The TechIsland TechPro Community will hold its fourth meetup on November 3, 2026 in Limassol, bringing together professionals working at the core of Cyprus’ technology sector for an evening of discussion, knowledge exchange and networking.

The community was created by TechIsland, the largest technology association on the island, as a dedicated platform for CTOs, CIOs, CISOs, technology architects, software developers, DevOps and platform engineers, data and AI specialists, cybersecurity professionals, UX experts and digital transformation leaders.

Its purpose is to give these professionals a space to meet peers outside their own organisations, exchange practical experience, discuss the challenges they are facing and build stronger connections across Cyprus’ technology ecosystem.

Following three meetups earlier this year, the community will come together with a programme combining a focused panel discussion with informal networking over drinks and bites.

At the centre of the evening will be the panel ‘Inside the Vault: Building Secure Systems for Digital Assets & Data’.

The discussion will take a practical look at how organisations protect what matters most, from customer data and production databases to API credentials, encryption keys, sensitive information and digital assets, while still enabling teams to move fast and keeping systems manageable in practice.

Joining the panel will be Anastasiia Sanina, Head of B2B Partnerships at The Vault, Denis Rybin, Director of Information Security at inDrive, Ingrid Camilleri, Chief Digital Officer at Cablenet, and Igor Bulatenko, Head of Information Security at Exness.

The conversation will be led by Andreas Neocleous, Chief Consulting Officer at PwC Cyprus, who will bring the speakers’ different perspectives together and guide the discussion around the practical decisions technology and security teams face.

The 4th TechIsland TechPro Community Meetup, powered by The Vault, will take place from 19.00 to 21.00.

Attendance is free of charge, including drinks and bites, but registration is required.

Those interested can register here.

Cypriot businesses need to organise their data, establish clear rules and train employees before adopting artificial intelligence (AI), according to Kyriaki Parmakki, co-founder and chief executive of Limassol-based solutions studio essere.ai, who hosted the first ClickUp event in Cyprus earlier this month.

The event, held on October 8, brought together business owners, directors and technology specialists to explore how companies can integrate AI into their operations, with demonstrations of practical applications and discussions on the foundations needed to make the technology effective.

ClickUp, an American software company valued at $4 billion and known for its project management, task management and AI capabilities, held its first event on the island in partnership with essere.ai, which is ClickUp’s official and certified partner in Cyprus and the only partner it works with directly on the island.

In an interview with the Cyprus Mail, Parmakki said that the event highlighted a growing gap between individuals’ willingness to use AI and the extent to which businesses have integrated it into their operations.

“In 2025, 44 per cent of people in Cyprus used generative AI, against an EU average of 33 per cent, while only 9 per cent of Cypriot companies used AI, less than half the EU rate of 20 per cent,” she said.

“People in Cyprus are ahead of their companies.”

She added that the event’s attendance and the questions raised by participants suggested that businesses were increasingly interested in practical implementation rather than simply debating whether to adopt the technology.

“Appetite is not the problem. The room was full on a Thursday evening, with owners and directors, and the questions were about how, not whether,” Parmakki said.

“ClickUp choosing Cyprus for its first event here means international platforms now see this market too.”

The event featured a presentation by ClickUp guest speaker Mary Bornaghi, who outlined the platform’s approach to bringing work management and AI together, while Parmakki presented the fundamentals businesses need before introducing AI.

Neophytos Polydorou, senior AI engineer at essere.ai, demonstrated 5 live use cases using real systems and demonstration data, while representatives of 2 companies discussed how moving their work into ClickUp had changed their operations.

The evening concluded with an AI-readiness assessment that participants could complete on their phones, followed by networking.

A central theme was that businesses should focus on their operational foundations before investing in AI tools, with Parmakki arguing that the technology’s effectiveness depends on the quality and accessibility of the information it can use.

“Everything a company does is data. A call, an invoice, a message, an approval. AI can only work with what it can read, so the first question is never which tool, it is where the data lives,” she said.

