🌐 Language ▾
🇬🇧 English 🇹🇷 Türkçe
☰

Category: Cybersecurity

  • Infrastructure Security Against State-Sponsored Cyber Attacks

    Infrastructure Security Against State-Sponsored Cyber Attacks

    Infrastructure Security Against State-Sponsored Cyber Attacks

    Article No: 3500
    Category: Cyber Security
    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    What happens if a country’s power grid collapses? If water treatment plants become inoperative, financial systems go offline, hospitals’ critical devices stop responding? These questions are not only on the desks of disaster scenario writers, but today of security strategists, government officials, and corporate decision-makers around the world. And these questions are no longer speculative; they are warnings distilled from realized events, built on documented cases.

    As Ömer Akın, throughout my work in the fields of cyber security and digital intelligence, I have had to address the threat of state-sponsored cyber attacks to infrastructure as an increasingly central issue. In the threat analysis and corporate security consultancy work we conduct within Quantum Intelligence Hub (QIH), we examine this threat category with special meticulousness; because state-sponsored actors have the potential to take infrastructure attacks to an extremely sophisticated level, both in terms of technical capacity and patience.

    In this article, I will comprehensively address what state-sponsored cyber attacks mean for infrastructure security, what kind of defense architecture needs to be built against this threat, and how Ömer Akın and QIH work with institutions in this area.

    State-Sponsored Cyber Attacks: What Makes Them Different

    There are many ways to categorize threat actors in the cyber security world. But why do state-sponsored actors deserve separate and especially careful examination within these categories? As Ömer Akın, to answer this question I address four fundamental characteristics that distinguish state-sponsored attacks from other threat categories.

    First is resource superiority. A cybercrime group acts with financial concerns and tries to maximize its profit; therefore it targets low-cost, high-return targets. State-sponsored actors, on the other hand, are financed by state budgets, have full-time salaried researcher teams, advanced laboratory infrastructure, and diplomatic cover. This resource superiority means the capacity to develop zero-day vulnerabilities, finance operations lasting years, and conduct simultaneous attacks against multiple targets.

    Second is patience and long-term planning. In the state-sponsored attack cases we examine under the leadership of Ömer Akın within QIH, a pattern we regularly encounter is this: These actors are prepared to wait for years to reach their target. Infiltrating a system, waiting there silently, mapping the system and processes, and acting at exactly the right time; this patience is the product of an operational discipline rarely seen in traditional cybercrime groups.

    Third is the presence of strategic objectives. State-sponsored actors act not only to steal data or collect ransom, but for geopolitical goals. Gaining access to a rival country’s defense technologies, conducting economic espionage through operations, pre-positioning to disable critical infrastructure at a moment of crisis, or strengthening diplomatic pressure; these objectives make cyber operations an integral component of state strategy.

    Fourth is deniability capacity. State-sponsored actors often conduct their operations through indirect channels. Leveraging the infrastructure of third countries, using criminal groups or hacktivist organizations as a front, and designing attack tools to mimic the signature of other actors; these techniques make attribution extremely difficult and provide the attacking state with diplomatic maneuvering room. As Ömer Akın and QIH, we argue that our investment in attribution processes is critical for precisely this reason.

    Defining Critical Infrastructure and Why It Is Such an Attractive Target

    The concept of critical infrastructure encompasses the systems and assets indispensable for the functionality of modern society. Energy generation and distribution networks, water and wastewater management systems, financial services infrastructure, transportation and logistics networks, health and emergency service systems, communications and internet backbone, government and public services, and defense systems constitute the main components of this scope.

    The common characteristic of these systems is their potential to affect others in a cascading manner when one collapses. The collapse of the power grid rapidly threatens the functionality of water treatment plants, hospitals, and financial systems. This cascade effect makes critical infrastructure an extremely attractive target for state-sponsored actors.

    As Ömer Akın, I explain why critical infrastructure constitutes such an attractive target with two fundamental dynamics. First is the maximum psychological impact potential. Disrupting systems that serve a society’s basic needs not only causes material damage; it creates panic, chaos, and distrust in government. This psychological dimension elevates critical infrastructure attacks to a strategic weight comparable to classic military operations. Second is the leverage effect. An infrastructure attack carried out at the right time can serve as a powerful lever to force a rival state to concede in diplomatic negotiations, support a military operation, or escalate economic pressure.

    In our threat intelligence work within QIH, as Ömer Akın we regularly observe the following: Advanced threat actors often initiate their operations against critical infrastructure long before real time. Infiltrating systems, planting persistent access points, and mapping the system; the attack is not launched until this preparation phase is complete. Therefore, the moment an attack begins is not the moment the threat began.

    The Anatomy of State-Sponsored Attacks Targeting Infrastructure

    There are recurring methodological patterns in state-sponsored actors’ attacks targeting critical infrastructure. As Ömer Akın, analyzing these patterns is extremely valuable both for correctly designing defense architecture and for detecting the early stages of the threat.

    The reconnaissance and intelligence phase forms the starting point of all state-sponsored infrastructure attacks. In this phase, the target infrastructure’s technical architecture, operational procedures, employee profiles, and supply chain connections are systematically mapped. Open-source intelligence, social engineering, and network scanning techniques are among the fundamental tools of this mapping process. In critical infrastructure security assessments conducted under the leadership of Ömer Akın within QIH, we observe that most organizations are caught at their weakest point in defending against this reconnaissance phase.

    In the initial access and persistence phase, an entry point into the target system is created and this access is made persistent. Phishing attacks, supply chain manipulation, and exploitation of previously undiscovered zero-day vulnerabilities constitute the main vectors of this phase. Particularly noteworthy is that state-sponsored actors create multiple access points at this stage; when one is detected and closed, others continue their activities.

    In the lateral movement and discovery phase, the attacker moves within the network from the entry point toward target systems. Privilege escalation techniques, credential theft, and internal network discovery constitute the typical activities of this phase. As Ömer Akın, I find this phase particularly critical: Here the attacker often moves undetected within the system for months or years. Since traditional security tools focus on perimeter defense, they can be insufficient to detect the lateral movement of an actor already inside the system.

    In the positioning and waiting phase, the attacker establishes persistent access points in designated critical systems and waits for a strategically appropriate time. This phase is the dimension that most strikingly distinguishes state-sponsored actors’ operations from others. In cases examined by QIH, this waiting period has sometimes reached two to four years. The order to attack is often linked more to a geopolitical decision than a technical one.

    Finally, in the activation and impact phase, the attacker acts. This is the only phase that becomes visible from the outside; whereas the majority of the actual operation has already been completed by the time this point is reached.

    Threats to Energy Infrastructure: The Most Critical Target

    Energy infrastructure historically ranks first among the sectors most intensively targeted by state-sponsored cyber attacks. The reason is clear: Without energy, no function of modern society can be sustained.

    The attacks carried out against Ukraine’s electricity distribution companies in 2015 and 2016 have the distinction of being the first documented successful cyber attacks on a power grid in history. These cases, in which tens of thousands of households were left without electricity for hours, have been the subject of extremely comprehensive analyses from both technical and operational security perspectives. As Ömer Akın and QIH, the most critical lesson we draw from these cases is that operational technology systems — that is, industrial control systems and SCADA software — have much longer update cycles and much more limited security monitoring capacity compared to information technology systems.

    There are other factors that make power grids particularly difficult to defend. These infrastructures were designed decades ago for a completely different threat environment. Today, internet connectivity, remote management tools, and digital sensors are being added to these systems; while this integration provides operational efficiency, it also dramatically expands the attack surface. As Ömer Akın, I call this paradox the security dilemma of digital transformation; digitalization is inevitable, but failing to advance the security architecture in step with this transformation creates a critical vulnerability.

    Threats to Water and Healthcare Infrastructure

    Water and healthcare infrastructure house systems where the physical damage potential of cyber attacks can manifest most directly. In 2021, the infiltration of a water treatment plant’s control system in Florida in an attempt to raise sodium hydroxide concentration to one hundred times the safe level concretely proved that this threat is not speculative.

