Cybersecurity as an engine of digital entrepreneurship

Informatec Digital » Resources » Cybersecurity as an engine of digital entrepreneurship

Talking about entrepreneurship today without addressing cybersecurity and privacy is incomplete. In an environment where businesses are connected, automated, and cloud-based, the ability to continue operating normally in a digital world fraught with risks has become a competitive advantage as powerful as it is difficult to measure. When everything is running smoothly, no one thinks about security; but the day something goes wrong, everyone looks in that direction.

This paradox explains why cybersecurity is often perceived as an expense rather than what it truly is: a direct driver of growth, innovation, and business opportunities . Startups and SMEs that understand this from the outset can move faster, gain the trust of customers and investors, comply with increasingly demanding regulations, and take advantage of public programs that are injecting hundreds of millions of euros into the cybersecurity entrepreneurial ecosystem in Spain.

Cybersecurity as a silent competitive advantage

In many organizations, when security is working, seemingly nothing headline-worthy happens . Systems continue to run, teams sell, produce, or serve customers as usual, and everything feels like it's running smoothly. This normalcy is precisely the true success of cybersecurity: a chain of processes, controls, and decisions that prevent technical incidents from escalating into business crises.

The problem arises when the investment is justified to management by arguing, "Look at the disaster that didn't happen." This way of measuring the value of security forces us to talk about hypothetical negative scenarios and avoided losses that never materialize, making it difficult to compete for funding against departments that can demonstrate sales, new clients, or product launches.

Furthermore, this approach fosters a dangerous bias: if a company has survived for years with low investment in security, some executives conclude that “enough is enough.” However, cybersecurity risks have a long and fat tail : years can pass without serious incidents… until a single attack has a devastating, even existential, impact on the business.

The key lies in reframing the question. Instead of “how do we prove that nothing bad has happened?”, it’s more useful to ask “ what does cybersecurity allow us to do that we otherwise couldn’t? ” This brings up tangible benefits such as entering new, highly regulated markets, signing contracts with major clients that demand strict standards, ensuring business continuity, or gaining a competitive edge over less protected rivals.

From this perspective, security ceases to be a hindrance and becomes an enabler: a necessary condition for innovating, scaling, and taking controlled business risks . It's not just about avoiding losses, but about maximizing the company's room for maneuver in a hostile environment.

Harsh reality: SMEs, startups and the cost of a cyberattack

Small organizations face a daily contradiction: they have the fewest resources to invest in protection, yet they also suffer the most direct impact from cyberattacks . The digitization of processes, online sales, cloud-based productivity tools, and connected ERPs has dramatically increased their attack surface, without always having a correspondingly robust security strategy in place.

The data is devastating: various studies indicate that in Spain, nearly 90% of companies were affected by some type of cyber threat in 2024. For an SME, the blow can be fatal: the average estimated cost of an attack is around €35.000, and approximately 60% of small businesses end up closing within six months of a serious incident. We're not just talking about ransomware attacks, but also data loss , production stoppages, service outages, and a breakdown in customer trust.

To make matters worse, attackers know that SMEs are easier targets than large corporations, which typically have dedicated teams, 24/7 SOCs, and more robust architectures. Thus, small businesses find themselves caught in the crossfire: they need to digitize to remain competitive , but this very digitization exposes them to a level of risk that many have yet to fully grasp.

In sectors such as agriculture and livestock, manufacturing, automotive, energy, and tourism—especially relevant in regions like Castile and León—digitalization has led to a leap in efficiency, traceability, and quality. However, the hyperconnectivity of machinery, IoT sensors , ERPs, and logistics systems also multiplies the vectors of attack. An incident not only entails economic losses but also damage to reputation, physical security, and even the supply chain.

Therefore, cybersecurity has become a fundamental requirement for business continuity, on par with liquidity or access to talent. Being prepared for an attack is no longer optional : it makes the difference between managing a crisis with limited damage and facing a scenario of closure, regulatory fines, and massive customer loss.

INCIBE: a national pillar for digital trust

In this context, Spain boasts a top-tier strategic asset: the National Cybersecurity Institute (INCIBE) , headquartered in Castile and León. This public entity, under the Ministry for Digital Transformation and Public Administration, has established itself as a national leader in the development of cybersecurity and digital trust for citizens, businesses, the academic community, and strategic sectors.

