Prompt engineering examples for beginners: 9 techniques, from zero-shot prompting to retrieval-augmented generation, that show how clearer instructions produce more useful AI answers
These 10 Q3 2026 startup funding rounds, from Databricks' $5 billion raise to Veeda AI's $90 million seed, show where venture money went across late-stage, early-stage and seed deals
Alexander Gromov explains why Europe’s savings market remains fragmented, how PickTheBank gives customers access to licensed banks and higher savings rates without holding their money, and why Cyprus is the company’s immediate priority.
PickTheBank started in 2022 as a comparison platform for European savings products. Today, you have expanded into a platform where customers can also apply for and manage deposits with selected partner banks. What drove this evolution, and what have you learned about the needs of European savers?
PickTheBank began with a personal question: where should I keep my savings to earn a better return without unnecessary risk? In 2023, we launched a comparison platform covering rates from almost every retail bank in Europe. It quickly gained popularity, especially in Western Europe.
We learned comparison alone was not enough, particularly for us in Cyprus. Knowing a better rate exists abroad differs from being able to access it. Customers need a familiar language, effective onboarding and confidence their money goes directly to a licensed bank.
That is why, in 2025, with Lidion Bank in Malta, we expanded into customer onboarding and fixed-term deposit management. Today, thousands use PickTheBank to find, apply for and manage savings products.
The lesson is simple: people want competitive rates, convenience and local support. A European deposit should be as easy to open and manage as one at home.
Europe has a single market, but banking and savings remain highly fragmented across national borders. What are the biggest barriers preventing Europeans from accessing savings products in other EU countries, and how is PickTheBank trying to remove that friction?
Europe has a single banking market on paper, but savings remain largely national. Customers in Cyprus may never discover or access competitive banks in Germany, Italy, Malta or the Baltics, while banks face significant costs to localise products, onboarding, support, marketing and operations country by country.
This creates major differences in rates for similar euro deposits. Some European markets currently offer returns of up to 3.5 per cent in EUR, while many customers in Cyprus earn very little, allowing inflation to reduce their savings’ real value.
This fragmentation has a real cost. Average household deposit rates in Cyprus remain among the euro area’s lowest, while statistics indicate that the average Cypriot holds around €30,000 in banks. If €30,000 earns 0–1 per cent locally instead of 3.5 per cent, the annual difference is approximately €750–€1,050.
PickTheBank bridges this gap through a familiar localised interface, while helping partner banks reach new markets without rebuilding their customer-facing infrastructure.
Trust is critical when a fintech company is helping people make decisions about their savings. How does the PickTheBank model work in practice, particularly around regulation, customer funds, deposit protection, and relationships with partner banks? How do you convince customers to look beyond their traditional local bank?
First, customers choose PickTheBank to diversify their savings. Those with larger balances may not want everything in one institution. Since eligible deposits are generally protected up to €100,000 per depositor, per bank, accessing additional banks can reduce concentration risk and make better use of deposit protection.
Second, PickTheBank is a service partner to licensed banks, not a bank, and never holds customer funds. The partner bank provides the deposit, holds the contractual relationship and receives the money after approval. PickTheBank provides technology, onboarding, a localised interface and support, while the banking product, funds and deposit protection remain with the bank. This aligns with customers’ desire to keep savings with banks rather than a fintech that invests or reallocates them.
Third, thousands of customers have used PickTheBank, and millions of euros have been placed with partner banks, demonstrating demand for competitive rates, diversification, transparency and bank-held savings.
PickTheBank is headquartered in Limassol but is addressing a European market. What are your priorities for the next 12–24 months? Are you planning to add more partner banks, markets or financial products, and are there any new partnerships, investment plans or announcements you can share with us?
Our priorities are focused on two areas.
First, we see strong organic demand in Cyprus. Over the next 12 months, we plan to localise the product further and focus more of our marketing efforts here. PickTheBank started from a problem we experienced ourselves, and we are excited to bring more value and a broader range of savings options to customers in Cyprus.
