Cyber News – SGBox Next Generation SIEM & SOAR

NIS2 Directive and OT Security: impacts, requirements and solutions

SGBox — Mon, 06 Jul 2026 09:55:45 +0000

The Impact of NIS2 on OT Security

The NIS2 Directive marks a turning point for cybersecurity across Europe. Until just a few years ago, protecting IT infrastructures was considered enough to reduce cyber risk. Today, however, that approach is no longer sufficient.

As industrial environments become increasingly digitalized, Operational Technology (OT) systems have become a prime target for cyber attackers, making an integrated security strategy more important than ever.

For manufacturing companies and organizations that manage industrial processes, the relationship between NIS2 and OT Security has become a fundamental pillar of cybersecurity governance.

How does NIS2 impact OT Security?

The NIS2 Directive expands the number of organizations subject to cybersecurity obligations while introducing a risk-based approach to security management.

Security measures can no longer focus solely on servers, workstations, and digital services. They must also include production facilities, industrial control systems, and OT networks that ensure business continuity.

This means organizations need complete visibility into their OT assets, continuous monitoring of their security posture, and incident detection and response procedures capable of protecting both IT and OT environments simultaneously.

Operational Technology and industry standards

Operational Technology (OT) includes the hardware and software used to control machinery, production lines, PLCs, SCADA systems, and other critical industrial infrastructure.

Unlike traditional IT environments, where data confidentiality is often the primary concern, OT environments prioritize system availability and operational continuity.

A production outage can lead to significant financial losses while also putting worker safety at risk.

For this reason, the internationally recognized IEC 62443 standard serves as the primary framework for securing industrial automation systems. It defines both technical and organizational requirements, including network segmentation, access control, continuous monitoring, and the adoption of a security-by-design approach.

Key OT Security requirements under NIS2

The NIS2 Directive introduces several cybersecurity measures that are particularly relevant to OT environments.

Among the most important are:

Extending cyber risk management to industrial facilities
Continuous inventory and monitoring of OT assets
IT and OT network segmentation
Vulnerability management and production-compatible patching strategies
Early detection of security incidents
Business continuity and disaster recovery planning
Supply chain monitoring and oversight of third-party vendors with access to critical systems and data

The ultimate goal of NIS2 is not simply to reduce the likelihood of cyberattacks, but to strengthen the overall resilience of the organization.

Beyond Compliance: the strategic benefits for industrial operations

Viewing compliance as nothing more than a regulatory requirement means missing a valuable opportunity.

Investing in OT Security helps organizations reduce production downtime caused by cyber incidents, improve equipment availability, and detect anomalous behavior before it disrupts operations.

Continuous monitoring of industrial environments also simplifies security audits, improves collaboration between IT and OT teams, and enables faster, more informed decision-making during incident response.

In this context, NIS2 and OT Security become complementary elements of a broader strategy focused on operational resilience.

SGBox for OT Security: an integrated security-by-design approach

Protecting industrial environments requires more than simply deploying new security tools. Organizations need a platform capable of correlating events across both IT and OT environments to provide a unified view of cyber risk.

SGBox was built around exactly this philosophy. By integrating Log Management, SIEM, and SOAR capabilities into a single modular, proprietary platform, SGBox enables organizations to:

Collect logs within an ACN-certified European Cloud environment
Centralize security data
Monitor security status in real time
Respond rapidly to security incidents
Monitor vulnerabilities and the external attack surface
Gather compliance evidence through comprehensive security reports and audit documentation

By combining technology, processes, and expertise, SGBox enables organizations to implement a true security-by-design model, where cybersecurity is built into the infrastructure from the very beginning and supports every stage of its lifecycle.

With SGBox, compliance with the NIS2 Directive becomes more than a regulatory obligation, it becomes an opportunity to strengthen OT security, improve operational resilience, and build a truly integrated cybersecurity strategy.

Learn more about SGBox features>>

Ignored Logs, exposed businesses: why your infrastructure already produces the data to prevent a cyber attack

SGBox — Fri, 03 Apr 2026 07:38:18 +0000

Every company’s IT systems tell a story every single day, quietly and with remarkable precision.

Every successful or failed authentication, every DNS query, every network connection established or interrupted, every file modification: everything leaves a trace, a chronological, sequential record of the actions performed by a device.

Yet in many organizations, especially SMEs, the process of managing security logs is either inconsistent or completely absent.

This significantly limits the ability to gain real-time visibility into the security status of the IT infrastructure, and consequently reduces the capability to detect anomalies and anticipate cyber threats.

The issue is never a lack of data, it’s the lack of a system capable of transforming that data into actionable intelligence, in real time, before the damage becomes irreversible.

The visibility paradox: why Log Management matters

Within any corporate IT infrastructure, firewalls, endpoint protection systems, IDS/IPS, VPNs, Active Directory, Cloud applications, and email gateways continuously generate security logs.

These are structured, precise, and chronologically ordered pieces of information, the ideal raw material for detecting anomalies, identifying suspicious behavior, and intercepting threats before they fully unfold.

The paradox is clear, and unfortunately widespread: organizations invest significant resources in perimeter security tools, yet systematically overlook the informational value those very tools generate every second.