In 2023 alone, INCIBE handled more than 83.000 cybersecurity incidents , of which over 58.000 directly affected the public and more than 22.000 affected businesses (including SMEs, micro-enterprises, and the self-employed). This represents a 24% increase compared to the previous year and reflects the constant escalation of threats. In Castile and León, for example, security problems were detected on 185.265 devices, with Valladolid being the most affected province.

INCIBE's mission is clear: to build a safer and more reliable digital environment . To achieve this, it offers tools, resources, and services ranging from incident management (through INCIBE-CERT) to training programs , awareness campaigns, and expert advice. Its goal is for both businesses and individuals to integrate digital security into their daily lives, thereby reducing the likelihood of successful attacks.

A key element is the 017 Cybersecurity Helpline, a free and confidential national service available from 08:00 a.m. to 23:00 p.m., 365 days a year, aimed at citizens, businesses, professionals, minors, and their families . From basic inquiries to crisis situations, 017 acts as an accessible point of reference for any question or incident related to digital security.

Furthermore, INCIBE channels and implements numerous initiatives linked to the Recovery, Transformation and Resilience Plan (PRTR) , funded by Next Generation EU funds. These actions not only aim to reduce risks, but also to boost the cybersecurity industry, foster innovation, and strengthen the entrepreneurial ecosystem throughout Spain.

RETECH Cybersecurity: territorial networks and leading projects

One of the major public policy instruments in this area is the RETECH initiative (Territorial Networks of Technological Specialization) , framed within the Digital Spain 2026 Agenda. RETECH coordinates regional projects aimed at digital transformation, ensuring coordination and collaboration between autonomous communities, and focusing on areas such as artificial intelligence, enabling technologies, digital health, FashionTech, GreenTech, RuralTech, digital entrepreneurship and, of course, cybersecurity.

The Government has allocated over €530 million from the Recovery Plan to RETECH, promoting projects with high territorial and economic impact. Within this framework is RETECH Cybersecurity, a strategic initiative coordinated by INCIBE that will involve 17 autonomous communities, with a budget of €162 million. Its purpose is to comprehensively develop the Spanish cybersecurity ecosystem: capabilities, industry, R&D&I, and talent.

RETECH Cybersecurity is structured around six nodes, and Castilla y León actively participates in node 1 with a budget of €31,7 million. Within this framework, the region is promoting the ARGOS project, aimed at strengthening cybersecurity in key sectors such as smart mobility and the aerospace industry , and leading digital transformation processes in these high-value-added areas.

To implement these initiatives, an agreement has been signed between the Institute for Business Competitiveness of Castile and León (ICE) and INCIBE. The objective is to promote projects led by the region itself, with a real impact on the economy and industry, and to foster the exchange of knowledge and experiences with other regions , thus encouraging more balanced and cohesive development throughout the territory.

This structure will connect with the Spanish National Community through the European Cybersecurity Competence Centre, where INCIBE acts as the National Coordination Centre (NCC-ES). In this way, the capabilities developed in the territories are integrated into a broader European strategy , strengthening Spain's digital sovereignty and competitiveness on the international stage.

INCIBE Emprende: Boosting Entrepreneurship in Cybersecurity

Cybersecurity is also one of the sectors with the greatest potential for employment and growth in the coming years . According to the "Analysis and Diagnosis of Cybersecurity Talent in Spain," prepared by ONTSI and INCIBE, in 2021 there were 149.774 professionals dedicated to this field in Spain, with a talent gap of over 24.000 positions. The market reached almost €1.500 billion in 2020 and is estimated to reach €2.000 billion in 2024, with a compound annual growth rate of 8,12%.

This context has driven the creation of INCIBE Emprende , a specific program to support cybersecurity entrepreneurs and startups throughout the entire entrepreneurial cycle: from generating business ideas to incubation and acceleration. Between 2023 and 2026, INCIBE will work with 35 public and private entities to implement various initiatives that will help integrate these projects into the Spanish digital economy.

The program has a budget of €64 million and is part of the PRTR's National Cybersecurity Industry Development Program (component 15, investment 7). Its focus is on strengthening the cybersecurity capabilities of citizens, SMEs, and professionals, while fostering a robust business ecosystem capable of competing both domestically and internationally.

In the specific case of Castile and León, INCIBE Emprende has 17 collaborating entities and an investment exceeding 10 million euros . Furthermore, there is a well-established Alumni network, which brings together some of the most relevant cybersecurity startups on the national and international scene, creating a virtuous cycle of talent, funding, collaboration, and exchange of experiences.