She described 4 stages of business development according to how information is managed, ranging from data held in employees’ heads to information stored in separate files, then organised in systems, and finally supported by AI intelligence.

“Moving up one step always means the same thing, organising the data, and only then does AI have something reliable to work with,” Parmakki said.

Skipping this groundwork can result in AI producing generic responses or confidently delivering incorrect information, while employees may turn to personal AI accounts to handle company information because their employers have not provided suitable systems.

Businesses may also struggle to translate individual productivity gains into measurable commercial results.

Parmakki cited McKinsey research involving 1,700 executives, saying 80 per cent reported that AI made them personally more productive, while only 37 per cent of companies saw the benefits reflected in their results.

“The gap between those two numbers is the foundations,” she said.

The event also examined the growing use of AI by employees, including the security implications when individuals adopt tools without company oversight.

According to figures presented during the event, the proportion of employees regularly using AI on their work computers had increased from 15 per cent to 45 per cent in 1 year, while 2 thirds of those users signed in through personal rather than company accounts.

“The question is not whether your people use AI. It is whether the company knows,” the event’s presentation stated.

Parmakki said the most immediate returns tended to come from processes involving large volumes of unstructured information, including telephone calls, emails, invoices and documents.

Examples included answering calls in the caller’s language, recording the details and making bookings while other employees continued their work, as well as reading, checking and filing supplier invoices without requiring someone to open each email.

Other applications could prepare short morning briefings identifying tasks at risk of missing deadlines and suggesting how work could be reassigned.

“These are not pilots. Each one removes a chore that repeats every week, and a person can check the result in seconds,” she said.

However, she stressed that businesses must establish clear boundaries for AI agents before allowing them to operate.

“Before an agent goes live we write three things down, what it may read, what it may do on its own, and where a person decides,” Parmakki continued.

“Draft yes, send no. Suggest yes, pay no. No decisions about people or payments without a person.”

She added that every action should be logged and the records reviewed weekly, allowing companies to monitor whether AI systems are operating within their permitted limits.

The live demonstrations illustrated how these principles could work in practice, including a support call recognised and handled by an AI agent called Ciao, which helped the caller and made a booking.

Another demonstration showed an 8am briefing identifying a task at risk and proposing that it be reassigned, while an AI agent prepared month-end billing for approval by a person.

Other examples included filing a supplier invoice without anyone having to read the inbox and conducting a weekly security review in which an agent checked every action against established rules, including access it had been denied.

The event also addressed the distinction between developing bespoke software and configuring existing platforms, with the presentation arguing that although building software has become more accessible, maintaining it still involves logins, permissions, mobile applications, backups, security, updates and support.

The departure of the person who originally built a system can also create difficulties for the business.

The recommendation was to build technology where it creates a genuine competitive advantage and configure existing tools for other requirements.

Regulatory compliance was another key theme, particularly the European Union’s AI Act and the responsibilities it places on businesses.

“The EU AI Act already asks two things of every company, train your people on AI, and tell customers when they are talking to a machine,” Parmakki said.

The event presentation stressed that businesses should provide AI training and retain evidence of that training, while making clear to people when they are interacting with AI.

It also highlighted the heavier requirements for AI systems making decisions about people and money, which Parmakki said were due to arrive in December 2027.

Beyond regulation, she argued that a lack of expertise and uncertainty about legal requirements and data protection were more significant obstacles to adoption than the price of the technology.

“The gap is not technology, and it is not money. It is knowledge, and fear,” she said.

“Most companies do not know where to start and do not know where this is going, so they wait.”

She referred to Eurostat findings on businesses that had considered AI but decided against adopting it, saying the most frequently cited reason in Cyprus and across the EU was a lack of relevant expertise, followed by legal uncertainty and data protection concerns, while cost ranked considerably lower.

Parmakki said essere.ai aimed to bridge that gap through education before technology, helping business owners understand what AI could do within their own operations, where it was appropriate and what needed to be in place first.

For companies seeking to move beyond experimentation, she identified 3 priorities, beginning with establishing a reliable operational system that the business owns.

