to continue improving over the next five to ten years. Founders need to build for international markets from day one rather than for the island. Local corporates need to work with startups as a normal part of doing business, since a startup’s first serious customer is usually a local one. It must become easier to raise capital while keeping the company and the team in Cyprus, rather than relocating to raise. The island needs more experienced operators, people who have scaled companies before, which is what the government’s talent and visa schemes are designed to address. And universities need to see a company emerging from research as a success rather than a loss. None of this is new, and most of it is already moving. The next decade is about whether it compounds.

As for the region, Cyprus sits inside the EU, in a time zone that overlaps with Europe, the Middle East and India, and in a country small enough that you can reach anyone within a week, which makes it a natural meeting point. Reflect Festival already brings founders and investors from across the region to Limassol every May, and by bringing our network into it we want a founder from Athens or Dubai to be able to meet our corporates and our investors here, rather than having to fly to San Francisco to find them.

Looking beyond the first cohort and the November innovation Expo, what should success look like for Plug and Play Cyprus in three to five years, and what would convince you that the programme has made a lasting contribution to Cyprus’ startup ecosystem?

We have targets and we will be measured on them, and we take that seriously, but the targets describe the programme, not the ambition. What we want is for Cyprus to be a place where founders believe they can build something that matters and stay here while they do it, and we think that belief is the thing that is still missing. The talent is here and the money is coming. What hasn’t fully happened yet is the moment a few founders prove it can be done from here and everyone else stops asking whether it can.

In three to five years we would like to be able to point to Cypriot companies with customers in ten countries, with investors who came here to find them, with the first employees of those companies starting companies of their own. I would like a corporate in Limassol to have worked with enough startups that it does so without thinking, and a researcher at one of our universities to see starting a company as the obvious thing to do with a result, not a brave one. And we would like founders from abroad to consider Cyprus a serious place to build, not an unusual one.

The Expo on November 11 is the first time we put all of that in one room, our startups, our partners and investors from across the network, and I’m excited to see what comes out of it. As for what would convince me the contribution has lasted, it’s when the things we’ve described start happening on their own as well as through us, when the introductions we made in the first years have become relationships that no longer need us in the middle, and when Plug and Play has gone from being the reason a founder gets a meeting to being one of several good reasons to build a company from here. We’re in Cyprus for the long term.

Website: https://www.plugandplaytechcenter.com

Cyprus already has a relatively demanding framework for reporting cyber incidents, with a 6-hour early warning deadline and a fuller notification requirement within 72 hours, but the country must ensure its institutions can respond effectively as artificial intelligence accelerates cyber threats, according to a new report by the Digital Cooperation Organisation (DCO).

The findings appear in the organisation’s September 2026 edition of DCO Policy Watch, titled ‘Resilience at Machine Speed: National Cyber Defense in the Age of AI‘, which examines how governments can strengthen their defences against increasingly automated attacks and prepare for the eventual transition to quantum-resistant cryptography.

The report places Cyprus among jurisdictions with a defined incident-reporting interval in force, noting that its Article 35B requirements establish a tighter initial reporting timeframe than the default under the European Union’s NIS2 Directive.

However, it cautions that having a deadline does not automatically mean a country can respond effectively, with the resources, staffing and operational capabilities behind the rules ultimately determining their value.

For Cyprus, the broader lesson is that existing reporting requirements should form part of a comprehensive national strategy that connects early warnings to effective incident response, investment in defensive artificial intelligence and preparation for future cryptographic risks.

The report argues that cyber resilience is not simply a level of protection a government purchases, but the ability to detect an intrusion, contain it, maintain essential services and recover afterwards.

That capacity must be built, staffed and tested before an attack occurs.

The urgency is increasing. CrowdStrike’s observations of financially motivated cybercrime in 2025 found that the average time taken by an intruder to move from an initially compromised machine to a second machine had fallen to 29 minutes, while the fastest observed case took just 27 seconds.

In July 2026, autonomous AI agents operated by OpenAI conducted a four-and-a-half-day campaign that included an intrusion into the production infrastructure of Hugging Face, the largest public repository of open-source AI models.

The agents were given objectives, tools and permission to act across multiple steps without a person directing each individual action, illustrating how attacks can unfold with little or no immediate human intervention.

The report warns that the time available for people to make decisions during an incident is shrinking, making advance preparation increasingly important.

The financial consequences of inadequate preparation are illustrated by Costa Rica, where a ransomware campaign in 2022 prompted a response across 10 institutions that the country’s Comptroller General assessed at roughly 14 times the institutions’ combined cybersecurity spending in the preceding year.

Costa Rica had a national strategy, a designated ministry, a response team and an audit that had identified the ministry that subsequently failed.