The result is what can be defined as a state of “blind visibility”, a condition where all the data needed to detect an attack is technically available, but the organization lacks both the centralized collection capability and the analytical engine required to extract meaning from it in time.

For IT teams, the challenge is often technical: heterogeneous logs from multiple sources, incompatible proprietary formats, and exponentially growing volumes of events that, without normalization and correlation, generate more noise than signal.

For business leaders and managers, the issue often remains in the background, perceived as a secondary technical concern, at least until an incident reveals its full strategic and economic impact.

Log Management: a data-centric approach to defense

The SGBox Log Management module is designed to address exactly this challenge.

It automatically collects and classifies information from any source, seamlessly integrating new devices without operational disruption, to build a detailed and continuously updated overview of the organization’s security posture.

Once collected, data is compressed, encrypted using asymmetric key algorithms, and timestamped with GPG signatures, essential guarantees not only for operational security but also for evidentiary integrity in forensic investigations, compliance audits, and inspections related to GDPR, System Administrators’ regulations, and the NIS2 Directive.

What sets this solution apart from a simple log repository is its ability to generate specific patterns to normalize data, even from non-standard formats or custom applications, ensuring native SGBox recognition regardless of the source.

Windows and Linux operating systems, network devices, firewalls, antivirus solutions, NIDS, web applications, and IoT sensors all converge into a single, structured, fully searchable collection point.

Through an intuitive system, users can search, filter, aggregate, and perform in-depth analysis, with the ability to drill down from a high-level overview to the detail of a single event.

Log Correlation Engine: when data becomes intelligence

Centralized collection is the necessary starting point, but the real leap forward happens at the correlation level.

This is where SGBox demonstrates one of its most distinctive capabilities: the Log Correlation Engine (LCE) identifies risk scenarios through advanced correlation rules that can trigger automated countermeasures without requiring manual analyst intervention.

The underlying logic is that of a Next-Generation SIEM, a solution capable of collect large volumes of logs, correlating data, and generating proactive alerts to identify anomalies and potential risk scenarios.

The module includes a library of predefined correlation rules, continuously updated based on the experience of SGBox Security Engineers, covering known attack scenarios such as lateral movement, brute force, data exfiltration, persistence, and APTs.

These rules can be customized according to the specific characteristics of each IT environment, ensuring coverage aligned with the organization’s actual risk profile.

When a threat is detected, SGBox can automatically trigger responses by executing scripts or interacting with security platforms via APIs, containing incidents in timeframes that manual processes could never achieve.

Optimizing costs without compromising coverage

One of the most common misconceptions in cybersecurity is that improving an organization’s security posture necessarily requires replacing existing tools.

SGBox takes the opposite approach: the platform integrates with the existing IT and security infrastructure, acting as a unifying layer that connects security tools, cloud services, and on-premise systems, without imposing costly replacement strategies.

From a cost management perspective, SGBox adopts a licensing model based on data sources, that is, the number of devices sending logs, without any limitation on data volume or the number of events processed over time.

This translates into a predictable and scalable cost structure, suitable for SMEs, large enterprises, and MSSPs alike: you don’t pay for growing log volumes, you pay for the sources you monitor.

A crucial distinction in an era where the proliferation of connected devices makes volume-based pricing models increasingly difficult to control.

From raw data to informed decisions

In a landscape where cyberattacks are becoming increasingly sophisticated, persistent, and difficult to detect, the ability to collect, normalize, and correlate logs in real time is no longer an advanced option reserved for large enterprises.

The ability to manage IT security in a centralized and proactive way has become a fundamental operational requirement for any organization that wants to maintain control over its digital perimeter.

SGBox Log Management allows organizations to truly “listen” to their systems, to correlate weak signals before they turn into real damage, interpreting data to stay one step ahead in preventing cyber attacks.

Request a free Demo of SGBox>>

How can a SIEM & SOAR Platform transform your company’s security posture?

SGBox — Mon, 02 Mar 2026 09:41:20 +0000

Today, the traditional approach to cybersecurity is no longer enough to keep up with the unpredictability and speed of modern cyber threats.

Organizations are facing increasingly complex and sophisticated attacks every day, advanced Ransomware, AI-driven threats, Phishing, and Social Engineering, all designed to exploit vulnerabilities and disrupt IT systems and Cloud environments.

To stay ahead, companies need flexible, cutting-edge technologies that can proactively counter evolving threats while protecting sensitive data and critical infrastructure.

SGBox’s SIEM & SOAR platform redefines modern cybersecurity by combining advanced technology with the ability to anticipate emerging threats. It brings together intelligent data management, real-time correlation, proactive monitoring, and automated response into one powerful solution.

Let’s explore how the SGBox Platform can strengthen and transform the companies security posture in line with today’s rapidly evolving threat landscape.

Real-Time visibility into your security status

SGBox’s SIEM & SOAR platform provides centralized visibility across your organization’s data, Endpoints, IT, and OT devices.

By collecting, correlating, and analyzing logs from multiple sources, it gives you full control and real-time insight across your entire digital perimeter.

