Attackers in Europe still walk in through the front door. The ENISA Threat Landscape 2025 analyzed 4,875 incidents between July 2024 and June 2025 and found that phishing opened 60% of intrusions, while vulnerability exploitation accounted for 21.3%. For many companies, the question has shifted from “will we be attacked?” to “how fast can we recover?”, and that question sits at the heart of cyber resilience for businesses.
Cyber resilience is an organization’s ability to anticipate, withstand, respond to, and recover from cyberattacks while it keeps critical operations running. We asked Florin Popa, Business Director at Orange Romania, how Romanian companies can build it. His answers cover NIS2 as a baseline, simple protection for small businesses, integrated connectivity and security, AI in security operations, and the community that keeps defenders sharp.
Orange Business has been a long-standing partner for DefCamp, and this interview highlights why the partnership has remained strong over the years.
From NIS2 compliance to cyber resilience for businesses
More and more business owners in Romania, even those running smaller companies, now see cybersecurity as a business risk that can hit operations, revenues and customer trust. NIS2 has pushed the topic higher on the management agenda, and Florin sees compliance as the starting line.
[...] compliance should be seen as a baseline, not as the end goal. The Directive requires organizations to adopt appropriate, proportionate technical, operational, and organizational measures to manage cybersecurity risks, along with incident-reporting processes.
That shift shows up in every client conversation. Questions about legal checklists increasingly give way to questions about exposure, critical assets, and response time. Florin explains how Orange Business meets each company at the level of maturity it has reached.
So our conversation with customers is increasingly moving from "What do I need to do to be compliant?" to "What are my critical assets, where is my exposure, and how quickly can I detect and respond to an incident?"
This is where our portfolio can support different levels of maturity. We usually start with a risk assessment, helping customers identify their exposure, and move toward specific solutions. And importantly, we don't necessarily start by replacing what the customer already has. In many cases, we add security layers around their existing infrastructure and progressively improve their security posture. Every organization has a different risk profile, technology stack, and level of maturity, so the right approach has to be tailored to the business.
Cybersecurity for small businesses, made simple
Small companies face the same attackers as large ones, but rarely with the same budgets or in-house expertise. Many of them have no one dedicated to security, and every hour spent comparing tools is an hour taken away from customers. Small business owners want a solution for their business, and a long list of products rarely helps them sleep better. Orange Business starts from the business problem.
A small company should not have to become a cybersecurity specialist in order to protect itself. We start by understanding what is critical for that business (its connectivity, endpoints, applications, cloud environment, data) and then determine what level of protection is appropriate.
In practice, that often means a managed service that watches over the company around the clock. Owners can focus on running the business, while specialists handle detection and response in the background. For many smaller companies, it is the first time they get continuous monitoring without building their own security team.
With SCUT Managed Detection & Response, for example, Orange provides 24/7 monitoring, bringing together data from endpoints, servers, cloud environments, and firewalls into an XDR platform, with AI-supported detection and human security expertise.
So the customer doesn't have to assemble and manage a complex security architecture on its own. We can translate its business risks into a security model that is understandable, scalable, and managed according to its needs.
Connectivity, cloud and security under one roof
Orange Business combines connectivity, cloud, and security in one offering, so customers don’t have to buy each service separately, and Florin sees the biggest gains in integration and visibility.
The traditional security perimeter has disappeared. Employees work remotely, applications are distributed across cloud and on-premise environments, and critical business processes depend on connectivity. This means security needs to follow the user, the application, and the data rather than simply protecting a corporate network perimeter.
That idea also shaped one of Orange’s biggest moves in security. In September 2025, Orange Romania launched SCUT, a dedicated cybersecurity company built in strategic partnership with Orange Cyberdefense. Florin explains the thinking behind it.
This is one of the reasons we launched SCUT: to bring these capabilities together under a unified cybersecurity approach. SCUT helps create a more integrated view of the customer's technology environment and security risks, making it easier to understand exposure and coordinate the response.
For the customer, it means a more coherent security strategy and better visibility across different layers of the IT environment.