Second, we are working on adding new partner banks. We hope that already this autumn Cypriot customers will be able to access a second partner bank through PickTheBank, giving them more choice, better diversification and access to a wider range of competitive deposit rates.
Our longer-term ambition remains European: one familiar platform, available in local languages, where customers can preserve and grow their savings with licensed banks across the EU.
About PickTheBank
PickTheBank is a European savings platform based in Cyprus. It helps customers compare savings products, apply for and manage partner bank fixed-term deposits through a localised digital interface.
PickTheBank acts as a service partner to licensed banks and never holds customer funds. Customers transfer funds directly to the relevant bank.
Lidion Bank plc is a credit institution registered in Malta and licensed by the Malta Financial Services Authority, or MFSA.
The bank combines traditional banking services with digital solutions, including financing, cash management, treasury operations and multi-currency services. Lidion Bank serves retail depositors with the support of PickTheBank.
In this interview, Redox One outlines its technology, progress towards commercial deployment and international ambitions. It also explains why Cyprus, home to its headquarters, could become an early market and demonstration base for wider regional adoption.
From development to deployment
Redox One was established in 2022 by Tharisa plc to develop iron-chromium redox flow battery technology for safe, sustainable and cost-effective energy storage.
Building on Tharisa’s expertise in chromium production, mining, metallurgy and chemical processing, the company was created to address one of the most significant challenges of the energy transition: storing renewable energy reliably at scale.
A key strength is our vertically integrated approach, spanning chromium resources, electrolyte production and complete energy storage systems. This provides greater control over quality, supply security, cost and long-term scalability.
One of our biggest challenges has been moving from technology development to fully integrated, real-world energy storage systems. Important milestones include the successful operation of demonstration systems at our European Technology Centre in Germany and the development of a 625 kWh demonstration system in China.
Our next focus is advancing larger demonstration projects and progressing towards commercial deployments that can support renewable energy growth worldwide.
Storage built for duration
Our iron-chromium redox flow battery technology is designed to transform intermittent renewable energy into dependable, dispatchable power. It complements lithium-ion batteries by addressing applications that require longer-duration storage, high utilisation rates and long operating lifetimes.
The technology uses abundant materials such as iron and chromium and is engineered for decades of operation with minimal capacity degradation.
Safety is a major advantage. The system uses a water-based, non-flammable electrolyte that eliminates the thermal runaway risks associated with conventional lithium-ion batteries.
Flow batteries also offer significant economic benefits for long-duration storage because power and energy capacity can be scaled independently. Extending storage duration primarily requires additional electrolyte and storage tanks rather than a complete battery system expansion.
From a sustainability perspective, the electrolyte can be reused and recycled, while the battery chemistry relies on widely available materials. Together, these attributes create a safe, sustainable and cost-effective solution for large-scale energy storage.
International growth
Our commercialisation strategy is international from the outset. We are advancing the technology through demonstration projects and strategic partnerships across Europe, China and South Africa, while engaging with utilities, industrial customers, renewable energy developers and technology partners.
Our immediate priority is to validate demonstration systems and use operational data to support larger commercial projects. We see strong opportunities in mining, industrial, utility-scale and renewable energy applications where long-duration storage can improve reliability, flexibility and asset utilisation.
Our connection to Tharisa provides access to critical raw materials and metallurgical expertise, enabling participation across the value chain, from electrolyte production to complete energy storage systems.
Cyprus could potentially play an important role as a gateway to Southern Europe, the Eastern Mediterranean and the Middle East. Over the next three to five years, our goal is to develop a growing portfolio of commercial installations and establish scalable manufacturing and supply-chain partnerships.
Cyprus as an early market
Cyprus is home to our headquarters and an important part of our long-term growth strategy. As an island electricity system with abundant solar resources, it faces many of the challenges that long-duration energy storage is designed to solve.
