.png)
The can of worms is open: why reactive security no longer holds
Espoo, Finland - 03.11.2026 In the space of two weeks this October, cyber security moved from the IT department to the front page.
On the night of 11 October, refrigeration systems in hundreds of French supermarkets were remotely switched into defrost mode. Intermarché, Coopérative U, E.Leclerc and others threw away whole aisles of food, and some equipment overheated and caught fire. Within days, similar incidents surfaced in Belgium, the Netherlands and Sweden, where Coop said six of its stores had to discard food. EU food commissioner Christophe Hansen called it a new "reality." The controllers were reportedly reachable from the public internet, some protected by little more than a default login.
Then, on 19 October, word spread of two critical vulnerabilities in PHP, the programming language behind a large share of the world's websites. Yle reported that an EU cyber security body was urging organisations to take their sites offline if they couldn't patch in time. That body was CERT-EU, whose advisory, as The Next Web reported, warned the flaws could let attackers run code on a server without logging in at all.
Fridges and websites. Two very different incidents, with one uncomfortable thing in common: in both cases, the weakness was knowable long before it became news.
Why this lands differently in the Nordics
At Adsotech, this is a pattern we see regularly in customer conversations. In Finland, and across the Nordics more broadly, cyber security has long been treated as due diligence. Something you document, report on and file away.
When the discussion turns to access controls or SoD risks (segregation of duties, the principle that no single person should be able to both create and approve the same transaction), the framing is usually about audit readiness. Will this pass the review?
In Germany or the US, the same conversation sounds different. People talk openly about preventing fraud: who could misuse their access, how, and what it would cost. They call a spade a spade.
That difference in vocabulary matters, because vocabulary sets urgency. A risk described as a vulnerability that might exist gets a line in a report. A risk described as fraud that could happen next quarter gets a budget.
The numbers point the same way. In its NIS investment study, ENISA, the EU's cyber security agency, found that EU organisations allocate on average 41% less to information security than their US counterparts.
AI is already in the picture
AI already sits inside the systems that run finance, procurement and HR. It has changed the whole dynamic of information security, and it changes how a private company needs to look at its total risk profile, from outside threats and inside ones alike.
From the outside, attackers have access to the same tools everyone else does, which makes it faster to find a weakness and act on it. From the inside, AI agents are a new kind of actor with real access. Writing in Forbes this summer, Pathlock CEO Damon Tompkins put it bluntly: "The level of access and authority these AI agents are granted is mind-blowing."
His argument is that traditional identity governance assumes the actor is a person, and "permissions designed for people aren't necessarily appropriate for autonomous systems." An agent with too much access can repeat a single mistake at machine speed. In Tompkins' words, "an AI-driven error can be replicated thousands of times across multiple systems." He also observes that boards ask plenty about AI adoption and return on investment, while questions about risk ownership "are less common," which he calls "a dangerous gap."
This is where the Nordic habit of treating security as a reporting exercise gets expensive. A compliance-first tone was already a weak fit when every user was a person. With AI acting at machine speed on both sides of the firewall, it leaves gaps that nobody is watching. If we want to cover those gaps, the tone in Europe has to change, from asking whether the controls will pass the review to asking who, or what, could misuse access tomorrow.
The can of worms is open
Safe to say that after this October, the world of IT and cyber security is no longer the same.
Cyber security behaves like a can of worms. Once it opens in one area, it shines a light on the entire risk profile. A patched website raises the question of who holds admin rights to it. A compromised controller raises the question of which other systems still run on default logins. And sooner or later, someone asks who in the ERP can create a new supplier and also approve the payment to it.
Those questions were always there. What has changed is that risks are now materialising, from outside and from inside, so they can no longer be swept under the rug. Being optimistic about unmitigated risk was a comfortable stance while incidents happened to someone else. That option is gone.
So the real shift is from reactive to proactive. Reactive governance waits for the audit finding or the headline, then fixes what broke. Proactive governance assumes the risk is real and keeps continuous visibility over who can do what: employees, roles, and increasingly AI agents. This is the ground Pathlock covers, and the reason we work with them. Access risk, SoD and identity governance get monitored continuously, the same way you would watch anything else that can cost you money.
One question to take with you
Is it time for information security to get a bigger share of private companies' budgets, and does your organisation know its risk profile inside and out?
Sources
ENISA: NIS Directive has positive effect, though study finds gaps in cybersecurity investment (11.12.2020)
Forbes: Key questions boards need to ask as AI agents become powerful enterprise actors, Damon Tompkins (24.7.2026)
Adsotech Scandinavia Oy · Keilaranta 1, 02150 Espoo, Finland
Comments