The upcoming Swedish Cybersecurity Act, which is based on the EU's NIS2 Directive, is often described as yet another heavy burden on organizations. But I would like to challenge that view. In fact, this law could mark the beginning of a new era: one in which cybersecurity is no longer a side issue, but a strategic opportunity and a key to competitiveness.

On August 23, 2025, IT supplier Miljödata AB was hit by a major cyberattack that knocked out important HR systems in over 160 Swedish municipalities and several regions. Miljödata supplies the Adato rehabilitation and HR system, which is used by 80% of Sweden's municipalities. The attack resulted in the theft of personal data for over one million Swedish citizens—including names, personal identification numbers, addresses, and contact details—linked to employees in municipalities such as Stockholm, Gothenburg, Linköping, and others.

Cloudflare is a linchpin of the modern Internet’s infrastructure, yet its “content-neutral” stance has repeatedly allowed phishing, malware, and extremist sites to hide behind its network. Security researchers warn that about 10.05% of all spam/malicious domains use Cloudflare’s nameservers, and that attackers routinely move flagged domains behind Cloudflare to “disguise the backend.”