Our technology can store excess renewable electricity during periods of strong solar generation and deliver it when demand exceeds supply. This improves grid flexibility, reduces renewable energy curtailment, enhances energy security and helps lower reliance on imported fuels.
We believe Cyprus could become an important early market for sustainable energy storage and a valuable demonstration platform for wider deployment across Southern Europe and the Eastern Mediterranean.
More broadly, Cyprus has the potential to strengthen its position as a regional deep-tech and clean-energy hub. Faster pathways for demonstration projects, targeted funding programmes and closer collaboration between government, industry, universities and investors would encourage more innovation-led companies to establish and expand their operations on the island.
Cyprus has the potential to become a regional innovation hub, but turning that ambition into globally successful companies will require startups to look beyond the domestic market, stronger corporate partnerships and easier access to international customers and investors.
In an exclusive interview with the Cyprus Mail, director at Plug and Play Cyprus, Filippos Kyprianou, discussed how the global innovation platform is connecting Cypriot founders with more than 600 corporations across over 60 locations, while helping them develop the commercial skills needed to scale internationally.
He also examined the role of local corporate partners, the challenges facing startups and what success should look like over the next five years.
Plug and Play has a global network spanning more than 60 locations. What does bringing that network to Cyprus mean in practical terms for a startup based on the island, and what can founders access through Plug and Play that they could not easily access before?
In practical terms it means a founder in Limassol is one introduction away from a decision-maker at a bank in Frankfurt or a shipping company in Singapore. Plug and Play works with more than 600 corporations across 60-plus locations, and those are not logos on a wall. They are relationships where the corporate has a team, a budget and a mandate to work with startups. Until now a Cypriot founder who wanted that kind of conversation had to get on a plane and hope.
The second thing is people. Every week of the programme we bring in mentors from across the network: operators who have scaled companies, investors, people who have run innovation inside large corporations. They would not normally be in Cyprus on a Tuesday morning, and our founders get time with them, one to one, on whatever is actually broken that week.
The third is capital. Plug and Play’s venture arm is one of the most active early-stage investors in the world. It hasn’t invested in Cyprus yet but our investment team sees every company that comes through the programme, and we want the first Cypriot startup in the portfolio to be the first of many.
None of it costs the founder anything. We take no equity, and the programme is covered through the Research and Innovation Foundation’s voucher scheme. And we are not here only for the ten companies in a cohort. The centre is a front door for the whole ecosystem. If you are a founder in Cyprus and need to reach a corporate or an investor in our network, come and talk to us.
The Cyprus centre has been developed through cooperation between Plug and Play, the government, the Research and Innovation Foundation and corporate partners. How important is that collaboration to building a sustainable ecosystem, what does it look like in practice, and where is there room to improve?
I’d say the collaboration isn’t something that helps the ecosystem, it is the ecosystem. When people look at Silicon Valley they see the startups, but what they’re really looking at is a loop that has been turning for seventy years, where Stanford produces the talent and the research, the funds on Sand Hill Road put money behind it, the corporates buy from the startups and eventually buy the startups themselves, and all of it sits on decades of government research spending that nobody remembers paying for. Each part feeds the next, and if you took any one of them out you’d be left with a pleasant university town.
In practice, collaboration means each party puts something real on the table and is accountable for it, and you can see that happening across the island, not only in our programme. The government sets the direction and removes the obstacles, through the grants RIF puts into early-stage companies, the spin-off framework that lets researchers leave a university with their own work, and the visa schemes that bring talent in. The corporates are starting to treat startups as suppliers and partners rather than as a sponsorship line. The universities are beginning to see a company coming out of a lab as a success rather than a loss.
Local funds and programmes are backing companies at the stage before they reach us, and we bring the international network, the programme and twenty years of knowing how this is done. Our piece of it is funded by RIF and co-funded by our partners, the targets are public, and we sit down with RIF regularly to look at the numbers together, so anyone can see whether it’s working.