What cyber resilience for businesses looks like in practice
Cyber resilience for businesses starts with an uncomfortable truth: sooner or later, an attacker will get through. The companies that come out stronger are the ones that planned for that moment in advance. Operational resilience is a central theme for Orange Business this year. Its approach follows the whole cybersecurity lifecycle, from understanding exposure to recovering after an incident.
It starts with understanding the organization's exposure, identifying and prioritizing vulnerabilities, and reducing the attack surface before those vulnerabilities can be exploited.
The next layer is continuous monitoring and detection, combined with proactive threat hunting to identify suspicious activity that may otherwise remain undetected. When an incident occurs, the focus shifts to rapid containment, investigation, and recovery, with the objective of minimizing disruption to critical business operations.
Prevention still matters, but no company can stop every attack. What sets resilient organizations apart is how quickly they spot an incident and recover from it. For Florin, resilience is never a single product.
Resilience means more than preventing an attack. It means being able to identify an incident quickly, respond effectively, and recover safely. I think everyone needs to understand that resilience is not about a single product. It is about combining a clear understanding of your exposure, reducing your attack surface, continuously monitoring for threats, and having the capabilities to respond and recover when an incident occurs.
AI changes where defenders spend their time
Few topics have dominated security conversations in the past two years as much as artificial intelligence. Vendors promise autonomous defense, while attackers already use AI to write convincing phishing emails at scale. On the defensive side, AI helps teams analyze very large volumes of security data, spot patterns, correlate events, prioritize alerts, and automate parts of detection and response. Florin is clear about what it does not change.
It's a process supported by AI and guided by human expertise.
For me, the important point is that AI doesn't remove the need for cybersecurity professionals. It changes where their time and expertise are most valuable.
AI can help machines process and correlate enormous amounts of information. Humans are still essential for understanding context, investigating complex incidents, making decisions.
The skills cybersecurity professionals need in the AI era
Cybersecurity tools evolve rapidly, requiring practitioners to constantly adapt. As deep knowledge in a single area becomes insufficient, AI’s influence on workflow distribution fundamentally reshapes the knowledge and competencies experts require.
The profile of a cybersecurity professional is becoming broader. Technical expertise remains essential, but professionals increasingly need to understand cloud environments, identity, data, automation, and AI, as well as the business processes they are protecting.
For our people, continuous learning is therefore essential. Cybersecurity evolves too quickly for professionals to rely only on the knowledge they acquired a few years ago.
For Orange Business, part of that learning happens away from the office. Conferences and community events bring defenders, researchers, and ethical hackers together. There, they compare notes on what they see in the field and bring fresh ideas back to their teams.
This is also why communities such as DefCamp are so important. They allow our teams to interact directly with ethical hackers and other specialists and share knowledge.
Orange Business and DefCamp 2026: a partnership built on trust and community
Orange Business has been part of DefCamp for many years and the company powers the 2026 edition, which brings more than 2,500 professionals from 700 organizations to the Palace of the Parliament. Florin explains why the partnership has lasted so long.
DefCamp has become much more than an annual conference for us. It is a place where the cybersecurity community comes together. You can learn from new research, a technical demonstration, or from the way another organization approaches a security challenge. And that is probably why, after so many years, it still feels like home: because cybersecurity is ultimately a community built around continuous learning, collaboration, and sharing knowledge.
Meet Orange Business at DefCamp 2026
Want to hear how Orange Business and SCUT approach resilience in practice? Find their team at DefCamp 2026, between talks on four stages and the competitions in the Hacking Village.
You can learn from new research, watch technical demonstrations, and compare notes with the specialists who defend Romanian companies every day.
Get your DefCamp 2026 ticket and join us in Bucharest on November 19 and 20.
Meet the interview author:
Nadine Tudor is a marketing and communications trainee at Bit Sentinel, where she especially enjoys creating social media content and visual assets. New to cybersecurity, she’s eager to keep learning and to help make complex security topics easier for everyone to understand.