ITBN Conf-Expo cybersecurity expert Turul Balogh, who is also chief information security and data protection officer at Tresorit, the one-time Hungarian startup that is now part of Swiss Post, tells the Budapest Business Journal why banks in Hungary generally operate at a higher regulated baseline, what audits examine and score, and how insurers assess risk.

BBJ: Who are the big players and main threats in financial-sector cybersecurity? Are we talking institutions, hacker groups, perhaps states?

Turul Balogh: I wouldn’t list specific companies, but I can talk about the landscape. Today, everything is organized along supply chains. A financial institution also sits in a supply chain: it creates value for its customers, and it has suppliers. Attackers try to reach the bank through that supply chain. EU and Hungarian lawmakers recognized this, which is why they introduced DORA and NIS2. These are EU-level frameworks that set out security processes to make banks cyber-resilient: security awareness, business continuity, incident handling, vulnerability testing, risk analysis, and so on. When we talk about “attacks,” we’re really talking about weaknesses in those processes. Vulnerability testing, for example, looks for flaws in the applications and systems a bank uses; it’s a cat-and-mouse game to find and fix them before attackers do. Banks operate day to day while plugging holes from many angles.

BBJ: How does that compare with other sectors in the EU?

TB: Banking is highly regulated and, across the EU, sits at a relatively solid defensive level. Because attacks require time and resources, adversaries focus on where defenses are weaker. That’s why many attacks shift toward other sectors. NIS2 now raises the bar across many industries, from food and logistics to waste management, that historically lacked uniform, robust protection. Attackers tend to target less protected companies, including many SMEs, which is why you see so many ransomware cases there.

BBJ: What is the relationship between NIS2 and DORA?

TB: You can see DORA as the NIS2-family rule specific to financial institutions. NIS2 applies broadly; DORA is the sectoral piece for finance.

BBJ: You’ve gone through these audits. What makes them hard, and what do auditors look at?

TB: With NIS2 in Hungary, there’s been a regulatory paradigm shift. After NIS2, Hungary had to decide how to adopt EU-level cybersecurity. There were existing laws, and the decision was to base everything on Act L of 2013 and build the changes on that. Member states chose different bases; some aligned to ISO 27000. In Hungary, the regulator took the NIST SP 800-53 (Rev. 5) framework as the foundation. That implies a different mindset and, many would say, a stricter approach with deeper, technical controls (protection system by system) compared to an ISO 27001-style, process-oriented, risk-tolerant model. Here, you can’t hand-wave; you have to implement what’s written into law.

At the legal level, there are multiple rules and requirement groups: privilege management, backup and disaster recovery, logging, incident handling, vulnerability testing, awareness training, and many more. There are hundreds of requirements, and each company must decide how it will comply. The law sets a strict frame, but management must define what really “hurts” for the business. For example, the law doesn’t specify exactly when a security event becomes an “incident” for you. You decide the thresholds: two days of a social page down, five days of a website outage, not being able to talk to customers for 10 days, or unable to send orders for 20; at what point is it critical? That differs by industry and company size.

A novelty of NIS2 is the number of sectors it brings into scope. Big organizations that were already regulated have established mechanisms; they’re under the same requirements as before. But newly in-scope SMEs in those sectors face a steeper climb to audit readiness. Firms on the official registry conduct the audits; you contract them, and from mid-next summer, they’ll run fairly comprehensive examinations. You get a score, the VMI (védelmi megfelelési index), that expresses your maturity. The goal is comparability: leadership doesn’t just get a long, hard-to-parse report; they see a number that can influence competition, procurement, and even marketing. Strong scores will be publicized; weaker ones probably won’t, at least at first.

BBJ: Some would say this all sounds bureaucratic. Does it really stop serious attacks?

TB: It depends on how the company approaches it and how targeted the attacker is. If someone truly prepares against a specific company, it’s hard. But these laws and standards are built on observed threats (techniques, tactics, and procedures adversaries use), and they ask the right questions: how would you withstand this or that? If you study the catalog and threat points, you can write playbooks and prepare. If a company treats it as paperwork or “just training,” it won’t help much. The law has been in force for a year; audits are only due next year, but attackers exfiltrate databases in seconds and sell them. Reviews occur every two years, while customer trust is constant. This isn’t about ticking a box; it’s about protecting the personal data of real people and operating “well,” which includes technical and privacy security, not only serving a consumer need. Companies that take this seriously will find competitive advantages; those that only push a few policies will struggle. The law is strict because the threats are at that level; it’s a solid professional package, but you can’t prepare for it in one or two months.

BBJ: How does this picture look in Hungary’s banking sector specifically?

TB: Financial institutions have long been well-regulated and at a high defensive level. The central bank continuously examines them and issues recommendations. There’s a lot of cross-industry cooperation and planning in the background to make controls effective. Banking here is a critical infrastructure, and it didn’t start building IT yesterday. The real challenges lie in other sectors and organizations that don’t yet grasp the weight of this.

BBJ: Does cyber insurance exist for these risks?

TB: Yes. Insurers expanded their offerings years ago to cover cyberattacks. The terms and conditions are long, and you must read exactly when they pay out, but in a mature market, transferring certain risks to an insurer is essential. A company can accept, mitigate with investment, or transfer a risk. Some risks you can’t directly address, so you insure. Pricing should be weighed against likely losses. We’ve seen cases where attacks caused huge financial impact and broader market effects: production stoppages, stock-market reactions, even state involvement to stabilize confidence. If two days of downtime equals 5-10% of annual revenue, a premium worth a fraction of that makes sense.

BBJ: Do financial institutions in Hungary typically buy these policies? And do insurers link coverage to audit results?

TB: Officially, you won’t know who bought what, but in the profession these policies are used, and in many places they’re effectively required. I don’t have a precise Hungarian count in my head, but it’s widespread. Insurers naturally prefer to cover organizations in better condition. They’ll ask for evidence (audit reports, perhaps supervisory materials from the central bank), and they do their own risk assessment. They assess capabilities in awareness, logging, incident handling, business continuity, disaster recovery, and more. If they see a prepared, responsive organization, coverage may be easier or cheaper. If a bank is a repeat offender on fines and non-compliance, coverage may be more complicated or more expensive. Insurers must price the likelihood and impact.

This article was first published in the Budapest Business Journal print issue of October 31, 2025.