For entrepreneurs, this translates into something very tangible: specialized support, access to mentors, training programs, visibility, and connections with clients and investors . In a sector as technical and regulated as cybersecurity, having this type of support can make the difference between remaining a good idea and becoming a viable and scalable company.

Acceleration programs: cybersecurity at the service of any startup

Beyond startups whose main product is cybersecurity itself, there is a growing need to support projects in any sector to integrate security from day one. An example of this is the Cybersecurity Acceleration program for startups designed by CEIN , with a 100% strategic and business-oriented approach, specifically designed for CEOs, regardless of their technical background.

This program selects a limited number of participants (up to a maximum of 10) and offers them an intensive itinerary that allows them to understand which risks are truly priorities in their case , anticipate the requirements of clients and investors, and avoid common mistakes that, in growth phases, often translate into technical overcosts, commercial delays, or lost opportunities.

The program begins with an individualized assessment in which each startup receives a comprehensive overview of its cybersecurity posture, conducted by an expert. This is followed by a week of intensive, hands-on group training focused on decisions that directly impact the business, customer relationships, and market demands.

The program is complemented by individual strategic mentoring sessions , aimed at translating decisions into concrete plans. For startups that already have an in-house technical team—or where the CEO is a technical expert—additional mentoring hours focused on implementation are offered, thus closing the loop between business vision and technical execution.

The ultimate goal is for participating companies to leave with clear priorities and a realistic roadmap , aligned with both their current situation and their growth strategy. It's not about turning every founder into a security expert, but rather about helping them understand where to focus their efforts, what to demand from suppliers, and how to demonstrate maturity to clients, partners, and investors.

Innovation, R&D&I and digital sovereignty in cybersecurity

Another key element for cybersecurity to drive entrepreneurship is a firm commitment to R&D&I and technological sovereignty . Cybercrime is an extremely lucrative business that invests aggressively in increasingly sophisticated attack techniques, tools, and models. To avoid always falling behind, it is essential to develop security solutions, services, and products that meet these challenges.

Relying exclusively on third-party or foreign technologies puts us in a vulnerable position, both from a market perspective and in terms of digital sovereignty. For this reason, INCIBE has launched public calls for proposals for the development of university chairs and strategic cybersecurity projects , with very clear objectives: to increase research capacity, stimulate the academic-business ecosystem, and generate cutting-edge solutions in areas such as artificial intelligence and quantum technologies applied to security.

The endowed chairs aim to enhance cybersecurity capabilities and resources within universities, companies, and technology centers, fostering knowledge transfer to the productive sector. They are, essentially, spaces where highly specialized talent is trained while addressing real-world market challenges. Strategic projects, meanwhile, seek to directly tackle some of the greatest scientific and technological challenges associated with digital security, promoting the practical application of the results.

These initiatives are part of the PRTR's Global Security Innovation Program , also under component 15. In total, 72 agreements have been signed with universities to develop 50 strategic projects and 22 endowed chairs, with a budget exceeding €60 million, of which INCIBE contributes 75% with European funds. In Castile and León, 15 agreements have been formalized with a budget exceeding €11 million.

For innovative startups and SMEs, this ecosystem represents a valuable talent pool, collaborative networks, and technology transfer opportunities. The gap between laboratory and market is narrowing , allowing new security solutions to reach end users faster and become globally competitive products.

Public Procurement of Innovation: Real Traction for Cyber ​​Solutions

Public Procurement of Innovation (PPI) has become a key driver for boosting competitiveness and innovation within public administrations. In the field of cybersecurity, INCIBE has developed the IECPI (Strategic Initiative for Public Procurement of Innovation), which uses public demand for products, services, and supplies as a tool to implement national digital security policies and directly support industry.

This initiative also falls within the framework of the PRTR's Global Security Innovation Program, specifically within the milestones aimed at " developing high value-added cybersecurity solutions and services ." In practice, this means that INCIBE and other public entities launch calls for proposals seeking innovative solutions to specific security problems, funding their development and validation in real-world environments.

Currently, four calls for proposals for Public-Private Partnerships (PPPs) are underway, with a total volume exceeding €248 million, of which INCIBE is co-investing more than €201 million. These initiatives have already resulted in 153 projects across Spain , 17 of them in Castile and León, with INCIBE contributing nearly €15 million.