That’s what collaboration looks like when it’s real: everyone has something at stake and nobody can hide behind the others.
Plug and Play’s core business worldwide is helping large companies work with startups. What would you say to a Cypriot company that wants to do more of that?
Most of the Cypriot companies I speak to already want to do this. What they ask is where to start, and my answer is usually smaller than they expect, and with different people in the room than they expect.
The way we do it with corporates around the world – and we’ve been doing it for twenty years with more than six hundred of them – is to start from a problem the business actually has rather than from a general wish to innovate.
A bank might want to cut the time it takes to onboard a business customer from weeks to days. A ship manager might want better data coming off its vessels. We take that problem, go through the startups we know, which at this point is tens of thousands, and bring back the handful that have already solved something similar for someone else.
The company meets them, picks one or two, and runs a pilot with us helping on both sides. The difficult part is rarely the technology, it is getting a company of eight people through the legal and security process of a company of eight thousand, and getting the company of eight thousand to make a decision in weeks rather than quarters.
If the pilot works there is a contract, and sometimes the corporate invests as well. That is more or less how a navigation startup ended up in every new Mercedes vehicle.
Where it goes wrong is when it is treated as an event instead of as work. If the innovation team organises a demo day and the head of operations isn’t there, nothing comes of it no matter how good the startups are, and if a pilot starts without anyone having agreed what happens when it succeeds, it will finish without anyone deciding.
I have watched this happen in Germany and in Singapore, so it is not a Cypriot problem, but it is the main reason companies try once and give up.
So my advice to a Cypriot company would be to pick one problem that someone in the business is already losing sleep over, give that person a modest budget and the authority to run a pilot and let us find the startups. Do one properly and the second is much easier. None of it needs an innovation lab.
Plug and Play works with major corporations around the world. How do you see Cyprus-based corporates such as Tototheo Global, ASBIS, ECOMMBX and Mastercard contributing to the development of local startups beyond simply providing sponsorship or support for programmes?
The funding is the smallest part of what they do. Each of the four came into this for reasons of its own, and the longer I work with them the more I think that mix is one of the programme’s strengths.
What each of them brings is quite different. Tototheo Global started out in maritime technology and has grown well beyond it over the years, but what matters most for our founders is that it is a company that built itself in Cyprus and then scaled into international markets, which is exactly the road the startups in our cohort are about to go down.
ASBIS is headquartered here and operates in dozens of countries, so it offers the kind of reach into other markets that a Cypriot startup could never buy on its own, and it is also one of the few corporates on the island that already invests in technology companies, which gives it a very practical interest in what comes out of the programme..
ECOMMBX built its payments infrastructure in Limassol and sells it internationally, so it knows from its own experience what a regulator will ask and what a bank’s due diligence actually looks like, and that is knowledge a fintech founder would otherwise spend a couple of painful years acquiring.
Mastercard brings the view of a global network that sees where payments are going before almost anyone else.
Some of them are here because they want startups working on problems inside their own business, some because they want to invest, and some because they believe the island needs this and would rather be part of it than watch from the side. What they have in common is that they all committed before there was a cohort or a single result to show them, when it would have been very easy to wait a year and see how it went. In my experience that kind of early commitment is the hardest thing to get from corporates anywhere in the world, and here we had it from the first day.
The first Plug and Play Cyprus cohort includes ten startups operating in areas ranging from artificial intelligence and diagnostics to energy and digital platforms. What were you looking for when selecting the first cohort, and what have you learned from working with these companies so far?
We kept the first cohort open to every sector on purpose, because when you start somewhere new you don’t know where the talent is, and the quickest way to find out is to open the door and see who walks in. We spent time with the finalists and picked ten.
At this stage you are backing people rather than plans, since the plan will change several times before it works, so what I look at is what a team has managed to do with almost no money, whether they can explain what has changed in the world that makes this possible now, and whether they have a real reason for the decisions they’ve made on price, market and hiring or are telling themselves a story. I also pay attention to what has moved between our first conversation and the second, because two weeks is usually enough to tell.