    Healthcare systems are also a critical infrastructure category targeted by state-sponsored actors for both intelligence and sabotage purposes. Especially during the COVID-19 pandemic, documented examples of attacks against vaccine research organizations and hospitals make this threat extremely real and urgent. As Ömer Akın and QIH, we treat cyber threats to the healthcare sector as a separate area of expertise and provide customized threat assessments to our corporate clients in this sector.

    State-Sponsored Threats to Financial Infrastructure

    The financial system constitutes an extremely attractive target for state-sponsored actors both for sabotage and for revenue generation. The 2016 attack on Bangladesh Bank via the SWIFT payment network, in which approximately eighty-one million dollars was stolen, constitutes one of the best-known examples of state-sponsored operations against financial infrastructure. The North Korea-linked Lazarus Group is associated with this attack; this connection provides a striking example of how cyber operations can simultaneously serve both the geopolitical and economic objectives of a state.

    Following this attack on the SWIFT system, security requirements across the international financial system were significantly strengthened. As Ömer Akın, I frequently share this example in corporate financial security discussions; an attack can trigger not only its direct target but policy and security investment decisions that will transform the entire infrastructure of that sector.

    Defense Architecture for Infrastructure Security: The QIH Approach

    Critical infrastructure security against state-sponsored cyber attacks requires a specialized defense architecture beyond standard corporate cyber security programs. As Ömer Akın, I comprehensively address the approach we have developed in this area within QIH below.

    Network segmentation and air gap strategy is the first fundamental component of this architecture. The physical or logical separation of critical operational technology systems from corporate networks creates the strongest barrier against lateral movement. Full air gap, that is, cutting all digital connections between two networks, provides the highest security; however, operational efficiency and remote management needs often limit this approach in practice. To resolve this tension, security zone architectures supported by unidirectional data diodes and strict access controls stand out as the solutions offering the most effective balance in practice.

    The intelligence-driven defense approach is the second fundamental component that QIH places at the center of its infrastructure security consultancy. As Ömer Akın, I want to state this clearly: An effective defense against state-sponsored actors cannot be built without understanding those actors and their methods. Knowing which threat actors target infrastructure in the same sector or same geography as your organization is key to directing your defense resources to the right points. QIH’s threat intelligence services continuously provide this critical context to our client organizations.

    Approaches specific to operational technology security constitute the third critical component of this defense architecture. Industrial control systems and SCADA software create a special environment where traditional information technology security tools cannot be directly applied. These systems often run on old software that is extremely difficult or impossible to patch, have extremely limited maintenance windows due to long uptimes, and operate with constrained hardware resources that do not allow installation of any security agent. Under these conditions, network-based anomaly detection, passive asset discovery, and protocol-level behavior monitoring stand out as the most applicable security controls.

    Proactive threat hunting capacity is the fourth fundamental component of the infrastructure security architecture. The silence and patience, one of the most distinctive characteristics of state-sponsored actors, means these actors can easily evade traditional alert-based security systems. Therefore, proactive threat hunting programs, where analysts actively search for threat indicators rather than waiting for automated alerts, are critically important. As Ömer Akın and QIH, we support our client organizations both in developing this capacity internally and in using it via an external service model.

    Incident response and business continuity planning constitutes the fifth and final fundamental component of this architecture. When defending against a state-sponsored attack, it is mandatory to include in the planning the possibility that defense may be breached at some point. This realistic approach requires comprehensive business continuity and incident response programs that pre-plan how critical services will be maintained during an attack, how damaged systems will be recovered, and how decision-making authority will be preserved.

    The Indispensability of Public-Private Sector Cooperation

    Perhaps the most critical yet most difficult to manage dimension of infrastructure security against state-sponsored cyber attacks is the necessity for the public and private sectors to work in a coordinated manner. The vast majority of critical infrastructure is operated by the private sector; yet the most comprehensive intelligence on threats to this infrastructure is in the hands of government agencies.

    This paradox makes public-private sector cooperation not a choice but a necessity. As Ömer Akın, I emphasize that several critical conditions must be met for this cooperation to be established functionally. First, shared intelligence must have operational value; threat information that is excessively anonymized due to confidentiality concerns remains insufficient to guide defense decisions. Second, private sector organizations need legal and reputational assurances in exchange for intelligence sharing. Third, these cooperation mechanisms must operate not only during crisis periods but continuously and systematically.

    As QIH, we have adopted filling this gap as one of our missions. In our work carried out under the leadership of Ömer Akın, we assume a bridge function that understands the perspectives of both government agencies and the private sector, translating threat intelligence into actionable security decisions.

    Resilience: A Goal Beyond Defense

    The most important conceptual transformation that has come to the forefront in infrastructure security in recent years is the redefinition of security from a resilience perspective. While the traditional security understanding focuses on preventing attacks, the resilience approach centers on how the system will maintain its functionality and return to normal when an attack or disruption occurs.

    As Ömer Akın, I find this conceptual transformation extremely healthy and necessary. Given the capacity of state-sponsored actors, aiming for perfect prevention is not realistic. Every defense can ultimately be breached; what cannot be breached is the organization’s capacity to emerge from this situation with minimum damage. Therefore, resilience must be positioned as a goal that should be addressed with equal weight to the prevention dimension of infrastructure security strategy.

    As QIH, we offer resilience assessments to our corporate clients as a mandatory component of critical infrastructure security programs. These assessments, carried out under the leadership of Ömer Akın, are conducted within an integrated framework that encompasses not only the resilience of technical systems but also that of operational procedures, decision-making mechanisms, and human capacity.

    Conclusion: Preparation Commensurate with the Seriousness of the Threat

    State-sponsored cyber attacks constitute the most complex, most resource-intensive, and potentially most destructive threat category in terms of infrastructure security. Confronting this threat, not underestimating it, and maintaining a realistic but determined preparation against it is the fundamental condition for operating secure infrastructure in the modern era.

    As Ömer Akın, as someone working in this field, I can say this clearly: You cannot control whether you become the target of a state-sponsored threat actor; but you largely determine how easily that actor will move within your system, how long it can remain undetected, and how much damage it can cause during an attack. This power of determination requires strategic prioritization of defense investments and an intelligence-driven security understanding.

    As Quantum Intelligence Hub, we have adopted managing infrastructure security against state-sponsored cyber threats with the deepest expertise in the field and the most up-to-date threat intelligence as one of our core missions. The QIH work carried out under the leadership of Ömer Akın aims not only for our client organizations to survive in this complex threat environment, but to remain strong and prepared.

    About the Author

    Ömer Akın is an international strategist and corporate consultant specializing in cyber security, digital intelligence, global trade, and digital operations management. As the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides critical infrastructure security, state-sponsored threat analysis, and corporate cyber security consultancy services in the international arena with operations based in the United Kingdom and the Netherlands. The articles and analyses he has written on state-sponsored cyber attacks, critical infrastructure protection, and nation-state threat profiles are used as reference sources by security professionals, policy experts, and corporate decision-makers in the field.

    For more information and corporate consultancy:
    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın
    Founder and Strategic Intelligence Director
    Quantum Intelligence Hub Ltd (QIH)
    qihhub.com | qihnetwork.com | qihhub.info

  • How Cyber Attacks Are Reshaping Global Security Policies

    How Cyber Attacks Are Reshaping Global Security Policies

    How Cyber Attacks Are Reshaping Global Security Policies

    Article No: 3499
    Category: Cyber Security
    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    Politics is often shaped in the shadow of crisis. The widespread adoption of traffic lights was born from traffic accidents starting to claim lives, the tightening of pharmaceutical safety regulations from major drug disasters shaking public opinion, and the systematization of flight safety protocols from decades of lessons forged by plane crashes. Global cyber security policies do not operate with a different dynamic. Every major cyber attack has confronted states, institutions, and international organizations with the inadequacy of their existing policies and has triggered new regulatory moves.

    As Ömer Akın, I have observed this cycle many times throughout my work in the fields of cyber security and digital intelligence. An attack occurs, its scale and consequences are reflected in public opinion, policymakers take action, and a new regulatory framework is built. Then threat actors evolve and develop a new method, and the cycle begins again. As Quantum Intelligence Hub (QIH), we not only monitor this cycle but proactively prepare our corporate clients for both legal changes and the evolving threat landscape.