For companies—especially technology-based firms and cybersecurity startups—public-private partnerships (PPPs) are a powerful traction tool: they not only provide funding but also a high-value public client with complex needs , real-world data, and the capacity to scale solutions to a large scale. Successfully completing a PPP project opens doors to new markets, strengthens the company's credibility, and provides valuable regulatory insights that are very difficult to obtain through other means.

In short, strategic public procurement in cybersecurity acts as a sophisticated demand driver that pushes companies to truly innovate, not just incrementally . And this competitive pressure, when properly channeled, generates products and services that can then compete successfully beyond our borders.

#INCIBEExperience: Cyber ​​culture for businesses and society

No cybersecurity strategy works if it ignores the human factor. That's why INCIBE has launched #ExperienciaINCIBE , a series of awareness , education, promotion, and outreach activities in cybersecurity that will travel across Spain for three years to strengthen trust in the use of digital technologies.

This experience is aimed at three main audiences: businesses and professionals, the general public, and children along with their families and schools. The most eye-catching format is a foldable roadshow truck that travels the country offering activities for all ages: escape rooms, online games, training sessions, a tent with large-format board and floor games, and a booth linked to the 017 information service.

The goal is for anyone to be able to experiment with cybersecurity in an accessible, practical, and fun way, learning to protect their digital identity, devices, and personal information. At events where INCIBE participates, a mobile modular stand is also set up with three distinct zones: information, demonstration and training, and gamification, with activities such as Kahoot!-style quizzes and micro-learning sessions.

Since its launch in 2023, #ExperienciaINCIBE has visited every province in Castile and León: León, Zamora, Salamanca, Palencia, Valladolid, Segovia, Burgos, Soria, and Ávila. This widespread reach is important because it allows cybersecurity awareness to be brought to rural areas and medium-sized cities , where there are also businesses, freelancers, educational centers, and citizens exposed to digital risks.

For SMEs and entrepreneurs, these initiatives represent an accessible opportunity to train their teams, raise employee awareness, and begin building a genuine cybersecurity culture without significant investment. And in the long run, this culture is one of the most valuable assets for reducing incidents and differentiating themselves as a reliable provider.

Cybersecurity as a catalyst for sustainable growth

In today's digital economy, cybersecurity has evolved from a purely technical element to a strategic driver of innovation, resilience, and competitive differentiation . Hyperconnectivity, the cloud, artificial intelligence, robotic process automation (RPA), and the Industrial Internet of Things have multiplied the attack surface, meaning that security is no longer an operating cost: it is an essential asset for meaningful innovation.

Digital transformation projects—migrations to multicloud architectures, DevSecOps environments, integration of AI into critical processes, adoption of Zero Trust, Confidential Computing, etc.—require that security be embedded from the design stage (Security by Design) and from the earliest phases of the development lifecycle (Shift Left Security) . Only in this way can extremely costly patchwork solutions be avoided later, in terms of time, money, and reputation.

Organizations that demonstrate maturity in cybersecurity and regulatory compliance (ISO 27001, NIS2, ENS, GDPR, DORA) gain a clear reputational and commercial advantage . In B2B and B2G markets, cybersecurity trust is now as important a selection criterion as price or quality. Contracts with major clients require evidence of security throughout the digital supply chain, independent audits, and risk-based governance models.

At the same time, leading companies are investing in intelligent defense automation, with platforms that combine SIEM, XDR, SOAR, AI, and cyber observability to detect, prioritize, and respond to incidents in near real time . This transforms security from a reactive and manual process into a dynamic system capable of learning, anticipating, and sustaining business continuity even in sophisticated attack scenarios.

All of this falls within a broader vision of cyber resilience , where the key is not so much preventing every incident (something impossible) as reducing detection, response, and recovery time, minimizing the financial and operational impact. Organizations that master this discipline not only suffer less, but can also afford to innovate more ambitiously, knowing that their security foundation and responsiveness have their backs.

Taken together, this entire constellation of public initiatives (INCIBE, RETECH, INCIBE Emprende, professorships, CPI, #ExperienciaINCIBE), advanced technological tools, and startup acceleration programs demonstrates that cybersecurity is no longer a hindrance or a mere mandatory cost, but a true engine of entrepreneurship and competitiveness : it allows businesses to open markets, attract investment, differentiate themselves to customers, create skilled jobs, and ultimately sustain a robust, reliable digital growth model aligned with the demands of the next decade.