This should provide a single source of information for clients, tasks, documents and figures, rather than relying on employees’ memories, inboxes and spreadsheets.

The second priority is to establish written rules governing what AI can access, which actions it can perform independently and when human approval is required, with every action logged and a designated employee responsible for oversight.

The third is to train employees, move them away from personal accounts towards company accounts and select a single recurring process in which AI can be introduced and tested.

“Pick one process that repeats every week, put AI inside it, run it for four weeks with a clear yes or no at the end, and only then take the next one,” she said.

“That is the difference between experimenting and integrating.”

Parmakki argued that businesses did not need to begin with an extensive strategy document or bespoke software, but rather with sound preparation and a disciplined approach to implementation.

“None of it needs a strategy document or custom software. It needs the groundwork done properly, and the discipline to start small,” she said.

The event also presented Gartner’s expectation that 60 per cent of AI projects lacking AI-ready data would be abandoned, reinforcing the importance of preparing business information before introducing additional tools.

The broader message was that AI adoption should be treated as an operational change rather than simply a technology purchase, with the potential benefits depending on how well companies organise their work, protect their information and equip employees to use the technology effectively.

Cyprus has the potential to become a regional innovation hub, but turning that ambition into globally successful companies will require startups to look beyond the domestic market, stronger corporate partnerships and easier access to international customers and investors.

In an exclusive interview with the Cyprus Mail, director at Plug and Play Cyprus, Filippos Kyprianou, discussed how the global innovation platform is connecting Cypriot founders with more than 600 corporations across over 60 locations, while helping them develop the commercial skills needed to scale internationally.

He also examined the role of local corporate partners, the challenges facing startups and what success should look like over the next five years.

Plug and Play has a global network spanning more than 60 locations. What does bringing that network to Cyprus mean in practical terms for a startup based on the island, and what can founders access through Plug and Play that they could not easily access before?

In practical terms it means a founder in Limassol is one introduction away from a decision-maker at a bank in Frankfurt or a shipping company in Singapore. Plug and Play works with more than 600 corporations across 60-plus locations, and those are not logos on a wall. They are relationships where the corporate has a team, a budget and a mandate to work with startups. Until now a Cypriot founder who wanted that kind of conversation had to get on a plane and hope.

The second thing is people. Every week of the programme we bring in mentors from across the network: operators who have scaled companies, investors, people who have run innovation inside large corporations. They would not normally be in Cyprus on a Tuesday morning, and our founders get time with them, one to one, on whatever is actually broken that week.

The third is capital. Plug and Play’s venture arm is one of the most active early-stage investors in the world. It hasn’t invested in Cyprus yet but our investment team sees every company that comes through the programme, and we want the first Cypriot startup in the portfolio to be the first of many.

None of it costs the founder anything. We take no equity, and the programme is covered through the Research and Innovation Foundation’s voucher scheme. And we are not here only for the ten companies in a cohort. The centre is a front door for the whole ecosystem. If you are a founder in Cyprus and need to reach a corporate or an investor in our network, come and talk to us.

The Cyprus centre has been developed through cooperation between Plug and Play, the government, the Research and Innovation Foundation and corporate partners. How important is that collaboration to building a sustainable ecosystem, what does it look like in practice, and where is there room to improve?

I’d say the collaboration isn’t something that helps the ecosystem, it is the ecosystem. When people look at Silicon Valley they see the startups, but what they’re really looking at is a loop that has been turning for seventy years, where Stanford produces the talent and the research, the funds on Sand Hill Road put money behind it, the corporates buy from the startups and eventually buy the startups themselves, and all of it sits on decades of government research spending that nobody remembers paying for. Each part feeds the next, and if you took any one of them out you’d be left with a pleasant university town.

In practice, collaboration means each party puts something real on the table and is accountable for it, and you can see that happening across the island, not only in our programme. The government sets the direction and removes the obstacles, through the grants RIF puts into early-stage companies, the spin-off framework that lets researchers leave a university with their own work, and the visa schemes that bring talent in. The corporates are starting to treat startups as suppliers and partners rather than as a sponsorship line. The universities are beginning to see a company coming out of a lab as a success rather than a loss.