    In this article, I will address how cyber attacks are transforming global security policies through concrete examples, historical contexts, and policy analysis. Understanding the dynamics of this transformation is critically important not only for security experts but for every institution and decision-maker developing strategy.

    The Policy-Threat Gap Problem

    One of the fundamental paradoxes shaping cyber security policies is the inevitable lag between threats and policy responses. Threat actors always move more nimbly; new tools, new methods, and new targets come into play. Policymakers, on the other hand, must struggle with a heavy structure stemming from democratic legitimacy processes, bureaucratic coordination, and lack of technical expertise to adapt to this change.

    As Ömer Akın, I summarize this lag most strikingly with the following observation: A significant portion of the cyber security regulations in force today were designed not based on today’s threats, but on the threat profiles of five to ten years ago. This means that policies can be partially outdated even at the moment they are implemented. At QIH, we bring this reality to our corporate clients’ agenda at every opportunity; legal compliance is not sufficient for security; current regulations may lag behind the real threat environment.

    Several critical mechanisms stand out to overcome this lag problem. First is the principle-based design of regulatory frameworks; regulations focusing not on specific technologies but on fundamental security principles adapt better to technological change. Second is the systematization of information flow between policymakers and security experts. Third is that regulatory frameworks incorporate cyclical update mechanisms.

    The Transformative Impact of Major Cyber Attacks on Policy

    Analyzing the major cyber attacks that determine the course of global security policies and the policy transformations they triggered is extremely illuminating for understanding how cyber attacks operate the policy mechanism.

    The coordinated cyber attacks against Estonia in 2007 created a turning point in NATO’s cyber defense policies. The targeting of a NATO member’s digital infrastructure concretely brought to its agenda the question of whether the alliance should consider cyber attacks within the scope of legitimate self-defense. As a direct product of this discussion, the NATO Cooperative Cyber Defence Centre of Excellence established in Tallinn in 2008 assumed a key role in building international cyber security norms. As Ömer Akın, I find this development particularly important: A cyber attack became the trigger for the restructuring of the international security architecture. This is very concrete proof that cyber attacks produce not only technical but strategic and institutional consequences.

    The Stuxnet case in 2010 created its policy impact on a very different dimension. The emergence of this malware indisputably proved that states actively develop and use cyber weapons and brought to the forefront the question of how cyber weapons would be classified under international law. The subsequent years of UN Group of Governmental Experts work and intensified academic and diplomatic efforts regarding international legal norms applicable to cyberspace largely follow the questions opened by Stuxnet. As Ömer Akın, who regularly monitors these normative developments within QIH, I would like to emphasize that the construction of the international cyber legal framework is still in its infancy and that this gap has serious consequences for corporate risks.

    The documents leaked by Edward Snowden in 2013 revealed global surveillance capacities and deeply shook both national and international policy agendas. The legal basis of data-sharing agreements between the European Union and the US was questioned, significant momentum was given to the preparation process of the GDPR, and many countries began to review their national encryption and data localization policies. As Ömer Akın and QIH, we evaluate the GDPR and similar regulations that came into force after this process not merely as compliance documents, but as products of translating the issue of data sovereignty into policy language.

    The 2016 US election interference operation added a completely new dimension to cyber security policies: election security and the protection of democratic institutions. Following this operation, many democratic countries increased their security investments in election infrastructure, elevated election security to a priority heading in national cyber security strategies, and anti-disinformation regulations for social media platforms came onto the agenda. As Ömer Akın, the most striking point I find in this transformation is this: The impact of cyber attacks on policy has now entered the agenda of a much broader policy ecosystem, extending not only from security ministries but to election institutions and media regulators.

    The SolarWinds supply chain attack in 2020 ignited a comprehensive policy transformation regarding software supply chain security in the US. Presidential executive orders, mandatory cyber security standards, and new security requirements for software suppliers working with federal agencies constitute the direct policy reflections of this attack. At QIH, we convey these policy changes to both our US-based and Europe-based clients along with their implications; because global supply chain integration carries the impact of these regulations to a much wider geography.

    The Colonial Pipeline attack in 2021 accelerated concrete steps in critical infrastructure security policies. In the US, a cyber incident reporting obligation was introduced for critical infrastructure operators, the implementation of sector-specific security standards was tightened, and information-sharing mechanisms between critical infrastructure owners and federal agencies were strengthened. As Ömer Akın, the critical lesson I draw from this example is this: A cyber attack is the most effective catalyst for creating the political will needed for policy change. However, this approach creates a reactive policy cycle and poses a serious obstacle to proactive regulation.

    The European Union’s Cyber Security Policy Transformation

    The European Union stands out as the bloc building the most systematic and comprehensive regulatory framework in the global cyber security policy arena. Tracing this transformation is extremely valuable for concretizing how cyber attacks operate the policy mechanism through the EU example.

    The first important step in the EU’s cyber security policy evolution is the Network and Information Systems Directive, which entered into force in 2016. This directive, which introduced minimum security requirements and incident notification obligations for operators of critical infrastructure and digital service providers, formed the first legal basis for EU-wide cyber security harmonization.

    Subsequently, the GDPR, beyond being a technical cyber security regulation, created a deep intersection with cyber security policy as a framework that radically transformed the understanding of data protection. Mandatory notification of personal data breaches, data minimization principles, and heavy sanction mechanisms showed how decisive regulatory pressure can be in changing institutions’ perspectives on data security.

    The NIS2 directive, which entered into force in 2023, represents the EU’s most comprehensive policy update in this area. Significantly expanding its scope in terms of both sectors and organization size, NIS2 explicitly holds management boards accountable for cyber security responsibility and systematically addresses supply chain security. As Ömer Akın, with our operations based in both the UK and the Netherlands, we closely follow the practical implementations of this directive and support QIH clients in their compliance processes.

    The European Union’s Cyber Resilience Act represents a yet-to-be-finalized but extremely important policy step. Aiming to introduce mandatory cyber security requirements for connected devices and software products, this law is a reflection of a new policy paradigm that ties product security to the manufacturer’s responsibility.

    The United States’ Cyber Security Policy Transformation

    The US cyber security policy architecture is built not on a central regulatory framework but on sector-specific standards, voluntary frameworks, and presidential executive orders. This approach produces both flexibility and inconsistency.

    The 2013 Executive Order on Improving Critical Infrastructure Cybersecurity and the subsequent NIST Cybersecurity Framework constituted an important example of using voluntary standards as a policy tool. As Ömer Akın, I find the NIST framework particularly valuable; we regularly refer to it in QIH consultancy processes as one of the fundamental reference points for assessing corporate security maturity and determining improvement priorities.

    The 2021 executive order by the Biden administration on improving the nation’s cybersecurity represents one of the most comprehensive updates to US cyber security policy. Software supply chain security, transition to zero trust architecture, cloud security standards, and strengthening security information sharing among federal agencies constitute the prominent headings of this order. It is known that the Colonial Pipeline and SolarWinds attacks directly accelerated this order. As Ömer Akın and QIH, we address these policy changes with their international dimensions and support our clients with transatlantic operations in managing both EU and US regulations in a coordinated manner.

    Cyber Security Policy Transformation in the Asia-Pacific Region

    To complete the global cyber security policy map, it is necessary to also address the dynamics of the Asia-Pacific region. This region hosts both the most advanced cyber attack capacities and the widest diversity in terms of cyber security policy approaches.

    Japan has undergone a radical transformation in its cyber security policy in recent years. Japan’s cyber security doctrine, which for a long time focused only on defense, is expanding to include the development of active cyber defense capacity under increasing threat pressure. Singapore, despite being a small state, has become a regional reference point in this field with a highly comprehensive and continuously updated national cyber security strategy.

    China’s cyber security policy represents both one of the most comprehensive regulatory frameworks and the most controversial positioning. This framework, consisting of the Data Security Law, Personal Information Protection Law, and Cybersecurity Law, has dramatically changed the obligations of foreign companies regarding data management in China. As Ömer Akın, I emphasize that institutions operating in or integrated with the Chinese market must meticulously analyze this regulatory framework; QIH offers special assessments to our corporate clients on this matter.