What has struck me so far is that the technical quality here is better than people outside Cyprus assume, and we have companies in diagnostics, energy and AI that I would put in any cohort in our network. Where they need us is on the commercial side, pricing for a market bigger than Cyprus, building a sales process that doesn’t stop when the founder is on a plane, and turning a pilot into a contract, which is what the three months are for.
Filippos Kyprianou
Cyprus has a growing technology community, but the domestic market is small. How important is internationalisation from the very beginning, and beyond funding, what are the biggest obstacles facing startups in Cyprus today?
It matters from before day one, from the moment you decide what to build. The question I ask every founder is: where do you want to be in five years? If the answer is Europe, build for Europe now. Price for it, hire for it, design for it and use Cyprus to test. You’ll hear me say this a lot. You’re not building a company for Cyprus. You’re building a company from Cyprus to serve global markets.
Estonia has about the same population as Cyprus and has produced around ten unicorns. It did that because nobody there could hide in a home market. A small market is only a problem if you let it set your ambition.
Beyond funding, the obstacles I see are distribution and ambition, in that order, and capital a long way behind. There’s more money looking at Cyprus than ever. What’s hard is the first international customer, the first salesperson who can close without the founder in the room, and being willing to fail in public. That last one matters more than people think. We have a culture, and it’s southern European more than Cypriot, where failure is something you hide. In Silicon Valley a founder who has failed once is easier to fund, not harder, because they learned something expensive and someone else paid for it. Part of what we’re here to do is bring that attitude with us.
Plug and Play has described Cyprus as having the potential to become an innovation hub in the Eastern Mediterranean. What would need to happen over the next five to ten years for that to translate into globally successful companies built from Cyprus, and how does Cyprus fit into the wider ecosystem?
The honest answer is that it needs a few Cypriot companies to make it internationally, because that is what sets everything else in motion. Once that happens, the people who built those companies go on to start new ones and invest in others, international investors begin to look at Cyprus seriously, and the next generation of founders can see that it is possible. Estonia is the clearest example: one exit, Skype, produced the founders and the capital behind most of the country’s startup scene today.
For that to happen here, a few things need to continue improving over the next five to ten years. Founders need to build for international markets from day one rather than for the island. Local corporates need to work with startups as a normal part of doing business, since a startup’s first serious customer is usually a local one. It must become easier to raise capital while keeping the company and the team in Cyprus, rather than relocating to raise. The island needs more experienced operators, people who have scaled companies before, which is what the government’s talent and visa schemes are designed to address. And universities need to see a company emerging from research as a success rather than a loss. None of this is new, and most of it is already moving. The next decade is about whether it compounds.
As for the region, Cyprus sits inside the EU, in a time zone that overlaps with Europe, the Middle East and India, and in a country small enough that you can reach anyone within a week, which makes it a natural meeting point. Reflect Festival already brings founders and investors from across the region to Limassol every May, and by bringing our network into it we want a founder from Athens or Dubai to be able to meet our corporates and our investors here, rather than having to fly to San Francisco to find them.
Looking beyond the first cohort and the November innovation Expo, what should success look like for Plug and Play Cyprus in three to five years, and what would convince you that the programme has made a lasting contribution to Cyprus’ startup ecosystem?
We have targets and we will be measured on them, and we take that seriously, but the targets describe the programme, not the ambition. What we want is for Cyprus to be a place where founders believe they can build something that matters and stay here while they do it, and we think that belief is the thing that is still missing. The talent is here and the money is coming. What hasn’t fully happened yet is the moment a few founders prove it can be done from here and everyone else stops asking whether it can.