Local funds and programmes are backing companies at the stage before they reach us, and we bring the international network, the programme and twenty years of knowing how this is done. Our piece of it is funded by RIF and co-funded by our partners, the targets are public, and we sit down with RIF regularly to look at the numbers together, so anyone can see whether it’s working.

That’s what collaboration looks like when it’s real: everyone has something at stake and nobody can hide behind the others.

Plug and Play’s core business worldwide is helping large companies work with startups. What would you say to a Cypriot company that wants to do more of that?

Most of the Cypriot companies I speak to already want to do this. What they ask is where to start, and my answer is usually smaller than they expect, and with different people in the room than they expect.

The way we do it with corporates around the world – and we’ve been doing it for twenty years with more than six hundred of them – is to start from a problem the business actually has rather than from a general wish to innovate.

A bank might want to cut the time it takes to onboard a business customer from weeks to days. A ship manager might want better data coming off its vessels. We take that problem, go through the startups we know, which at this point is tens of thousands, and bring back the handful that have already solved something similar for someone else.

The company meets them, picks one or two, and runs a pilot with us helping on both sides. The difficult part is rarely the technology, it is getting a company of eight people through the legal and security process of a company of eight thousand, and getting the company of eight thousand to make a decision in weeks rather than quarters.

If the pilot works there is a contract, and sometimes the corporate invests as well. That is more or less how a navigation startup ended up in every new Mercedes vehicle.

Where it goes wrong is when it is treated as an event instead of as work. If the innovation team organises a demo day and the head of operations isn’t there, nothing comes of it no matter how good the startups are, and if a pilot starts without anyone having agreed what happens when it succeeds, it will finish without anyone deciding.

I have watched this happen in Germany and in Singapore, so it is not a Cypriot problem, but it is the main reason companies try once and give up.

So my advice to a Cypriot company would be to pick one problem that someone in the business is already losing sleep over, give that person a modest budget and the authority to run a pilot and let us find the startups. Do one properly and the second is much easier. None of it needs an innovation lab.

Plug and Play works with major corporations around the world. How do you see Cyprus-based corporates such as Tototheo Global, ASBIS, ECOMMBX and Mastercard contributing to the development of local startups beyond simply providing sponsorship or support for programmes?

The funding is the smallest part of what they do. Each of the four came into this for reasons of its own, and the longer I work with them the more I think that mix is one of the programme’s strengths.

What each of them brings is quite different. Tototheo Global started out in maritime technology and has grown well beyond it over the years, but what matters most for our founders is that it is a company that built itself in Cyprus and then scaled into international markets, which is exactly the road the startups in our cohort are about to go down.

ASBIS is headquartered here and operates in dozens of countries, so it offers the kind of reach into other markets that a Cypriot startup could never buy on its own, and it is also one of the few corporates on the island that already invests in technology companies, which gives it a very practical interest in what comes out of the programme..

ECOMMBX built its payments infrastructure in Limassol and sells it internationally, so it knows from its own experience what a regulator will ask and what a bank’s due diligence actually looks like, and that is knowledge a fintech founder would otherwise spend a couple of painful years acquiring.

Mastercard brings the view of a global network that sees where payments are going before almost anyone else.

Some of them are here because they want startups working on problems inside their own business, some because they want to invest, and some because they believe the island needs this and would rather be part of it than watch from the side. What they have in common is that they all committed before there was a cohort or a single result to show them, when it would have been very easy to wait a year and see how it went. In my experience that kind of early commitment is the hardest thing to get from corporates anywhere in the world, and here we had it from the first day.

The first Plug and Play Cyprus cohort includes ten startups operating in areas ranging from artificial intelligence and diagnostics to energy and digital platforms. What were you looking for when selecting the first cohort, and what have you learned from working with these companies so far?