This unified approach breaks down silos between departments and security tools, enabling early detection of potential vulnerabilities and allowing you to respond proactively, before threats escalate into full-scale attacks.

Data security with regulatory Compliance in mind

The regulatory landscape is becoming increasingly complex, requiring organizations to meet strict requirements around data governance, cyber risk management, security roles, and IT policies.

To comply with regulations, companies must implement well-defined cybersecurity processes that prioritize data integrity.

The platform offers advanced Log Management and retention features. Logs are collected, encrypted, and time-stamped to ensure immutability and full alignment with regulatory requirements.

Streamlined and optimized Incident Response

Rapid incident response is critical to minimizing the potential damage caused by cyberattacks.

The SIEM & SOAR platform enhances threat detection through advanced analytics, machine learning, and automation, identifying anomalies at an early stage. Once a threat is detected, automated response workflows are triggered to contain and manage the incident efficiently.

The SIEM (Security Information & Event Management) component, combined with SOAR (Security Orchestration, Automation & Response), enables proactive alert management, reduces false positives, and monitors user behavior, significantly improving the effectiveness of response processes with actionable, real-time data.

Seamless integration with your existing infrastructure

One of the key advantages of a SIEM & SOAR platform is its ability to integrate seamlessly with your existing IT and security infrastructure.

It acts as a unifying layer that connects various security tools, Cloud services, and On-Premise systems, ensuring smooth data flow and coordination. This eliminates the need for costly rip-and-replace strategies and maximizes the value of your current investments.

SGBox’s platform features a modular and flexible architecture, allowing it to adapt to your organization’s specific security needs, from basic log collection to advanced correlation and incident response capabilities.

It can be deployed On-Premises, in the Cloud, or in Multi-Tenant mode, providing MSSPs with unified and centralized security management for their clients.

Request a free demo>>

Next Generation SIEM uncovered: definition, benefits, and best practices

SGBox — Wed, 04 Feb 2026 14:31:13 +0000

What is Next Generation SIEM?

Next Generation SIEM represents the evolution of traditional Security Information and Event Management solutions.

Born to tackle the challenges of an increasingly complex and dynamic threat landscape, a Next Generation SIEM combines event collection and correlation with advanced analytics powered by Artificial Intelligence (AI), Machine Learning (ML), and orchestrated automation.

While traditional SIEMs focus primarily on log collection and alerting, a Next Generation SIEM goes further: it processes vast volumes of data in real time, identifies anomalous behavioral patterns, and enables automated threat responses, drastically reducing the average time to detect and respond.

This transformative approach is what shapes the future of SIEM, proactive cybersecurity designed to anticipate and mitigate attacks before they occur and impact business operations.

Components of Next Generation SIEM

A Next Generation SIEM is more than just a log and event management system, it’s an intelligent, integrated ecosystem for proactive security monitoring.

Key components include:

Data Collection and Normalization: gathers information from systems, applications, identities, cloud environments, and networks.

User Behavior Analytics: uses machine learning and User and Entity Behavior Analytics (UEBA) to detect anomalies and advanced patterns.

Event Correlation Engine: enriches events with third-party threat intelligence and operational context.

Integrated SOAR: automates responses, workflows, and playbooks to accelerate threat mitigation.

Visualization and Reporting: intuitive dashboards display attack timelines and insights aligned with security policies.
Scalable Cloud Architecture: Next Generation SIEMs integrate seamlessly with Cloud platforms, providing scalability and instant access to security insights without requiring complex hardware infrastructure.

This architecture supports a complete security cycle, from visibility to response, combining data science and security operations within a single platform.

Traditional SIEM vs Next Generation SIEM: what’s the difference?

Feature	Traditional SIEM	Next Gen SIEM
Data Analysis	Rule-based	AI/ML and behavioral analytics
Scalability	Limited, often On-Premises	Cloud-native and flexible
Detection	Reactive	Proactive and predictive
Automation	Manual or semi-automated	Full orchestration (SOAR)
Visibility	Partial and siloed	Unified, multi-environment

While legacy solutions focus on compliance and log management, Next Generation SIEMs address modern complexity with deep visibility into identities, Cloud environments, and user behavior, reducing “noise alerts” and focusing security resources on the highest-priority threats.

Benefits of Next Generation SIEM for SMEs

For small and medium-sized enterprises, adopting a Next Gen SIEM means closing critical gaps in defensive capabilities and response times:

Enhanced detection of advanced threats: AI and UEBA help identify sophisticated attacks before damage occurs.

Reduction of false positives: intelligent systems filter out noise, easing analysts’ workload and improving operational efficiency.

Automated responses: integrated SOAR allows mitigation and containment actions to run automatically, reducing average response time.

Compliance support: automated reporting and continuous visibility help SMEs stay aligned with regulations such as GDPR and NIS2.

Cost optimization: Cloud-native architectures allow businesses to pay only for what they use, avoiding heavy hardware investments.

Best Practices for Implementing a Next Generation SIEM

To fully leverage a Next Generation SIEM, it is essential to follow best practices:

Clearly define security objectives before implementation to align technology with operational priorities.

