Industry and Energy: Sophisticated phishing techniques likely using AI tools Energy is an extremely critical sector due to its high number of dependent services. The likelihood of the energy sector being targeted increased in 2023 as a result of the ongoing conflict in Ukraine and the European Union’s efforts to shift towards importing energy products from other markets (e.g., Norway, USA, Azerbaijan, and Persian Gulf countries). The Czech water sector also faced cyberattacks last year following escalation of the Israeli-Palestinian conflict. Pro-Iranian actor targeted entities that use Unitronics devices Over the past year, several entities in the water sector were targeted by a pro-Iranian group as part of a global campaign against users of devices produced by the Israeli company Unitronics. Although operation of these devices has not been significantly compromised, the attacks illustrate how Czech entities can be affected by international conflicts. The energy and industrial sectors also differ from other sectors in their level of satisfaction with cybersecurity budgets. Approximately 63 % of respondents from the energy and industrial sectors are satisfied with their cybersecurity budgets, with more than 60 % planning to increase their budget next year. In contrast, only 43 % of respondents in other sectors reported satisfaction with their cybersecurity budgets, with around half expecting a budget increase (Fig. 19). In 2023, 63 % of the surveyed organisations from the energy and industrial sectors faced attempted cyberattacks. Although phishing has long been the most prevalent attack method, a new trend observed was an increase in the sophistication of these attacks, similar to those seen in the financial sector. Respondents attributed the trustworthiness and sophistication of the phishing emails to the use of AI tools. However, less than half of the surveyed organisations in the energy and industry sectors conducted simulated phishing campaigns in 2023, with 35 % not testing resilience against cyber threats at all. This situation may be related to the respondents’ perceptions of the severity of these attacks as minor. However, phishing is often the initial vector for cyberattacks. Satisfaction with the allocated cybersecurity budget, comparison of the energy and industry sectors vs. average (% of respondents) 37 % No 43 % Yes 63 % Yes Energy and industrial sector Figure 19 57 % No Cross-sector average 33