We kept the first cohort open to every sector on purpose, because when you start somewhere new you don’t know where the talent is, and the quickest way to find out is to open the door and see who walks in. We spent time with the finalists and picked ten.

At this stage you are backing people rather than plans, since the plan will change several times before it works, so what I look at is what a team has managed to do with almost no money, whether they can explain what has changed in the world that makes this possible now, and whether they have a real reason for the decisions they’ve made on price, market and hiring or are telling themselves a story. I also pay attention to what has moved between our first conversation and the second, because two weeks is usually enough to tell.

What has struck me so far is that the technical quality here is better than people outside Cyprus assume, and we have companies in diagnostics, energy and AI that I would put in any cohort in our network. Where they need us is on the commercial side, pricing for a market bigger than Cyprus, building a sales process that doesn’t stop when the founder is on a plane, and turning a pilot into a contract, which is what the three months are for.

Cyprus has a growing technology community, but the domestic market is small. How important is internationalisation from the very beginning, and beyond funding, what are the biggest obstacles facing startups in Cyprus today?

It matters from before day one, from the moment you decide what to build. The question I ask every founder is: where do you want to be in five years? If the answer is Europe, build for Europe now. Price for it, hire for it, design for it and use Cyprus to test. You’ll hear me say this a lot. You’re not building a company for Cyprus. You’re building a company from Cyprus to serve global markets.

Estonia has about the same population as Cyprus and has produced around ten unicorns. It did that because nobody there could hide in a home market. A small market is only a problem if you let it set your ambition.

Beyond funding, the obstacles I see are distribution and ambition, in that order, and capital a long way behind. There’s more money looking at Cyprus than ever. What’s hard is the first international customer, the first salesperson who can close without the founder in the room, and being willing to fail in public. That last one matters more than people think. We have a culture, and it’s southern European more than Cypriot, where failure is something you hide. In Silicon Valley a founder who has failed once is easier to fund, not harder, because they learned something expensive and someone else paid for it. Part of what we’re here to do is bring that attitude with us.

Plug and Play has described Cyprus as having the potential to become an innovation hub in the Eastern Mediterranean. What would need to happen over the next five to ten years for that to translate into globally successful companies built from Cyprus, and how does Cyprus fit into the wider ecosystem?

The honest answer is that it needs a few Cypriot companies to make it internationally, because that is what sets everything else in motion. Once that happens, the people who built those companies go on to start new ones and invest in others, international investors begin to look at Cyprus seriously, and the next generation of founders can see that it is possible. Estonia is the clearest example: one exit, Skype, produced the founders and the capital behind most of the country’s startup scene today.

For that to happen here, a few things need to continue improving over the next five to ten years. Founders need to build for international markets from day one rather than for the island. Local corporates need to work with startups as a normal part of doing business, since a startup’s first serious customer is usually a local one. It must become easier to raise capital while keeping the company and the team in Cyprus, rather than relocating to raise. The island needs more experienced operators, people who have scaled companies before, which is what the government’s talent and visa schemes are designed to address. And universities need to see a company emerging from research as a success rather than a loss. None of this is new, and most of it is already moving. The next decade is about whether it compounds.

As for the region, Cyprus sits inside the EU, in a time zone that overlaps with Europe, the Middle East and India, and in a country small enough that you can reach anyone within a week, which makes it a natural meeting point. Reflect Festival already brings founders and investors from across the region to Limassol every May, and by bringing our network into it we want a founder from Athens or Dubai to be able to meet our corporates and our investors here, rather than having to fly to San Francisco to find them.

Looking beyond the first cohort and the November innovation Expo, what should success look like for Plug and Play Cyprus in three to five years, and what would convince you that the programme has made a lasting contribution to Cyprus’ startup ecosystem?

We have targets and we will be measured on them, and we take that seriously, but the targets describe the programme, not the ambition. What we want is for Cyprus to be a place where founders believe they can build something that matters and stay here while they do it, and we think that belief is the thing that is still missing. The talent is here and the money is coming. What hasn’t fully happened yet is the moment a few founders prove it can be done from here and everyone else stops asking whether it can.