Integrate all relevant data sources, including cloud environments, endpoints, identities, and critical business applications.

Configure use cases and response playbooks based on realistic attack scenarios.

Continuously monitor and update AI/ML models to refine detection and reduce false positives.

Combine with SOAR and Threat Intelligence to maximize automation and contextual decision-making.

These steps help transform a SIEM from a simple log management tool into a predictive, operational security platform.

Future trends: AI challenges in SIEM

Looking ahead, AI and machine learning will remain a cornerstone of SIEM innovation. Emerging technologies will drive:

Predictive and contextual detection: systems capable of anticipating anomalous behaviors before they occur.

Increasingly sophisticated automation: enhanced SOAR capabilities with autonomous decision-making based on continuous learning.

Integration with XDR and Zero Trust security: SIEM merging with Extended Detection & Response and Zero Trust models for a fully integrated defense cycle.

Generative AI support: using generative models to simulate attack scenarios and improve automated playbooks.

These trends reflect the growing need for solutions that not only detect threats but also predict and autonomously adapt defenses.

SGBox: modular and scalable Next Generation SIEM & SOAR Platform

SGBox offers a next-generation platform designed to simplify ICT security management.

It integrates SIEM and SOAR capabilities into a single solution, combining advanced log collection and management, event correlation, in-depth analysis, and automated incident response.

Its modular design allows businesses to adapt the solution to their maturity level, while the scalable architecture ensures high performance even in Cloud and Multi-Tenant environments.

SGBox’s features help SMEs transform security management from an operational cost into a strategic asset, providing all the tools needed to protect data integrity and ensure business continuity against any cyber threat.

Discover the Platform>>

Zero Trust Security: what does it consist of?

SGBox — Mon, 02 Feb 2026 10:56:18 +0000

What does Zero Trust mean?

Zero Trust is a security framework based on the principle “never trust, always verify.”

According to this principle, access to corporate resources is strictly controlled and granted only after thorough verification of the identity and context of the user or device, applying security rules based on the principle of least privilege.

This modern approach continuously validates security configurations and postures to ensure strong protection against rapidly evolving threats.

In recent years, the Zero Trust framework has become the foundational paradigm for securing digital infrastructures.

By 2026, Gartner estimates that approximately 10% of large enterprises will adopt a mature program based on this security approach.

Why the Zero Trust model emerged

Historically, cybersecurity relied on a perimeter-based approach (the so-called castle-and-moat model): everything inside the corporate network was considered trustworthy. Today, this paradigm is no longer sustainable.

Cloud computing, SaaS applications, remote access, mobile devices, and OT environments have dissolved the traditional perimeter. Modern threats also exploit compromised credentials and lateral movement, making implicit trust ineffective.

The Zero Trust model was created precisely to address these new challenges, eliminating the concept of default trust and introducing continuous, context-aware controls.

How to build a Zero Trust architecture

To implement a Zero Trust architecture, it is essential to follow several key steps:

Identification and authentication: every user and device must be accurately identified. Using multi-factor authentication (MFA) is a fundamental practice to enhance security.

Network segmentation: dividing the network into micro-segments isolates resources and limits lateral movement in case of a breach.

Continuous monitoring: real-time activity monitoring helps detect abnormal behaviors and potential threats, enabling timely responses.

Granular access policies: defining who can access what, under which conditions, and for how long allows for more precise and dynamic controls.

When integrated into a unified framework, these measures create a secure and resilient environment capable of meeting the challenges of Zero Trust cybersecurity.

The fundamental principles of the Zero Trust model

A proper implementation of the Zero Trust model is based on several key principles that ensure strong enterprise security:

Continuous verification: every user, device, or application must be verified each time it connects to the network, regardless of previous access.

Least-privilege access: each user or system is granted only the minimum privileges necessary to perform their specific tasks.

Micro-segmentation: the network is divided into small, isolated segments to contain and limit the spread of a threat.

Identity-based security: identity becomes the new security perimeter.

Visibility and continuous monitoring: constant collection and analysis of logs and security events.

What are the benefits of the Zero Trust approach?

Adopting the Zero Trust strategy offers numerous advantages:

Reduced risk of breaches: rigorous controls and constant verifications limit unauthorized access and contain potential threats.

Greater visibility and control: continuous monitoring systems provide companies with a detailed view of data flows and activities within the network.

Flexibility and scalability: the Zero Trust architecture easily adapts to dynamic networks and cloud environments, simplifying security management in complex scenarios.

Protection of critical assets: network segmentation and granular access policies ensure that the most sensitive resources are always protected, reducing the impact of potential attacks.

Zero Trust and Regulatory Compliance

The Zero Trust model provides concrete support for compliance with regulations and security frameworks such as:

NIS2, by improving access control, logging, and incident management.
GDPR, by strengthening the protection of personal data.
NIST standards, ISO/IEC 27001, and international best practices.

Event traceability and centralized policy management make audits and compliance activities easier.

How the SGBox Platform Supports Zero Trust architecture

The SGBox platform is designed to integrate Zero Trust security principles simply and effectively.