    The Evolution of the International Normative Framework

    When evaluating the transformation in global security policies, it is necessary to separately focus on how the normative framework at the international law level has evolved. International norms, bilateral agreements, and multilateral documents in cyberspace, while not yet having achieved a unified international legal framework, are making important strides.

    The Tallinn Manual, prepared by legal experts within NATO, is the most comprehensive academic reference addressing how international law applies to cyber operations. Although non-binding, this document, which is referred to by states and courts, plays a critical function in the development of cyber warfare law.

    The UN Group of Governmental Experts work constitutes the main multilateral platform where states try to build consensus on norms of responsible state behavior in cyberspace. Although this work progresses slowly, it serves an important function in building the international cyber security normative framework. As Ömer Akın and QIH, we regularly evaluate the long-term impacts of these normative developments on corporate security policies and integrate these assessments into our clients’ strategic planning processes.

    The Growing Influence of the Private Sector on Policy Processes

    An important trend that has stood out especially in recent years in shaping global cyber security policies is the increasing influence of large technology companies and cyber security firms on policy processes. This influence flows through two channels.

    First is the transfer of technical expertise. The vast majority of governments do not possess the technical expertise needed to correctly assess the cyber threat environment and design effective regulations. To fill this gap, consultancy is obtained from private sector experts, consultation mechanisms are established with industry organizations, and public-private cooperation platforms are implemented. As Ömer Akın, I find the role QIH assumes in these processes extremely valuable and consider sharing our corporate knowledge base to contribute to policy discussions an important responsibility.

    Second is the operational role in incident response. In the aftermath of major cyber attacks, private cyber security companies assume critical roles in investigation, attribution, and damage assessment processes. The findings of these companies often provide direct input to both technical reports and policy decisions.

    Risks Created by Global Policy Misalignment

    When evaluating the transformation of global cyber security policies, the risks created by this transformation occurring in an uncoordinated manner should not be overlooked. Different countries adopting different approaches creates both operational difficulties and security gaps.

    Regulatory fragmentation creates a serious compliance burden for companies operating in multiple countries. As Ömer Akın, I personally experience this through QIH, which has corporate structures in both the UK and the Netherlands; EU regulations, the UK’s post-Brexit orientation, and the requirements of other jurisdictions where our clients operate require us to manage a highly complex compliance matrix. Solving this complexity constitutes one of the core value propositions QIH offers to its corporate clients.

    Gaps in threat intelligence sharing constitute another critical risk of global policy misalignment. While threat actors move across national borders, the information sharing defenders need to monitor this mobility and take countermeasures encounters political and legal obstacles.

    How Organizations Adapt to the Changing Policy Environment

    This rapid transformation of global security policies creates both risk and opportunity for institutions. As Ömer Akın, the approach I recommend to QIH’s client institutions for managing this transformation I address through five fundamental principles.

    First is regulatory foresight. Not only complying with current regulations but also identifying upcoming changes in advance and starting preparation processes today significantly reduces compliance costs. QIH offers this regulatory foresight service to its clients. Second is turning policy changes into security improvement opportunities. Regulatory pressures often activate corporate dynamics that can be used to legitimize security investments. As Ömer Akın, we plan with institutions to strategically use this window.

    Third is maintaining the balance between compliance and real security. Controls designed to meet regulatory requirements do not necessarily have to be effective against real threats. Managing both simultaneously is a fundamental skill of a strategic security program. Fourth is maintaining dialogue with policymakers. Especially for institutions operating in critical sectors, contributing technical expertise to policy discussions is valuable both for protecting sectoral interests and for producing more effective policies.

    Fifth and most fundamental is making change capacity a corporate competency. Policies change, threats evolve, technology transforms. Corporate structures that can adapt quickly to these changes possess the most enduring competitive and security advantage. As QIH, building this adaptability capacity in our client institutions is the long-term goal of our consultancy work.

    Conclusion: Turning the Policy Cycle from Reactive to Proactive

    Cyber attacks have historically transformed global security policies with a reactive dynamic. An attack comes, damage emerges, a policy response forms. This cycle provides threat actors with a permanent advantage.

    As Ömer Akın, I argue that the only way to break this cycle is to make policy production processes more proactive, more agile, and more fed with technical expertise. This is the duty of both states and institutions. States must derive regulatory frameworks not from lessons of previous attacks but from future threat projections; institutions must see legal compliance not as a minimum bar but as the starting point on the road to maximum security.

    As Quantum Intelligence Hub, we both advocate this vision at a theoretical level and implement it in our practical consultancy work. The QIH work carried out under the leadership of Ömer Akın adopts as its fundamental priority ensuring that our client institutions are prepared not only for today’s policy requirements but also for tomorrow’s threat environment and regulatory framework. Cyber security policy is less a target than a process that needs continuous updating, and those who manage this process best remain in the strongest position.

    About the Author

    Ömer Akın is an international strategist and corporate consultant specializing in cyber security, digital intelligence, global trade, and digital operations management. As the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides cyber security policy analysis, threat intelligence, and corporate security consultancy services in the international arena with operations based in the United Kingdom and the Netherlands. The articles and analyses he has written on global cyber security policies, nation-state threats, and corporate security strategy are used as reference sources by decision makers, policy experts, and security professionals in the field.

    For more information and corporate consultancy:
    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın
    Founder and Strategic Intelligence Director
    Quantum Intelligence Hub Ltd (QIH)
    qihhub.com | qihnetwork.com | qihhub.info

  • The Rise of Cyber Warfare in Global Politics

    The Rise of Cyber Warfare in Global Politics



    The Rise of Cyber Warfare in Global Politics

    Article No: 3498
    Category: Cyber Security
    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    The definition of war has changed. This change did not come suddenly, but it happened without most people noticing. The advance of tanks, the deployment of naval forces, and aerial bombardment; these traditional images of conflict are giving way to a silent, invisible, and borderless form of warfare. Cyber warfare is no longer a science fiction scenario, but a real component of today’s geopolitics. And this reality is fundamentally reshaping global power balances, national security doctrines, and corporate risk strategies.

    As Ömer Akın, during the years I have spent in the fields of cyber security and digital intelligence, I have closely observed cyber warfare moving from theory to practice, and states building both offensive and defensive capacities in this new front in a competitive manner. The intelligence and security consultancy work we carry out within Quantum Intelligence Hub (QIH) provides us with a perspective that allows us to analyze this transformation at an academic level and manage it at a corporate level.

    In this article, I will comprehensively address the conceptual framework of cyber warfare, its historical development, its reflections on global politics, and what this new battlefield means for institutions and states in all its dimensions. I aim not only to inform the reader but also to make them feel the real weight of this issue; because cyber warfare is no longer just a matter for security experts, but a phenomenon that every decision-maker must understand.

    What is Cyber Warfare: The Boundaries and Debates of the Concept

    The concept of cyber warfare still faces a controversial definitional problem in both academic and policy worlds. While some consider any state-sponsored cyber attack within the scope of cyber warfare, others limit this definition only to cyber operations that cause physical damage or cross the threshold of armed conflict. This debate has important practical consequences; because whether an action is classified as cyber warfare directly determines whether the right to self-defense can be exercised under international law and the form of diplomatic responses.

    As Ömer Akın, I find it more accurate to approach cyber warfare within the following framework: Cyber warfare is the entirety of coordinated cyber operations carried out by a state or actors acting on behalf of a state against another state’s or critical infrastructure’s digital systems with the aim of causing damage, rendering them dysfunctional, stealing data, or creating psychological impact. This definition includes both attacks that cause direct physical damage and intelligence operations that produce long-term strategic effects.

    As an organization that regularly analyzes this field at QIH, I can say this clearly: The boundaries between cyber warfare, cyber espionage, cyber sabotage, and cybercrime are deliberately blurred. This ambiguity allows attackers to maintain a wide corridor of deniability and makes it difficult for the international community to develop a coordinated response. Therefore, understanding cyber warfare also means understanding this intentional uncertainty.