In three to five years we would like to be able to point to Cypriot companies with customers in ten countries, with investors who came here to find them, with the first employees of those companies starting companies of their own. I would like a corporate in Limassol to have worked with enough startups that it does so without thinking, and a researcher at one of our universities to see starting a company as the obvious thing to do with a result, not a brave one. And we would like founders from abroad to consider Cyprus a serious place to build, not an unusual one.

The Expo on November 11 is the first time we put all of that in one room, our startups, our partners and investors from across the network, and I’m excited to see what comes out of it. As for what would convince me the contribution has lasted, it’s when the things we’ve described start happening on their own as well as through us, when the introductions we made in the first years have become relationships that no longer need us in the middle, and when Plug and Play has gone from being the reason a founder gets a meeting to being one of several good reasons to build a company from here. We’re in Cyprus for the long term.

Website: https://www.plugandplaytechcenter.com

Cyprus already has a relatively demanding framework for reporting cyber incidents, with a 6-hour early warning deadline and a fuller notification requirement within 72 hours, but the country must ensure its institutions can respond effectively as artificial intelligence accelerates cyber threats, according to a new report by the Digital Cooperation Organisation (DCO).

The findings appear in the organisation’s September 2026 edition of DCO Policy Watch, titled ‘Resilience at Machine Speed: National Cyber Defense in the Age of AI‘, which examines how governments can strengthen their defences against increasingly automated attacks and prepare for the eventual transition to quantum-resistant cryptography.

The report places Cyprus among jurisdictions with a defined incident-reporting interval in force, noting that its Article 35B requirements establish a tighter initial reporting timeframe than the default under the European Union’s NIS2 Directive.

However, it cautions that having a deadline does not automatically mean a country can respond effectively, with the resources, staffing and operational capabilities behind the rules ultimately determining their value.

For Cyprus, the broader lesson is that existing reporting requirements should form part of a comprehensive national strategy that connects early warnings to effective incident response, investment in defensive artificial intelligence and preparation for future cryptographic risks.

The report argues that cyber resilience is not simply a level of protection a government purchases, but the ability to detect an intrusion, contain it, maintain essential services and recover afterwards.

That capacity must be built, staffed and tested before an attack occurs.

The urgency is increasing. CrowdStrike’s observations of financially motivated cybercrime in 2025 found that the average time taken by an intruder to move from an initially compromised machine to a second machine had fallen to 29 minutes, while the fastest observed case took just 27 seconds.

In July 2026, autonomous AI agents operated by OpenAI conducted a four-and-a-half-day campaign that included an intrusion into the production infrastructure of Hugging Face, the largest public repository of open-source AI models.

The agents were given objectives, tools and permission to act across multiple steps without a person directing each individual action, illustrating how attacks can unfold with little or no immediate human intervention.

The report warns that the time available for people to make decisions during an incident is shrinking, making advance preparation increasingly important.

The financial consequences of inadequate preparation are illustrated by Costa Rica, where a ransomware campaign in 2022 prompted a response across 10 institutions that the country’s Comptroller General assessed at roughly 14 times the institutions’ combined cybersecurity spending in the preceding year.

Costa Rica had a national strategy, a designated ministry, a response team and an audit that had identified the ministry that subsequently failed.

What it lacked, according to the report, was sufficient funding, an operational plan and an enforceable reporting obligation.

The DCO identifies three pillars of national cyber resilience that governments, including Cyprus, should prioritise.

The first is establishing the institutional foundations needed to respond to incidents, including a published national strategy, a designated authority, clear reporting requirements and deadlines, and a trained workforce.

The report says these components are complementary rather than interchangeable, warning that a reporting duty has limited value if the receiving team lacks the capacity to act.

Although incident-reporting obligations exist across almost all DCO member states, measurable deadlines are less consistently established.

It recommends that governments attach clearly defined reporting intervals to existing legal obligations, taking account of the severity of incidents and the information reasonably available, while ensuring the receiving institutions have the resources to respond.