With advanced monitoring, authentication, and segmentation solutions, SGBox allows companies to:

Implement dynamic access controls: the platform supports the adoption of role-based, context-aware, and behavior-based access policies, ensuring maximum security.

Integrate heterogeneous systems: SGBox offers a unified environment to manage and monitor all network components, facilitating the adoption of a Zero Trust model.

Respond quickly to threats: with real-time analysis and monitoring tools, the platform enables rapid intervention in case of anomalies, reducing the impact of potential attacks.

DISCOVER THE PLATFORM>>

The Key Cybersecurity Challenges for SMEs and Large Enterprises in 2026

SGBox — Thu, 08 Jan 2026 14:09:40 +0000

What are the main cybersecurity challenges in 2026?

Throughout 2026, both small and medium-sized enterprises (SMEs) and large organizations will face increasingly complex cybersecurity challenges.

These challenges are driven by the rapid evolution of digital threats, stringent regulations such as the NIS2 Directive, and a persistent shortage of internal resources.

Defining clear roles, processes, and countermeasures to anticipate threats and mitigate incidents must become a strategic asset around which business continuity is built.

Traditional tools are no longer sufficient: the question is no longer if an organization will be attacked, but when.

Let’s explore the key trends and challenges that companies will need to address over the course of this year.

Regulatory compliance

The NIS2 Directive imposes strict obligations regarding risk management, incident reporting within 24 hours, and supply chain security management, with penalties of up to 2% of global annual turnover for non-compliance.

Many SMEs, lacking dedicated IT teams, will struggle to carry out risk assessments and develop Disaster Recovery plans, exposing themselves to regulatory penalties and reputational damage.

The year 2026 marks the final deadlines for the Directive’s full implementation, with the October deadline requiring the adoption of risk management measures to ensure supply chain security.

Advanced AI-driven threats

The use of artificial intelligence by malicious actors represents a critical challenge. To mitigate these risks, it is essential to adopt multi-layered security measures and strategies capable of evolving in step with the growing complexity of emerging threats.

SMEs are a preferred target for cybercriminals due to their lack of internal expertise and technological resources able to detect threats within corporate IT infrastructures and respond effectively to incidents.

This makes AI a key element of the Cybersecurity Trends 2026, as its applications continue to expand and evolve, giving rise to increasingly sophisticated and dynamic threats.

How will the Zero Trust model evolve in 2026?

The “Zero Trust” security model is redefining corporate security strategies, based on the principle of “never trust, always verify.”

Its key elements include:

Continuous authentication: dynamic validation of users and devices.
Micro-segmentation: isolation of resources to limit the risk of lateral compromise.
Intelligent orchestration: integration of orchestration and automation components (SOAR) for managing multi-cloud and distributed environments.

Implementing this model requires not only technological innovation, but also a cultural shift, supported by adaptive policies and advanced monitoring tools.

Zero Trust architecture stands out among the Cybersecurity Trends 2026 as an essential approach to tackling increasingly sophisticated threats. Gartner predicts that 10% of large enterprises will implement well-defined Zero Trust programs.

IoT security: protecting complex ecosystems

The rapid proliferation of IoT devices introduces new vulnerabilities, making targeted security strategies essential:

Global standards: unified protocols to ensure interoperability and security.
Automated patch management: intelligent systems capable of detecting and fixing vulnerabilities in real time.
Edge computing protection: security solutions deployed at edge nodes to enhance network resilience.

The integration of IoT and AI will enable more efficient distributed control, optimizing operational costs and strengthening threat response.

Within the Cybersecurity Trends 2026, IoT confirms its role as a critical domain where security must be treated as a strategic priority.

SGBox’s SIEM & SOAR platform and Managed Services

Thanks to the modular and scalable features of its proprietary SIEM & SOAR platform, combined with the SOC as a Service offering provided by the dedicated CyberTrust 365 business unit, SGBox delivers tailored solutions to support your organization in building a robust strategy for comprehensive cybersecurity and compliance management.

In this unpredictable and dynamic landscape, we help companies overcome daily IT security challenges by providing a high level of support, specialized expertise, and continuously updated technologies.

Would you like to explore the features of our platform and related services in more detail?

CONTACT US FOR A FREE DEMO >>

Cyber Security in Italy: analysis of the Clusit 2025 Report and solutions for protecting SMEs

SGBox — Wed, 03 Dec 2025 15:28:19 +0000

The new update of the Clusit 2025 Report paints a picture of rapid evolution. While the world battles financial cybercrime, Italy faces an unprecedented wave of geopolitical activism.

In this article, we analyze the main data and how SGBox technology can support Italian SMEs in defending themselves against the most prevalent threats.

Cber Security in 2025: a rapidly evolving landscape

2025 is proving to be a disruptive year for information security. While 2024 already signaled a worrying increase in incidents, the first half of 2025 confirms and aggravates this trend, bringing to light new dynamics that directly impact the operational continuity of companies and Italian institutions.

The latest update of the Clusit Report leaves no doubt: the frequency and severity of attacks are constantly increasing, making cybersecurity no longer an option, but a fundamental pillar for business survival.

