The Cybersecurity Act requires more than just knowledge on paper

The Cybersecurity Act imposes stricter requirements on organizations’ cybersecurity efforts. On October 1, 2026, new regulations and general guidelines came into effect under the Act, which, among other things, clarify the requirement for security training for senior management. And since personnel change, systems evolve, and threats shift, it is important that training not be a one-time event, but rather be repeated regularly. 

– When we talk about cybersecurity, there are two aspects to consider: the theoretical and the practical. The former includes the written security policy. Perhaps it’s been posted on the wall in the office. But of course, that’s not enough—it must also be implemented. That’s where the practical aspect comes in,” says Shamoona Imtiaz, a research and development engineer at RISE and a member of the Cyber Range team. 

Cyber Range is a controlled testing environment at RISE in Kista, where companies and public organizations can test their cybersecurity in an environment that mirrors their own digital reality, without causing any damage to their actual systems. 

Simulates a typical day at work that takes an unexpected turn

Shamoona Imtiaz emphasizes that it is not only IT staff and technicians who benefit from this type of testing environment. This is especially true now that the requirement for mandatory cybersecurity training for an organization’s leadership has taken effect. At the Cyber Range, executives can gain an understanding of their responsibilities under the Cybersecurity Act through scenario-based training.

“We see how important it is to develop the ability to understand and communicate with colleagues. Leaders must be able to discuss security risks with the company’s more technical roles, and the communications department also needs to understand what happens during a cyberattack in order to communicate both internally and externally,” says Shamoona Imtiaz.

A cyber exercise is largely about simulating a typical day at work that takes an unexpected turn. Typical in the sense that everyone has their own areas of responsibility and tasks, but unexpected because these tasks will be interrupted by a cyberattack. 

– The technical team is there, management is there, and the communications staff are there as well. The idea behind scenario-based training is to strengthen organizations’ ability to work together and to bridge the gaps that arise when different departments don’t speak the same language. “How do I communicate my problem using words my boss can understand? During a training session at the Cyber Range, you get the opportunity to practice this,” says Shamoona Imtiaz.

Cyber preparedness that limits damage

Many cyber testing environments have an offensive focus, where participants get to practice attacking a simulated system themselves in order to understand how it needs to be protected. The idea is to stay one step ahead of the attacker by gaining knowledge of how vulnerabilities in the digital environment can be exploited.

“But I don’t entirely agree that this approach is the right path for all types of organizations. For the military and government agencies, absolutely, but when it comes to smaller industrial companies or municipalities with limited resources, it’s preparedness that’s more important,” says Shamoona Imtiaz.

The preparedness perspective involves practicing how the organization should respond when an attack is detected, with a focus on limiting damage and keeping operations running. In practice, this may involve learning to recognize warning signs, knowing when to alert IT staff, acquiring knowledge about how to isolate an affected computer, and practicing how to restore systems and data using backups.

But can't you gain that knowledge by reading up on it?

“We humans tend to forget some of the information we read, but if we’ve been in that situation and experienced an attack in real time, things stick in our subconscious in a different way. The experience leaves a more lasting impression than any document ever could,” says Shamoona Imtiaz, continuing: 

– Many people who leave our training rooms after a day of training continue to discuss things with one another. What happened there? How did we react? What could we have done differently? The exercise is over, but the participants are sharing lessons learned and information because they’ve begun to understand, see possibilities, and evaluate their abilities. I think that’s very telling.