Ghana provides one example, requiring incidents to be reported to the relevant sectoral or national team within 24 hours of detection.

The second pillar concerns artificial intelligence and the changing balance between attackers and defenders.

The report distinguishes between human attackers using AI to discover vulnerabilities more quickly, autonomous AI agents acting without continuous human direction, and defensive applications of AI that help security teams identify weaknesses, assess incidents and test systems.

It says public evidence is not yet sufficient to establish whether AI overall favours attackers or defenders, but stresses that offensive tools are becoming more accessible.

A campaign against government systems reported in August 2026 was assembled using open-source agent frameworks, illustrating that sophisticated capabilities are not necessarily restricted to the companies developing the most advanced AI models.

The report therefore recommends stronger basic security controls, greater use of AI for defensive purposes and coordinated governance of advanced AI systems.

It also urges governments to record the degree of automation involved in cyber incidents, rather than relying exclusively on classifications of attack techniques.

Such reporting should allow an incident to be marked as “unknown” when the available evidence cannot establish whether actions were automated or directed by a person.

Singapore’s June 2026 guidance on securing agentic AI provides an example of how governments can identify vulnerabilities in automated workflows and apply appropriate safeguards.

For Cyprus, the findings point to the importance of ensuring that existing cyber security procedures account for attacks involving autonomous systems, while testing whether defensive AI tools can perform useful work under real incident conditions.

The report notes that, during the July 2026 Hugging Face incident, commercial AI models initially used by responders refused much of the forensic work because their safeguards could not distinguish between someone investigating an attack and someone conducting one.

An open-weight model running on the platform’s own hardware subsequently helped responders decode staged payloads, demonstrating the value of testing alternative tools before an emergency arises.

The third pillar is preparing for quantum computing, which could eventually undermine some of the public-key cryptographic systems currently used to protect data and authenticate communications.

The report warns of the “harvest now, decrypt later” risk, in which attackers collect encrypted information today in the expectation that future computing capabilities will allow them to decipher it.

Because replacing vulnerable cryptography across government systems can take years, preparation should begin before quantum computers capable of breaking existing protections become available.

The first step is to establish an inventory of the cryptographic algorithms used to protect information in transit and at rest, as well as those used to verify identities.

The report says this can begin without specialised quantum expertise or new procurement.

It recommends introducing inventory requirements through existing regulatory instruments, updating national cryptographic standards to include quantum-resistant algorithms and amending rules governing public key infrastructure, including electronic signatures and trust services.

Governments should then develop funded migration plans that identify responsible institutions, prioritise systems according to risk and establish testing and completion milestones.

The United States has estimated that migrating prioritised federal systems, excluding national security systems, will cost €6.25 billion ($7.10 billion), illustrating the scale of the investment involved.

The report also highlights how long cryptographic transitions can take, citing 22 years between the publication of the Advanced Encryption Standard and the National Institute of Standards and Technology’s cutoff for applying new protection with Triple DES, and 25 years between the first theoretical attack on SHA-1 and its planned retirement in 2030.

The DCO’s proposed roadmap divides action into three stages, beginning with foundational measures that allow governments to understand their own systems, progressing to operational capabilities, and culminating in advanced capabilities that member states can develop more effectively through cooperation.

Alongside reporting deadlines and cryptographic inventories, it recommends identifying essential services that should receive priority protection, ensuring cyber response teams are staffed around the clock and testing defensive AI tools before they are needed.

The report concludes that much of the initial work involves improving existing laws, procedures and administrative systems rather than developing new technology.

However, sustained funding is still required to maintain specialist teams, train and retain staff and complete cryptographic migration.

For Cyprus, the priority is to build on its existing reporting framework by ensuring that warnings lead to effective action, while starting the long-term work of mapping and upgrading vulnerable cryptographic systems.

The report argues that governments can make substantial progress using authorities and resources they already possess, while regional cooperation can help share the cost of capabilities that would be difficult for individual countries to maintain.

Its central message is that the time available for institutional preparation remains, even as the time available to intervene during an attack continues to shrink.