The most significant data from the Clusit Report (H1 2025)

Globally, the situation is critical. In the first half of 2025, 2.755 severe incidents were recorded, the highest number ever logged for a single semester, marking an increase of 36% compared to the previous semester.

It is not just a matter of quantity, but of quality and impact: 82% of the incidents analyzed had consequences of “Critical” or “High” severity.

This means that when an attack succeeds, the economic, reputational, and operational damages are almost always devastating.

Focus on Italy: a worrying anomaly

Italy continues to be in an uncomfortable position. Despite representing a minimal fraction of the world’s population, our country suffered 10.2% of the global attacks recorded in the first half of 2025.

However, what distinguishes Italy from the rest of the world is the nature of the attackers. While globally Cybercrime (driven by profit) dominates with 87% of incidents, in Italy, we are witnessing the overtake by Hacktivism. In our country, 54% of attacks are of activist/geopolitical matrix, versus 46% of cybercrime.

This peculiarity is reflected in the attack techniques:

DDoS (Distributed Denial of Service): this is the leading technique in Italy, used in 54% of cases (versus 9% globally), aimed at paralyzing services and creating visible disruptions.

Malware and Ransomware: although decreasing to 20% of the total in Italy, they remain a lethal threat to the integrity of company data.

Which sectors are most affected?

No sector can be considered safe, but 2025 has seen specific targeting of certain verticals:

Government & Military: this is the most affected sector in Italy (38% of the total), with a dizzying growth in incidents (+600% compared to the same period in 2024), driven by geopolitical tensions.

Transportation & Storage: rises to second place (17%), highlighting the fragility of supply chains and logistics.

Manufacturing: represents 13% of Italian incidents, confirming itself as a critical target due to the convergence between IT and OT and the value of intellectual property.

How SGBox responds to emerging threats

Faced with a scenario where DDoS attacks aim to halt operations and “Agentic” Artificial Intelligence begins to make threats more autonomous and sophisticated, Italian SMEs need total visibility into their infrastructure.

The SGBox platform offers a concrete and modular response to the critical issues highlighted by the Clusit Report:

Real-Time monitoring against DDoS: given the prevalence of DDoS attacks in Italy, SGBox’s ability to collect and correlate logs from different sources (firewalls, routers, servers) allows for real-time identification of traffic anomalies. This enables security teams to react promptly before the service is completely interrupted.

Defense against Malware and Ransomware: with 20% of Italian attacks still based on Malware, SGBox’s Event Correlation (SIEM) functionality is decisive. By analyzing suspicious patterns and correlating seemingly disconnected events, the platform can detect early signs of anomalies and automatically generate security alerts.

User Behavior Analytics (UEBA) for Agentic AI: the new threats based on Agentic AI operate autonomously and adaptively. The SGBox UEBA module analyzes the behavior of users and entities: if an account or a process begins to behave abnormally (e.g., accesses at strange hours, data exfiltration), the system signals it, regardless of whether the attacker is human or an AI-guided bot.

NIS2 Compliance and reporting: with the consolidation of the requirements imposed by the NIS2 Directive, risk management and incident notification become mandatory for many companies in the Supply Chain (Manufacturing, Transport). SGBox simplifies compliance by centralizing logs and generating advanced reporting ready for audits, reducing the bureaucratic burden.

Future prospects

The analysis of the Clusit 2025 report suggests that uncertainty is the “new normal”.

The gap between the offensive capability of attackers and the defense of companies is widening, and for the coming year, we expect the use of Artificial Intelligence in attacks to become increasingly pervasive and “underground,” making threats less evident but more insidious.

The challenge for Italian SMEs is not just technological but also cultural: it is necessary to move from a reactive approach to a proactive one, through well-defined security strategies and technologies capable of promptly detecting and responding to new cyber threats.

SGBox is committed to remaining at the forefront of cyber threat evolution, continuously developing new features and updating its solutions to guarantee the maximum level of protection to its customers.

To find out how SGBox can help your organization build a solid cybersecurity strategy, contact us for a personalized consultation.

PROTECT YOUR COMPANY>>

11 ways to optimize logging costs

SGBox — Mon, 17 Nov 2025 13:06:22 +0000

How can you optimize log-related costs?

In an increasingly data-driven world marked by constantly evolving threats, efficiently managing logs becomes a key strategic lever: it’s not just about controlling costs, but about ensuring operational visibility, security, and compliance without unnecessary expenses.

Adopting a Log Management platform allows you to achieve the right balance between visibility into security data across IT (Information Technology) and OT (Operational Technology) environments, while reducing overall costs.

Here’s how, together with SGBox, you can turn log management into an efficient process that creates a competitive advantage in terms of security and compliance.

1 – Define log retention policies

Keeping every generated event may seem like a cautious choice, but it often results in unnecessary expenses. Logs must be segmented by importance (critical / operational / less relevant) and assigned appropriate retention periods.

SGBox helps companies map log flows, define retention policies aligned with regulatory requirements (e.g., GDPR, NIS2), and automate archiving or deletion at the end of the useful lifecycle.

2 – Filter based on log level

Not all logs have the same value, meaning some are redundant and unnecessary for initiating security activities. Irrelevant, low-value logs should be reduced, as they can negatively impact SOC team operations.