    Historical Turning Points of Cyber Warfare

    When narrating the history of cyber warfare, rather than presenting a mere chronological list, it is much more illuminating to focus on the breaking points that shaped this history. As Ömer Akın, I evaluate these turning points within both their technical and geopolitical contexts.

    The first major breaking point is the coordinated cyber attacks against Estonia in 2007. Triggered by the removal of a pro-Russian monument, these attacks paralyzed the digital infrastructure of a NATO member state for weeks. Banking systems, government websites, and media organizations were targeted simultaneously. This event revealed for the first time so clearly that cyber warfare could be used as a state-organized tool. In QIH’s analysis of this case, as Ömer Akın, the point that caught my attention most was the strategic design of the attacks, which simultaneously accounted for both technical and psychological impact.

    The second major breaking point is the Stuxnet malware that emerged in 2010. Targeting Iran’s nuclear enrichment facilities, this software proved that cyber weapons could create concrete damage in the physical world. Stuxnet, which physically destroyed uranium enrichment centrifuges, showed that cyber operations could produce results comparable to traditional sabotage methods. From this point on, cyber weapons became a permanent component of states’ national security toolkits. When Ömer Akın and the QIH team examined this case, we assessed that Stuxnet was not only a technical weapon but a highly sophisticated strategic message.

    The third critical turning point is the cyber operations carried out against the US electoral process in 2016. These operations clearly revealed that cyber warfare is no longer limited to infrastructure sabotage or data theft; it can target democratic processes, public perception, and societal trust. Disinformation, phishing attacks, and leaked documents constituted the different tools of this operation. As Ömer Akın, I summarize the deepest impact of this event on global politics as follows: When cyber warfare gained a dimension that threatens electoral systems and democratic legitimacy, it entered the agenda not only of defense ministers but of all state institutions and civil society.

    The fourth breaking point is the SolarWinds supply chain attack in 2020. This case showed that cyber warfare can now be carried out not by attacking a direct target but through trusted interconnections. Infiltrating a software update used by thousands of organizations, this attack is considered one of the most comprehensive cyber espionage operations in history in terms of both scale and difficulty of detection. The main lesson we at QIH drew from this case was: The weakest link in the security chain is no longer the organization’s own infrastructure, but the third parties integrated with that infrastructure.

    The Place of Cyber Warfare in Global Power Competition

    When evaluating cyber warfare from a global politics perspective, focusing on its place in great power competition is inevitable. As Ömer Akın, I address this analysis through three main dimensions.

    The first dimension is the issue of deterrence. In conventional warfare, nuclear deterrence functioned on the basis of mutual destruction fear. In the cyber domain, deterrence poses a much more complex problem. The difficulty of attribution, that is, the difficulty of proving the source of an attack with technical evidence, fundamentally undermines deterrence. An attacker can disable the deterrence mechanism by hiding its identity or acting through another actor. In QIH’s threat intelligence work, as Ömer Akın, we regularly address this problem; attribution capacity forms the technical infrastructure of cyber deterrence, and strengthening this capacity continues to be a critical priority for global security.

    The second dimension is the issue of asymmetric advantage. Cyber warfare has the potential to partially overturn the traditional military power balance. A state or actor with relatively limited resources can inflict disproportionate damage on a much larger rival with a sophisticated cyber operation. This asymmetry is changing the rules of global power competition. While small states can obtain a balancing tool against major powers by developing cyber capacity, major powers use cyber superiority as a tool of strategic pressure.

    The third dimension is the issue of normative vacuum. The international legal frameworks governing land, sea, and air warfare are products of decades of experience and negotiation processes. In the cyber domain, international norms are still in their infancy. Although the UN Group of Governmental Experts and academic initiatives such as the Tallinn Manual are important steps, a binding international law of cyber conflict is still under construction. As Ömer Akın and QIH, we argue that filling this normative vacuum is one of the most critical priorities for global cyber security and we closely follow developments in this area.

    The Threat of Cyber Warfare to Critical Infrastructure

    One of the most dangerous dimensions of cyber warfare in global politics is its capacity to target critical infrastructure systems. Energy grids, water treatment plants, financial systems, transportation networks, and health infrastructure; these systems, which form the indispensable backbone of modern societies, have become extremely sensitive targets for cyber attacks.

    The ransomware attack on Colonial Pipeline, the largest fuel pipeline operator in the US, in 2021, strikingly revealed how fragile critical infrastructure security can be. The system being offline for days led to a fuel crisis and panic buying wave in the Southeastern US. Although this attack was assessed to have been carried out not by a state directly but by a cybercrime group, the incident served as a strong example that state-sponsored actors could use the same tools for a larger strategic purpose.

    As Ömer Akın, when I address critical infrastructure attacks from a global politics perspective, I would like to emphasize that these attacks are not limited to technical damage only. Targeting a country’s electricity grid simultaneously undermines that country’s defense capacity, economic functioning, and public trust in the state. This multidimensional impact elevates critical infrastructure attacks to a strategic weight comparable to conventional armed attacks. When conducting critical infrastructure security assessments at QIH, under the leadership of Ömer Akın, we adopt precisely this integrated impact perspective.

    Cyber Operations in the Context of Hybrid Warfare

    Today, cyber warfare mostly appears not as an isolated form of conflict but as an integral component of hybrid warfare. The hybrid warfare model, in which physical military action, economic pressure, disinformation campaigns, and cyber operations are used in a coordinated manner, creates a structure that is difficult both to analyze and to defend against.

    As Ömer Akın, when examining the cyber dimension of hybrid warfare, I would like to draw attention to two critical features. First, cyber operations function in hybrid warfare in both preparation and execution phases. Before a physical operation begins, intelligence is gathered on the target country’s defense systems, communication infrastructure, and decision-making mechanisms; when the operation begins, these systems are attempted to be disabled simultaneously with cyber attacks. Second, in hybrid warfare, cyber operations also have a strong psychological dimension. Coordinated attacks on a society’s digital infrastructure aim to create a sense of chaos and helplessness to weaken resistance capacity.

    In strategic threat assessments conducted within QIH, under the leadership of Ömer Akın, we keep this hybrid dimension constantly on the agenda. In the security consultancy we provide to our corporate clients, we also systematically address not only technical cyber threats but also the broader geopolitical and strategic context of these threats.

    States’ Cyber Capacity Race

    Today, it is estimated that more than thirty states worldwide have developed active cyber offensive capacity. This capacity race shares both similarities and important differences with traditional arms races.

    The similarity is this: In both races, parties invest resources to balance or outpace rivals, and this process leads to a cyclical escalation. The difference comes from this: Unlike conventional weapons, cyber capacities can be largely kept secret. While it is almost impossible to completely hide a country’s nuclear capacity, cyber operation capacity can be developed and used in a much more covert manner.

    As Ömer Akın, when I evaluate this race from a global security perspective, the development I find particularly concerning is the increasingly blurred relationship between private cyber mercenaries and cybercrime groups and states. Some states create a deniability space by conducting their own cyber operations through private groups or criminal organizations, and also benefit from the technical capacity of these groups. In QIH’s threat intelligence work, we continuously monitor this hybrid actor structure and warn our corporate clients against the risks arising from this structure.

    The United States, Russia, China, Iran, North Korea, and Israel are among the countries most analyzed in terms of global cyber power capacity. Each of these countries’ cyber doctrines, targeting criteria, and operational capacities differ significantly from one another. The critical point I want to emphasize as Ömer Akın is this: Institutions and states that understand these differences can tailor their defense strategies to the specific threat actors they face. This customization capacity produces much more effective results compared to a general-purpose defense approach.

    Cyber Security Alliances and Multilateral Cooperation

    An effective defense against cyber warfare requires a much broader cooperation framework than the capacity a single state or institution can develop alone. This reality has paved the way for the rapid proliferation of multilateral cyber security cooperation mechanisms in recent years.