In three to five years we would like to be able to point to Cypriot companies with customers in ten countries, with investors who came here to find them, with the first employees of those companies starting companies of their own. I would like a corporate in Limassol to have worked with enough startups that it does so without thinking, and a researcher at one of our universities to see starting a company as the obvious thing to do with a result, not a brave one. And we would like founders from abroad to consider Cyprus a serious place to build, not an unusual one.
The Expo on November 11 is the first time we put all of that in one room, our startups, our partners and investors from across the network, and I’m excited to see what comes out of it. As for what would convince me the contribution has lasted, it’s when the things we’ve described start happening on their own as well as through us, when the introductions we made in the first years have become relationships that no longer need us in the middle, and when Plug and Play has gone from being the reason a founder gets a meeting to being one of several good reasons to build a company from here. We’re in Cyprus for the long term.
Cyprus already has a relatively demanding framework for reporting cyber incidents, with a 6-hour early warning deadline and a fuller notification requirement within 72 hours, but the country must ensure its institutions can respond effectively as artificial intelligence accelerates cyber threats, according to a new report by the Digital Cooperation Organisation (DCO).
The findings appear in the organisation’s September 2026 edition of DCO Policy Watch, titled ‘Resilience at Machine Speed: National Cyber Defense in the Age of AI‘, which examines how governments can strengthen their defences against increasingly automated attacks and prepare for the eventual transition to quantum-resistant cryptography.
The report places Cyprus among jurisdictions with a defined incident-reporting interval in force, noting that its Article 35B requirements establish a tighter initial reporting timeframe than the default under the European Union’s NIS2 Directive.
However, it cautions that having a deadline does not automatically mean a country can respond effectively, with the resources, staffing and operational capabilities behind the rules ultimately determining their value.
For Cyprus, the broader lesson is that existing reporting requirements should form part of a comprehensive national strategy that connects early warnings to effective incident response, investment in defensive artificial intelligence and preparation for future cryptographic risks.
The report argues that cyber resilience is not simply a level of protection a government purchases, but the ability to detect an intrusion, contain it, maintain essential services and recover afterwards.
That capacity must be built, staffed and tested before an attack occurs.
The urgency is increasing. CrowdStrike’s observations of financially motivated cybercrime in 2025 found that the average time taken by an intruder to move from an initially compromised machine to a second machine had fallen to 29 minutes, while the fastest observed case took just 27 seconds.
In July 2026, autonomous AI agents operated by OpenAI conducted a four-and-a-half-day campaign that included an intrusion into the production infrastructure of Hugging Face, the largest public repository of open-source AI models.
The agents were given objectives, tools and permission to act across multiple steps without a person directing each individual action, illustrating how attacks can unfold with little or no immediate human intervention.
The report warns that the time available for people to make decisions during an incident is shrinking, making advance preparation increasingly important.
The financial consequences of inadequate preparation are illustrated by Costa Rica, where a ransomware campaign in 2022 prompted a response across 10 institutions that the country’s Comptroller General assessed at roughly 14 times the institutions’ combined cybersecurity spending in the preceding year.
Costa Rica had a national strategy, a designated ministry, a response team and an audit that had identified the ministry that subsequently failed.
What it lacked, according to the report, was sufficient funding, an operational plan and an enforceable reporting obligation.
The DCO identifies three pillars of national cyber resilience that governments, including Cyprus, should prioritise.
The first is establishing the institutional foundations needed to respond to incidents, including a published national strategy, a designated authority, clear reporting requirements and deadlines, and a trained workforce.
The report says these components are complementary rather than interchangeable, warning that a reporting duty has limited value if the receiving team lacks the capacity to act.
Although incident-reporting obligations exist across almost all DCO member states, measurable deadlines are less consistently established.
It recommends that governments attach clearly defined reporting intervals to existing legal obligations, taking account of the severity of incidents and the information reasonably available, while ensuring the receiving institutions have the resources to respond.
Ghana provides one example, requiring incidents to be reported to the relevant sectoral or national team within 24 hours of detection.
The second pillar concerns artificial intelligence and the changing balance between attackers and defenders.