SGBox supports the configuration and monitoring of log levels in complex environments, helping filter out priority alerts that are truly useful for security operations and audits.

3 – Use log compression

The volume of collected logs can grow quickly and disproportionately. Applying compression techniques reduces storage space and transfer costs without compromising accessibility.

SGBox offers integrated solutions for log compression and archiving, ensuring that data remains available for analysis while occupying fewer resources.

4 – Centralize Log Management

When logs originate from multiple applications, microservices, and regions, spreading them out makes analysis, correlation, and cost-control significantly harder. A centralized platform provides visibility, aggregation, and control.

SGBox delivers an advanced Log Management and SIEM platform that centralizes logs and security events, streamlines analysis procedures, and optimizes storage and access, reducing duplication and inefficiencies.

5 – Monitor and control log ingestion

Controlling which logs are ingested avoids allocating financial and technological resources to store unnecessary data. It’s important to set thresholds, control metrics, and anomaly alerts for log ingestion.

With SGBox, you can define automatic rules and alerts for log ingestion, exclude irrelevant traffic, and act quickly in the event of unexpected variations or spikes.

6 – Analyze data before archiving

Not all data deserves long-term storage. Enrichment and normalization at the point of entry allow filtering, aggregation, and transforming logs into more useful and compact formats, reducing costs and improving analysis quality.

SGBox supports data-enrichment pipelines, log transformation, and intelligent filtering so that only data truly needed for security, auditing, and actionable SIEM inputs is retained, optimizing threat detection performance.

7 – Use Tiered storage

Not all logs require the same level of accessibility: recent logs are consulted frequently, while historical logs are typically used only for audits or compliance. Using lower-cost storage tiers (cold, deep-archive) leads to significant savings.

With SGBox, you can define automatic policies that move logs across tiers (hot → warm → cold) based on usage, ensuring fast access where needed and more economical storage elsewhere.

8 – Automate Data Lifecycle Management

Manual interventions and sporadic actions lead to errors, hidden costs, or unnecessary data retained for too long. Automating the entire lifecycle, from collection, to tier transitions, to deletion, is essential.

SGBox integrates automation features for lifecycle management: automatic log transitions, scheduled expiration and deletion, all in line with internal policies and applicable regulations.

9 – Optimize indexing strategies

In log search engines indexing determines both cost and performance. Poor choices inflate costs.

SGBox supports companies in designing efficient log-search architectures: optimized mappings, shard/replica management, index rollover policies, and snapshot & archiving strategies that reduce costs and improve response times.

10 – Use cost governance tools

Understanding where money is spent, forecasting increases, and setting budget thresholds help maintain control over logging-related expenses. Dashboards, reports, and alerts are essential.

SGBox offers economic visibility across the entire log stack: dedicated reporting, cost driver analysis, alerts, and support for defining operational budgets, avoiding unexpected billing surprises.

11 – Apply log sampling

In high-volume environments (IoT, microservices, heavy traffic), recording every event can become prohibitive. Sampling consists of storing only a selected percentage of less-critical events while maintaining visibility into errors and anomalies.

SGBox helps define structured sampling policies: clear criteria (errors, security events, user behavior), dedicated flows for critical and non-critical events, and continuous monitoring of sampling effectiveness.

Discover SGBox Log Management >>

The role of SIEM in producing and managing security audits for regulatory compliance

SGBox — Wed, 15 Oct 2025 10:35:19 +0000

In a context where cybersecurity regulations are becoming increasingly stringent, ensuring compliance is no longer just a legal obligation, it’s a fundamental requirement for maintaining the trust of clients and partners.

Tools such as SIEM (Security Information and Event Management) play a crucial role in this process, enabling organizations to monitor, record, and analyze system activities to demonstrate their adherence to key regulations, including NIS2 and GDPR.

How SIEM enables regulatory compliance

Cybersecurity regulations like the NIS2 Directive, GDPR, and ISO 27001 standards require organizations to adopt appropriate technical and organizational measures to ensure data protection and effective incident management.

However, the real challenge for many companies lies in proving compliance, documenting every monitoring, analysis, and response activity.

This is where SIEM comes into play.

A SIEM system collects and correlates logs from all corporate devices and systems,such as firewalls, servers, endpoints, applications, and IoT devices, providing a comprehensive, real-time view of the organization’s security posture.

Thanks to its automated correlation and behavioral analysis capabilities, SIEM helps identify suspicious events, intrusion attempts, or data breaches.

More importantly, it records every activity in a structured and verifiable manner, ensuring the traceability required to meet audit and compliance obligations.

In practice, SIEM allows organizations to:

Centralize log collection and maintain logs in an unalterable format, as required by the GDPR.
Track and document access, changes, and security incidents.
Demonstrate the ability to promptly detect and respond to threats, as mandated by NIS2.
Automate the production of compliance reports according to predefined standards.

Security reports and audits

One of the main advantages of a Next-Generation SIEM system is its ability to automatically generate detailed and customizable security reports.

These reports are an essential resource for both internal and external audits, clearly demonstrating compliance with relevant regulations.