    NATO’s inclusion of cyber defense within the scope of collective defense, the Five Eyes intelligence alliance’s cyber threat sharing networks, the European Union’s coordination mechanisms within ENISA, and bilateral cyber security agreements constitute concrete examples of this multilateral structure. As Ömer Akın and QIH, we both research these alliance structures and, in our corporate consultancy processes, evaluate with institutions how to benefit from the private sector extensions of these structures.

    However, these alliance structures also have serious limitations. Conflicts of interest regarding threat intelligence sharing, national security interests, and resource sharing are the biggest obstacles to multilateral cyber security cooperation. Especially in situations requiring alliance members to develop a coordinated response to a cyber attack, disagreements on attribution and political calculations can weaken this coordination.

    The Corporate Dimension of Cyber Warfare: Non-State Targets

    Cyber warfare does not only take place between states. Private sector institutions, civil society organizations, and individuals can also become both targets and sometimes unwitting actors of this war. As Ömer Akın, I place this dimension at the center of the consultancy work QIH provides to its corporate clients.

    Private companies operating critical infrastructure, especially in energy, finance, and telecommunications, can be direct national security targets. Large technology companies are continuously among the institutions targeted by state-sponsored actors to discover and analyze advanced malware and zero-day vulnerabilities. Small and medium-sized enterprises in the defense industry supply chain are at the forefront of the most vulnerable group targeted as an access gateway to large defense companies.

    In the consultancy work conducted under the leadership of Ömer Akın within QIH, while addressing this corporate dimension, I constantly emphasize the following: When an institution becomes the target of a state-level threat actor, most traditional cyber security controls become insufficient. Therefore, intelligence on state-sponsored threat actors must be an integral part of the defense strategy. QIH provides both threat intelligence and strategic consultancy services to its institutions in this regard and does not leave them alone in this complex threat environment.

    Artificial Intelligence and the Future of Cyber Warfare

    The most critical variable that will determine the course of cyber warfare in the coming period is the integration of artificial intelligence into this field. As Ömer Akın, I address the new dimensions AI brings to cyber warfare from two perspectives: its contribution to offensive capacity and its contribution to defensive capacity.

    From an offensive perspective, AI dramatically increases both the speed and scale of attacks. Highly customized phishing content produced with large language models, automated vulnerability discovery systems, and malware that adapts to evade traditional security tools in target networks; QIH’s threat intelligence work regularly confirms that these tools are actively deployed today.

    From a defensive perspective, AI enables security analysts to analyze petabyte-scale data in real time, flag anomalous patterns with a sensitivity the human eye cannot catch, and automate threat response processes. As Ömer Akın, we actively develop this defensive contribution of AI both theoretically and practically in our work within QIH.

    However, the outcome of this race remains uncertain. Which side will gain superiority in the AI arms race largely depends on which side adopts this technology faster, more effectively, and more responsibly. As Ömer Akın and QIH, we will continue to closely monitor this race and resolutely prepare our institutions on both offensive and defensive dimensions.

    National and Corporate Defense Strategy Against Cyber Warfare

    An effective defense strategy against cyber warfare cannot be sufficient alone at either the national or corporate level. The coordinated operation of these two levels is the fundamental condition for creating a truly resilient defense ecosystem against hybrid and multi-layered threats.

    At the national level, an effective cyber defense strategy must include four main components. First, ensuring centralized cyber security coordination. Fragmented institutional responsibilities and lack of coordination constitute one of the biggest weaknesses of national cyber defense. Second, establishing public-private sector cooperation mechanisms covering critical infrastructure owners. Since the vast majority of critical infrastructure is operated by the private sector, national defense remains incomplete without this cooperation. Third, circulating cyber threat intelligence among institutions through real-time sharing mechanisms. Fourth, adopting a long-term investment strategy for the continuous development of both cyber offensive and defensive capacity.

    At the corporate level, the approach I advocate as Ömer Akın in QIH’s consultancy processes is this: For institutions to be resilient against state-sponsored threat actors, they need not only technical controls but an intelligence-driven security approach. Who can target you, what methods do these actors use, where are your systems’ most valuable and most vulnerable points; the answers to these questions must form the core of the corporate security strategy.

    Conclusion: Confronting the Enduring Reality of Cyber Warfare

    Cyber warfare is not a temporary trend, but a permanent reality of global politics. As digitalization deepens, connectivity increases, and the dependence of critical systems on digital infrastructure intensifies, both the strategic importance and destructive potential of cyber warfare will continue to increase.

    As Ömer Akın, I think that confronting this reality first requires a mental transformation. Seeing cyber warfare not only as a technical problem but as a multi-layered strategic issue with geopolitical, economic, social, and legal dimensions is a prerequisite for both states and institutions to make accurate decisions in this area. As QIH, we place this multidimensional perspective at the center of every consultancy relationship, every threat analysis, and every security strategy discussion.

    Being prepared for cyber warfare does not mean waiting for an attack to happen. Understanding threat actors, anticipating possible attack vectors, continuously updating defense capacity, and knowing in advance what to do when an attack occurs; this is the preparation that Quantum Intelligence Hub, under the leadership of Ömer Akın, strives to build together with institutions. This preparation is the strongest foundation of corporate and national security in the digital age.

    About the Author

    Ömer Akın is an international strategist and corporate consultant specializing in cyber security, digital intelligence, global trade, and digital operations management. As the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides cyber warfare analysis, threat intelligence, and corporate security consultancy services in the international arena with operations based in the United Kingdom and the Netherlands. The articles and analyses he has written on cyber warfare in global politics, state-sponsored threat actors, and corporate security strategy are used as reference sources by decision makers, security professionals, and academics in the field.

    For more information and corporate consultancy:
    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın
    Founder and Strategic Intelligence Director
    Quantum Intelligence Hub Ltd (QIH)
    qihhub.com | qihnetwork.com | qihhub.info

  • Digital Forensics: Evidence Collection in Cyber Incidents

    Digital Forensics: Evidence Collection in Cyber Incidents

    Digital Forensics: Evidence Collection in Cyber Incidents

    Article No: 3497
    Category: Cyber Security
    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub

    By: Ömer Akın, Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    When a cyber attack occurs, the first reaction of organizations is usually to bring the system back up, limit the damage, and continue operations. This reflex is understandable, but it often leads to missing a critical opportunity: the opportunity to collect evidence. A cyber incident is not only a technical failure. It is also a crime scene. And as with every crime scene, the correct collection, preservation, and analysis of evidence is the only way to reveal who carried out the attack, how, and with what motivation.

    As Ömer Akın, in the cyber security and digital intelligence work I conduct within Quantum Intelligence Hub, the most frequent picture I encounter is this: Organizations can manage incident response technically, but they cannot integrate the digital forensics discipline into the process. For this reason, the identity of the attacker remains unclear, connections cannot be established between different attacks by the same actor, and legal processes remain inconclusive due to lack of evidence. Digital forensics is precisely the discipline that fills this gap.

    In this article, I will address the concept of digital forensics from scratch, explain comprehensively how evidence collection processes in cyber incidents should be structured, which methodologies stand out, and what kind of capacity organizations should build in this area.

    What Is Digital Forensics and Why Is It Critically Important

    Digital forensics is the process of collecting, preserving, analyzing, and reporting data found on digital devices and networks in a legally valid manner. This discipline, also known as forensic informatics, lies at the intersection of cyber security and law.

    As Ömer Akın, when I explain this definition to corporate executives, I particularly emphasize this distinction: Cyber security analysis focuses on stopping the attack. Digital forensics focuses on understanding and proving the attack. The first is operational, the second produces both operational and legal value.

    Why is digital forensics critical? Because in the modern cyber threat environment, it is no longer possible to defend without recognizing the attacker. The same threat actor can target different organizations for months. The evidence collected reveals this actor’s tactics, techniques, and procedures. This information not only solves that incident, it also makes it possible to anticipate future attacks.

    In addition, regulatory frameworks require organizations to report cyber incidents with a certain integrity of evidence. The European Union’s NIS2 directive, the regulations of the Personal Data Protection Authority in Türkiye, and sectoral standards clearly define post-incident evidence collection and retention obligations. As Ömer Akın, I observe that these obligations make it mandatory for organizations to proactively develop their forensic capacity.