What it lacked, according to the report, was sufficient funding, an operational plan and an enforceable reporting obligation.

The DCO identifies three pillars of national cyber resilience that governments, including Cyprus, should prioritise.

The first is establishing the institutional foundations needed to respond to incidents, including a published national strategy, a designated authority, clear reporting requirements and deadlines, and a trained workforce.

The report says these components are complementary rather than interchangeable, warning that a reporting duty has limited value if the receiving team lacks the capacity to act.

Although incident-reporting obligations exist across almost all DCO member states, measurable deadlines are less consistently established.

It recommends that governments attach clearly defined reporting intervals to existing legal obligations, taking account of the severity of incidents and the information reasonably available, while ensuring the receiving institutions have the resources to respond.

Ghana provides one example, requiring incidents to be reported to the relevant sectoral or national team within 24 hours of detection.

The second pillar concerns artificial intelligence and the changing balance between attackers and defenders.

The report distinguishes between human attackers using AI to discover vulnerabilities more quickly, autonomous AI agents acting without continuous human direction, and defensive applications of AI that help security teams identify weaknesses, assess incidents and test systems.

It says public evidence is not yet sufficient to establish whether AI overall favours attackers or defenders, but stresses that offensive tools are becoming more accessible.

A campaign against government systems reported in August 2026 was assembled using open-source agent frameworks, illustrating that sophisticated capabilities are not necessarily restricted to the companies developing the most advanced AI models.

The report therefore recommends stronger basic security controls, greater use of AI for defensive purposes and coordinated governance of advanced AI systems.

It also urges governments to record the degree of automation involved in cyber incidents, rather than relying exclusively on classifications of attack techniques.

Such reporting should allow an incident to be marked as “unknown” when the available evidence cannot establish whether actions were automated or directed by a person.

Singapore’s June 2026 guidance on securing agentic AI provides an example of how governments can identify vulnerabilities in automated workflows and apply appropriate safeguards.

For Cyprus, the findings point to the importance of ensuring that existing cyber security procedures account for attacks involving autonomous systems, while testing whether defensive AI tools can perform useful work under real incident conditions.

The report notes that, during the July 2026 Hugging Face incident, commercial AI models initially used by responders refused much of the forensic work because their safeguards could not distinguish between someone investigating an attack and someone conducting one.

An open-weight model running on the platform’s own hardware subsequently helped responders decode staged payloads, demonstrating the value of testing alternative tools before an emergency arises.

The third pillar is preparing for quantum computing, which could eventually undermine some of the public-key cryptographic systems currently used to protect data and authenticate communications.

The report warns of the “harvest now, decrypt later” risk, in which attackers collect encrypted information today in the expectation that future computing capabilities will allow them to decipher it.

Because replacing vulnerable cryptography across government systems can take years, preparation should begin before quantum computers capable of breaking existing protections become available.

The first step is to establish an inventory of the cryptographic algorithms used to protect information in transit and at rest, as well as those used to verify identities.

The report says this can begin without specialised quantum expertise or new procurement.

It recommends introducing inventory requirements through existing regulatory instruments, updating national cryptographic standards to include quantum-resistant algorithms and amending rules governing public key infrastructure, including electronic signatures and trust services.

Governments should then develop funded migration plans that identify responsible institutions, prioritise systems according to risk and establish testing and completion milestones.

The United States has estimated that migrating prioritised federal systems, excluding national security systems, will cost €6.25 billion ($7.10 billion), illustrating the scale of the investment involved.

The report also highlights how long cryptographic transitions can take, citing 22 years between the publication of the Advanced Encryption Standard and the National Institute of Standards and Technology’s cutoff for applying new protection with Triple DES, and 25 years between the first theoretical attack on SHA-1 and its planned retirement in 2030.

The DCO’s proposed roadmap divides action into three stages, beginning with foundational measures that allow governments to understand their own systems, progressing to operational capabilities, and culminating in advanced capabilities that member states can develop more effectively through cooperation.

Alongside reporting deadlines and cryptographic inventories, it recommends identifying essential services that should receive priority protection, ensuring cyber response teams are staffed around the clock and testing defensive AI tools before they are needed.

The report concludes that much of the initial work involves improving existing laws, procedures and administrative systems rather than developing new technology.

However, sustained funding is still required to maintain specialist teams, train and retain staff and complete cryptographic migration.

For Cyprus, the priority is to build on its existing reporting framework by ensuring that warnings lead to effective action, while starting the long-term work of mapping and upgrading vulnerable cryptographic systems.

The report argues that governments can make substantial progress using authorities and resources they already possess, while regional cooperation can help share the cost of capabilities that would be difficult for individual countries to maintain.

Its central message is that the time available for institutional preparation remains, even as the time available to intervene during an attack continues to shrink.