A security audit is an in-depth evaluation of an organization’s IT infrastructure and security practices, designed to identify existing vulnerabilities before they can be exploited by cybercriminals.

SIEM-generated reports may include:
Statistics on detected security events.
A timeline of incidents and corresponding responses.
Vulnerability analyses and attack trend assessments.
Comparisons between current security levels and regulatory requirements.

By automating reporting, SIEM reduces the workload of SOC teams, minimizes the risk of human error, and ensures the consistency and reliability of data over time.

During a security audit, having up-to-date and verifiable reports makes it easier to demonstrate to regulators that security controls are in place and that monitoring processes are actively maintained.

The importance of conducting periodic security audits

Performing periodic security audits is one of the best practices for maintaining compliance and ensuring an organization’s cyber resilience.

Audits help verify that security controls are effective, up to date, and aligned with current regulations.

Without appropriate tools, collecting and analyzing the data required for an audit can be a lengthy and complex process.

A SIEM system simplifies and accelerates this process by allowing organizations to:

Automatically analyze system logs and detect abnormal behavior.
Highlight potential risk or non-compliance areas.
Demonstrate continuous monitoring and timely corrective actions.

Conducting regular audits with the support of a SIEM transforms compliance from a mere obligation into an opportunity, enhancing not only security but also corporate transparency and governance.

SGBox and regulatory compliance

SGBox is a Next-Generation SIEM & SOAR platform designed to simplify security and compliance management for organizations of all sizes and industries.

Thanks to its modular architecture and advanced log management capabilities, SGBox enables organizations to:

Collect, normalize, and store security logs in full regulatory compliance.
Automate the generation of compliance reports for standards such as GDPR, NIS2, ISO 27001, and PCI-DSS.
Correlate security events and orchestrate incident responses (SOAR functionality).
Easily integrate new data sources and security modules to accommodate infrastructure growth.

In addition, SGBox offers intuitive, customizable dashboards that give IT Managers, CISOs, and DPOs a clear, real-time overview of security and compliance status, facilitating collaboration between technical teams and corporate management.

DISCOVER SGBOX SIEM>>

New threats (Ransomware and AI): defending with an advanced SIEM

SGBox — Tue, 02 Sep 2025 07:12:17 +0000

The current context: Ransomware and emerging AI threats

In recent years, Ransomware has become increasingly sophisticated and widespread. The rise of the Ransomware-as-a-Service model has enabled even criminals with limited skills to launch complex attacks.

In Italy, ransomware continues to rank among the most impactful threats during the first half of 2025, with a total of 91 attacks (compared to 92 in the first half of 2024). The most significant cases of the semester targeted a university, a hospital diagnostic lab, and several digital service providers for public administration. (Source: ACN Operational Summary).

The development of AI gives attackers new opportunities to create sophisticated threats that are becoming more frequent, adaptive, and difficult for traditional defense systems to detect.

This scenario makes intelligent and responsive security tools essential.

Challenges for SMEs, IT Managers, CISOs, and DPOs

Small and medium-sized businesses often lack dedicated security teams or large budgets. In this context, IT Managers, CISOs, DPOs, and Account Managers seek clear, effective, and ready-to-use solutions that ensure protection, business continuity, and regulatory compliance.

Why the adoption of an advanced SIEM is essential

A Next Generation SIEM leverages advanced contextual and behavioral data to detect subtle anomalies such as zero-day threats or unusual user behavior—issues that traditional defense systems often miss.

This enables the detection of silent attacks at their earliest stages, reducing response times and allowing the implementation of countermeasures to minimize damage.

Automation and Rapid Response

Modern SIEM solutions incorporate advanced correlation engines that proactively identify threat signals and trigger automated responses.

Centralization, continuous Monitoring, and Compliance

Advanced SIEMs centralize logs and events from multiple systems, enabling continuous monitoring and the creation of reports for security audits and compliance with GDPR, ISO 27001, or PCI DSS.

This streamlines operations and helps DPOs address regulatory requirements.

How SGBox’s Next Generation SIEM makes the difference

Modular, Scalable, and Cloud-Native Architecture

SGBox offers a Next Generation SIEM & SOAR Platform with a modular and distributed architecture, adaptable to the needs of both SMEs and large enterprises.

The Cloud SIEM version eliminates hardware and maintenance costs, offering automatic updates, customized integrations with existing infrastructures, and continuous monitoring.

In-Depth analysis, Threat Intelligence, and integrated SOAR

The SGBox platform includes a powerful correlation engine, Threat Intelligence capabilities for proactive analysis, and automated incident responses through its integrated SOAR component, which significantly reduces average detection and response times.

This allows IT Managers and CISOs to focus on priority threats, supported by intuitive dashboards and reports, achieving greater effectiveness in incident management.

Practical benefits of SGBox SIEM for businesses and Public Administration

Operational efficiency, thanks to automation that reduces workload and complexity.
Cost reduction, especially with the SaaS model, avoiding infrastructure investments.
Strategic support, with continuous monitoring, aggregated visibility, and compliance support.
Faster response times, powered by the SOAR engine, which shortens containment phases.