    The Digital Forensics Process: Step-by-Step Evidence Collection

    An effective digital forensics process is much more than randomly collecting data. Internationally accepted methodologies address this process in four main phases.

    The first phase is preparation. The capacity to collect evidence must be ready before a cyber incident occurs. This includes procuring forensic tools, defining evidence storage procedures, and training the incident response team with forensic awareness. As Ömer Akın, the area I see most lacking in Quantum Intelligence Hub consultancy processes is exactly here: Organizations start thinking forensically after the incident occurs. Yet evidence collection is planned before the incident, not at the moment of the incident.

    The second phase is identification and collection of evidence. Which systems will be imaged, which log records will be preserved, and which network traffic will be recorded is determined at this stage. The critical point is this: Evidence collection must be performed without compromising the integrity of the evidence. Even when pulling data from live systems, no write operation should be performed, and if possible, work should be done in read-only mode.

    The third phase is preservation of evidence and chain of custody tracking. For each piece of evidence collected, by whom, when, with which method it was collected, where it is stored, and who accessed it must be documented completely. This chain of custody record is the basis of the legal validity of the evidence. If there is a break in the chain, even the strongest technical finding can lose its value in court.

    The fourth phase is analysis and reporting. The collected evidence is analyzed to create a timeline, map the attacker’s movements, and determine the root cause of the incident. As a result of this analysis, two different reports are prepared, one for technical teams and one for senior management. While the technical report details how the incident occurred, the executive summary reveals the business impact and the measures that need to be taken.

    Types of Evidence in Cyber Incidents

    Evidence collected in digital forensics work is divided into different categories according to its source. As Ömer Akın, when I explain these categories to organizations, I emphasize that each tells a different story.

    Disk images are an exact copy of a system and offer the possibility of in-depth analysis, including deleted files. Memory dumps can reveal running processes, open network connections, and unencrypted passwords. Log records answer the question of who accessed which system and when. Network traffic records show the size and target of data exfiltration.

    Mobile device evidence is becoming increasingly critical. Employees accessing corporate data via mobile devices makes it mandatory to include these devices in the forensic scope. In the forensic work carried out within Quantum Intelligence Hub, I have observed many times that mobile evidence often illuminates the initial entry point of the attack.

    Cloud environment evidence requires separate expertise. The cloud provider’s log records, access keys, and virtual machine snapshots do not exactly overlap with traditional forensic methods. As Ömer Akın, I think cloud forensic capacity is one of the weakest links of modern organizations.

    Common Mistakes in Evidence Collection

    As someone who has been responding to cyber incidents for years, I can clearly see the recurring mistakes in evidence collection processes. These mistakes both reduce the value of technical findings and make legal processes impossible.

    The most common mistake is rushing to restart or clean the system. When an attack is detected, the first reflex is to shut down the system and perform a clean installation. This operation completely destroys volatile evidence in memory. As Ömer Akın, I always tell organizations: Collect evidence first, then clean. Operational continuity is important, but evidence loss is irreversible.

    The second common mistake is failing to preserve evidence integrity. If a hash value is not taken when evidence is collected, it cannot be proven that the evidence was not altered later. This eliminates legal validity.

    The third mistake is not keeping a chain of custody record. Who collected the evidence, where was it stored, who accessed it? When the answers to these questions are not documented, the evidence is rejected in court.

    The fourth mistake is allowing unauthorized persons to access evidence. Even a curious system administrator examining evidence can make the integrity of the evidence questionable. For this reason, at Quantum Intelligence Hub we strictly apply role separation and access control in evidence collection processes.

    Forensic Tools and Technologies

    Modern digital forensics cannot be carried out without specialized tools. As Ömer Akın, I adopt an approach that varies according to the needs and maturity level of organizations in tool selection.

    Open source tools offer a strong entry point for organizations at the beginner level. Tools such as Autopsy, Sleuth Kit, Volatility, and Wireshark are widely used for disk analysis, memory analysis, and network analysis. These tools are free but require expertise.

    Corporate forensic platforms offer a more integrated capacity. Solutions such as EnCase, FTK, and X-Ways Forensics combine evidence collection, analysis, and reporting processes in a single interface. These platforms are preferred especially for collecting evidence to be used in legal processes.

    Cloud forensic tools form a separate category. AWS, Azure, and Google Cloud’s own forensic toolsets enable the collection of evidence in the cloud environment. As Ömer Akın, I emphasize that the correct configuration of these tools is the most critical step in preventing evidence loss in cloud-based attacks.

    AI-supported forensic tools are the most remarkable development of recent years. Anomaly detection from large data sets, timeline creation, and attacker behavior pattern recognition are accelerated by machine learning. At Quantum Intelligence Hub, we position these tools not to replace the human analyst, but as a layer that empowers the analyst.

    Legal Dimension: Admissibility of Evidence in Court

    One of the ultimate goals of digital forensics work is for the collected evidence to be usable in legal processes. This requires much more than technical accuracy.

    The Turkish Code of Criminal Procedure and the Law on Protection of Personal Data stipulate certain procedures for the collection and use of digital evidence. It is mandatory for the evidence to be obtained by lawful methods, for the integrity of the evidence to be preserved, and for it to be supported by an expert report for the evidence to be admissible.

    As Ömer Akın, I give organizations this warning: Not every technically correct piece of evidence is legally valid. Involving a legal advisor in the evidence collection process at an early stage prevents procedural rejection that may occur later.

    In addition, cross-border evidence collection creates separate legal complexity. The physical location of data in a different country in the cloud environment brings that country’s data sovereignty rules into play. For this reason, organizations operating internationally need to design their evidence collection policies in accordance with multiple jurisdictions.

    Integration of Digital Forensics and Threat Intelligence

    Digital forensics alone explains how an incident occurred. Threat intelligence shows whether this incident is part of a larger picture. As Ömer Akın, I think the integration of these two disciplines is the element that makes a real difference in cyber incident management.

    When evidence collected in a cyber incident is matched with the MITRE ATT&CK framework, the tactics and techniques used by the attacker become clear. When these techniques are compared with the profiles of known threat actors, they provide strong clues about the actor behind the attack. This attribution directly affects both the defense strategy and the legal process.

    In the work carried out within Quantum Intelligence Hub, we have seen many times that enriching forensic findings with threat intelligence plays a critical role in linking attacks by the same actor in different organizations. This integrated approach transforms reactive incident response into proactive threat hunting.

    How to Build Corporate Digital Forensics Capacity

    Building an organization’s digital forensics capacity from scratch can seem daunting. As Ömer Akın, I summarize this process in five practical steps.

    The first step is the creation of policies and procedures. A written forensic policy defining evidence collection, storage, and destruction processes is the foundation of capacity. The second step is determining the toolset. Tools appropriate to the size and risk profile of the organization should be selected, and the licenses and updates of these tools should be regularly monitored.

    The third step is training human resources. Providing forensic training to the existing cyber security team is the fastest way to increase capacity. The fourth step is integrating forensic steps into the incident response plan. Which evidence will be collected within the first 24 hours when an incident occurs should be predefined.

    The fifth step is keeping an external support mechanism ready. Not every organization needs to have a full-time forensic team. Making an agreement in advance with expert organizations such as Quantum Intelligence Hub ensures that expert support can be obtained without losing time in a critical incident.

    Conclusion

    Digital forensics, as the discipline of evidence collection in cyber incidents, has become an indispensable part of modern cyber security programs. Stopping the attack is now as much a part of corporate responsibility as understanding and proving the attack.

    As Ömer Akın, I can summarize my main message in this field as follows: An organization that does not collect evidence is doomed to be exposed to the same attack again. Digital forensics is a discipline that not only illuminates the past but also secures the future.

    As Quantum Intelligence Hub, we continue to support organizations in strengthening their forensic capacity, integrating a forensic perspective into incident response processes, and transforming the collected evidence into both technical and legal value. The work carried out under the leadership of Ömer Akın aims not only to manage cyber incidents, but to understand and prevent them.

