Cybersecurity, from silent threat to strategic priority
This article comes from Paperjam published in December 2025.
Cyberattacks are soaring and regulations multiply. From AI-driven risks to increasing pressure on talent, cybersecurity has become a strategic issue. Sabika Ishaq, Head of Information Security and CISO at Grant Thornton Luxembourg, explains what’s at stake.
Cyberattacks up 59% in Luxembourg in Q2 2025
Organisations in Luxembourg faced 1,862 cyberattacks per week in Q2 2025, compared with 1,173 a year earlier*, according to data published by Check Point Research. While high, that is slightly below the European average of 1,977 per week. Financial services, public administration and education remain the sectors in the country.
Cyberattacks are rising fast. What are the main threats today, and how do they impact recruitment and skills needs?
It reflects two realities: detection has improved, and the threat landscape keeps expanding and growing more sophisticated.
The biggest risks arise where old and new worlds meet. Many key infrastructures still rely on legacy systems—built decades ago; once linked to cloud platforms, AI tools or external networks, their vulnerabilities multiply. Another growing weakness is identity compromise: most breaches result from stolen or misused credentials, the value supply chain partners; hence the contagion flows in third-party risk.
Geopolitical tensions further complicate matters, with state-sponsored actors embedding themselves in networks. To adapt, organisations must both strengthen their defences and recruit talents able to bridge technology, analytics and strategy.
“Dora has moved cybersecurity from the back office to the boardroom”
How does regulation reshape the way organisations structure their cybersecurity teams?
Dora has moved cybersecurity from the back office to the boardroom. Executives are now directly accountable, management listens, budgets follow, and resilience becomes a shared responsibility.
The problem is less about a lack of skills than about capacity. Europe has strong expertise, but too few professionals to meet demand. The challenge is to attract and retain the right talent.
Companies need experts in cloud, identity management and AI risk, but also profiles who can translate technical issues into business terms. That’s where diversity becomes strategic. Gender, background, experience or neurodiversity, each perspective helps to see risks differently.
How does this lack of resources translate to Luxembourg?
Like elsewhere in Europe, Luxembourg faces a double dependency. The first is human. Europe still relies on external experts, while local training and talent development remain limited.
The second is technological: much of the digital power depends on a handful of global vendors—Amazon, Microsoft, Google. Without greater investment in Europe’s shared digital infrastructures, this reliance will persist. Luxembourg’s sovereign cloud and AI ambitions may start, but it must be matched by R&D, education and industrial policy to build real digital sovereignty in Europe.
Is recruiting cybersecurity talent even harder for SMEs?
Big firms and clear frameworks set the standards, leaving a missing compliance shield on SME operations. To avoid a two-speed cybersecurity landscape, shared platforms, managed services and public-private support schemes are essential. Encouragingly, Luxembourg’s ecosystem is evolving in that direction, enabling smaller players to access best practices and affordable resilience without replicating large-enterprise models.
Cyber Budgets Set to rise
57% of respondents anticipate increasing their budget for cybersecurity over the next 12 to 24 months.
- 43% do not plan to increase their cybersecurity budget
- 57% plan to increase their cybersecurity budget
Source: Check Point Research, published October 23, 2025.
If training is not the solution, how can we develop education systems that stay relevant in a field evolving as fast as cybersecurity?
The key is continuous learning. Technology evolves daily, and so must we. That’s the interest I share with my mentees: investing in your own learning is the best investment you can make.
Luxembourg is moving in the right direction.
Institutions like the Luxembourg Bankers’ Association (ABBL), the Chamber of Commerce and the Luxembourg House of Cybersecurity are joining forces through working groups and uniting experts from finance, industry and the public sector. Together, they’re shaping training programmes, sharing intelligence and strengthening the local talent pipeline.
How will AI reshape cybersecurity jobs, will it replace or enhance human expertise?
AI is a game changer, but it won’t replace us. It will amplify us. It brings speed, precision and the ability to spot anomalies that humans might miss. But final judgments must remain human, because cybersecurity is about context, ethics and decision-making. The real competition is no longer human versus machine, but human + AI versus machine. Cybercriminals are already using AI, mastering these tools is the only way to stay ahead.
Can Luxembourg become a true European hub for cybersecurity, or is it hard still to small to reach that level?
Luxembourg is well positioned: it’s mutually international and supported by a skilled cross-border workforce. Its strength lies not in size, but in diversity and collaboration. What truly sets the country apart is its ability to bring together public, private and academic actors around shared goals. It’s not about mass, it’s about excellence and innovation. Luxembourg has all the ingredients to lead by example in Europe.
53% turn to AI and/or cyber talent shortage
According to PwC’s 2026 Global Digital Trust Insights survey (17,381 leaders across 77 countries), only 6% of organisations have fully solved the talent gap. The shortage is particularly severe in small markets, pushing 59% of organisations to rely on AI and machine learning to fill critical skills gaps.
Want to discuss the cybersecurity function in your organisation? Contact Sabika Ishaq: sabika.ishaq@lu.gt.com
Learn more about our Information Security services.
With more than 340 people and 27 partners, Grant Thornton Luxembourg is a leading provider of Audit, Tax & Accounting, Advisory, Financial Services and Technology services for all types of entities in Luxembourg.
-
![Sabika Ishaq]()
Sabika Ishaq Sabika is Chief Information Security Officer (CISO) and Head of Information Security at Grant Thornton Luxembourg.View Profile