The report distinguishes between human attackers using AI to discover vulnerabilities more quickly, autonomous AI agents acting without continuous human direction, and defensive applications of AI that help security teams identify weaknesses, assess incidents and test systems.
It says public evidence is not yet sufficient to establish whether AI overall favours attackers or defenders, but stresses that offensive tools are becoming more accessible.
DCO member states
A campaign against government systems reported in August 2026 was assembled using open-source agent frameworks, illustrating that sophisticated capabilities are not necessarily restricted to the companies developing the most advanced AI models.
The report therefore recommends stronger basic security controls, greater use of AI for defensive purposes and coordinated governance of advanced AI systems.
It also urges governments to record the degree of automation involved in cyber incidents, rather than relying exclusively on classifications of attack techniques.
Such reporting should allow an incident to be marked as “unknown” when the available evidence cannot establish whether actions were automated or directed by a person.
Singapore’s June 2026 guidance on securing agentic AI provides an example of how governments can identify vulnerabilities in automated workflows and apply appropriate safeguards.
For Cyprus, the findings point to the importance of ensuring that existing cyber security procedures account for attacks involving autonomous systems, while testing whether defensive AI tools can perform useful work under real incident conditions.
The report notes that, during the July 2026 Hugging Face incident, commercial AI models initially used by responders refused much of the forensic work because their safeguards could not distinguish between someone investigating an attack and someone conducting one.
An open-weight model running on the platform’s own hardware subsequently helped responders decode staged payloads, demonstrating the value of testing alternative tools before an emergency arises.
The third pillar is preparing for quantum computing, which could eventually undermine some of the public-key cryptographic systems currently used to protect data and authenticate communications.
The report warns of the “harvest now, decrypt later” risk, in which attackers collect encrypted information today in the expectation that future computing capabilities will allow them to decipher it.
Because replacing vulnerable cryptography across government systems can take years, preparation should begin before quantum computers capable of breaking existing protections become available.
The first step is to establish an inventory of the cryptographic algorithms used to protect information in transit and at rest, as well as those used to verify identities.
The report says this can begin without specialised quantum expertise or new procurement.
It recommends introducing inventory requirements through existing regulatory instruments, updating national cryptographic standards to include quantum-resistant algorithms and amending rules governing public key infrastructure, including electronic signatures and trust services.
Governments should then develop funded migration plans that identify responsible institutions, prioritise systems according to risk and establish testing and completion milestones.
The United States has estimated that migrating prioritised federal systems, excluding national security systems, will cost €6.25 billion ($7.10 billion), illustrating the scale of the investment involved.
The report also highlights how long cryptographic transitions can take, citing 22 years between the publication of the Advanced Encryption Standard and the National Institute of Standards and Technology’s cutoff for applying new protection with Triple DES, and 25 years between the first theoretical attack on SHA-1 and its planned retirement in 2030.
The DCO’s proposed roadmap divides action into three stages, beginning with foundational measures that allow governments to understand their own systems, progressing to operational capabilities, and culminating in advanced capabilities that member states can develop more effectively through cooperation.
Alongside reporting deadlines and cryptographic inventories, it recommends identifying essential services that should receive priority protection, ensuring cyber response teams are staffed around the clock and testing defensive AI tools before they are needed.
The report concludes that much of the initial work involves improving existing laws, procedures and administrative systems rather than developing new technology.
However, sustained funding is still required to maintain specialist teams, train and retain staff and complete cryptographic migration.
For Cyprus, the priority is to build on its existing reporting framework by ensuring that warnings lead to effective action, while starting the long-term work of mapping and upgrading vulnerable cryptographic systems.
The report argues that governments can make substantial progress using authorities and resources they already possess, while regional cooperation can help share the cost of capabilities that would be difficult for individual countries to maintain.
Its central message is that the time available for institutional preparation remains, even as the time available to intervene during an attack continues to shrink.
Login
.jpg)