    About the Author

    Ömer Akın is a strategist and corporate consultant specializing in cyber security, digital intelligence, global trade, and digital operations management. As the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides digital forensics and cyber incident response consultancy services in the international arena with operations based in the United Kingdom and the Netherlands. The articles and analyses he has written on digital forensics, forensic informatics, and cyber incident management are used as reference sources by security professionals and decision makers in the field.

    For more information and corporate consultancy:
    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın
    Founder and Strategic Intelligence Director
    Quantum Intelligence Hub Ltd (QIH)
    qihhub.com | qihnetwork.com | omerakin.nl

  • Data Sovereignty and Cyber Security in the Digital Age

    Data Sovereignty and Cyber Security in the Digital Age

    Data Sovereignty and Cyber Security in the Digital Age

    Article No: 3496

    Category: Cyber Security

    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub

    Written by: Ömer Akın, Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    It is said that data is more valuable than oil. Although this analogy has now turned into a cliché expression, the reality it contains has never been so indisputable. All of the companies with the largest market values in the global economy are built on business models that place data at their center. States manage their national security with data-driven systems. Individuals, whether they are aware of it or not, produce data in every digital action they take and carry increasingly deep concerns about the control of this data.

    In the middle of this picture, the concept of data sovereignty has become an issue that is gaining increasing importance both at the geopolitical and corporate level. Who will have access to the data, where the data will be stored, which law will protect the data, and how this data will be secured in the event of a cyber attack or data breach; the answers to these questions now carry not only technical but also strategic and political dimensions.

    As Ömer Akın, I observe in my work in both cyber security and digital operations management that the issue of data sovereignty is rapidly rising as a priority on corporate agendas. In this article, I will comprehensively address what data sovereignty means, its points of intersection with cyber security, and what kind of strategy institutions should adopt in this area.

    The Concept of Data Sovereignty: Definition and Scope

    Data sovereignty refers to the right and capacity of a state to control data produced, processed, or stored on its own territory within its own legal and administrative framework. This concept has gained an extremely complex dimension in recent years with the globalization of digital infrastructure.

    The traditional understanding of sovereignty was based on physical borders. In the digital age, the data of a citizen living in one country may be stored in a data center thousands of kilometers away, processed by a company subject to the law of a different country, and transferred via a server that falls under the jurisdiction of a third country. This reality fundamentally shakes the traditional understanding of sovereignty.

    As Ömer Akın, I think that data sovereignty should be addressed in three layers. The first layer is state sovereignty; it is the issue of protecting national data from the access of foreign governments and companies and ensuring that national law can be effectively applied to this data. The second layer is corporate sovereignty, which covers the capacity of companies to control data belonging to their own customers and operations. The third layer is individual data sovereignty; it refers to the rights of individuals to control how their own digital data is collected, used, and shared.

    In the digital operation and security studies conducted under the leadership of Ömer Akın within Quantum Intelligence Hub, I observe more clearly every day that these three layers constantly intersect and that every institution must manage this intersection point strategically.

    Data Localization: Opportunity or Constraint?

    One of the most concrete policy reflections of data sovereignty discussions is data localization requirements. Many countries have enacted regulations that restrict the transfer of certain categories of data abroad or require that this data be stored compulsorily in local data centers.

    Russia’s requirement to store personal data on local servers, China’s data localization requirements brought by data security and cyber security legislation, the European Union’s data transfer restrictions under GDPR, and Turkey’s regulations regarding the processing of personal data domestically constitute concrete examples of this policy in different geographies.

    As Ömer Akın, I think that when evaluating data localization policies, the arguments put forward by both advocates and critics should be addressed in a balanced manner. Those who advocate data localization argue that this policy strengthens national security, limits foreign governments’ access to citizens’ data, and contributes to the development of the local data economy. Critics argue that data localization fragments global digital services, increases data center investment costs for small countries, and in some cases strengthens the control of authoritarian regimes over their citizens.

    When evaluated from the perspective of institutions, data localization requirements become a serious source of operational complexity, especially for international companies operating in more than one country. Planning in advance the answers to questions such as which data will be stored in which country, how compliance with the legal requirements of different countries will be ensured, and how these requirements will be reflected in cloud infrastructure decisions constitutes the basic condition for managing both costs and compliance risks.

    Cloud Sovereignty: The New Dimension of Digital Dependency

    With cloud computing becoming dominant in the corporate world, data sovereignty discussions have gained a new and critical dimension. American technology giants such as Amazon Web Services, Microsoft Azure, and Google Cloud, which hold more than two-thirds of the global cloud services market, have become the main carriers of the digital infrastructure of institutions and states worldwide.

    This dependency presents a disturbing picture from the perspective of sovereignty. As Ömer Akın, I find it useful to ask the following question to concretize this issue: To what extent does storing critical public infrastructure, health data, or financial records on servers belonging to a foreign company undermine the real sovereignty of that country over this data?

    The European Union put the GAIA-X project into practice in search of a concrete answer to this question. This initiative, which aims to create a cloud ecosystem shaped by Europe’s own values and standards, represents one of the most striking policy outputs of the cloud sovereignty discussion. With similar concerns, France, Germany, and other European countries are developing national cloud policies regarding the data processing preferences of public institutions.

    When I evaluate this dynamic from both a geopolitical and corporate perspective as Ömer Akın, I conclude that cloud sovereignty is a strategic issue that not only states but also private sector institutions should put on their agenda. It has now become a necessity for institutions to systematically evaluate not only cost and performance but also data sovereignty requirements, legal compliance obligations, and possible geopolitical risks in their cloud supplier selection.

    The Intersection of Data Sovereignty and Cyber Security

    Data sovereignty and cyber security have a deep and complex relationship with each other. Correctly understanding this relationship is a prerequisite for developing effective strategies in both areas.

    The most basic point of intersection is the protection of data. Data sovereignty is a claim of right; cyber security is the means to actually protect this right. Legal frameworks, national regulations, and contractual guarantees define who controls the data; however, it is cyber security controls that translate these definitions into technical reality. For example, the European Union’s GDPR regulation brings comprehensive obligations regarding the protection of personal data. Fulfilling these obligations directly requires cyber security practices such as encryption, access control, data classification, and incident response.

    The second point of intersection is nation-state cyber operations. Cyber attacks carried out by state-sponsored threat actors to access the data of foreign governments, companies, and individuals turn the issue of data sovereignty into a concrete security threat. As Ömer Akın, I find this dimension particularly critical: Data sovereignty is not just a matter of legal framework. Without defense capacity against cyber intelligence operations, legal protections can remain ineffective in practice.

    The third point of intersection is data breaches and leaks. Data breaches experienced at the corporate or national level not only create financial and reputational damage; they also effectively end data sovereignty when data falls into uncontrolled hands. For this reason, cyber security is the technical guarantee of data sovereignty.

    Reflections of Global Data Regulations on Security

    Regulations regarding data protection and data sovereignty are rapidly increasing and expanding in scope worldwide. These regulations are assuming an increasingly decisive role as frameworks that directly shape the cyber security strategies of institutions.

    The European Union’s GDPR stands out as the most comprehensive and most effective of global data protection standards. This regulation, which brings strict requirements regarding the processing, storage, and transfer of personal data, directly binds all institutions operating in the EU or processing the data of EU citizens. The heavy financial sanctions applied in case of violations have made compliance costs an integral part of corporate security budgets.

    Turkey’s Personal Data Protection Law adopts many principles compatible with GDPR, but contains some differences in local practice. As Ömer Akın, as someone working through corporate structures based in Turkey and the Netherlands, I personally experience how critical a strategy it requires to manage the requirements of both regulatory frameworks simultaneously. Especially in cross-border data transfers, which legal mechanism will be used and how compliance obligations to the data protection authority of each country will be documented are areas that require careful planning.

    In the United States, sector-specific regulations are at the forefront. HIPAA in the health sector, the Gramm-Leach-Bliley Act in the financial sector, and California’s CCPA at the state level; require institutions to manage their data security requirements in a complex compliance environment that varies by sector and geography.

    Data Classification: The Operational Foundation of Sovereignty

    The most basic operational step in putting data sovereignty into practice is the systematic classification of the data an institution owns. Without knowing which data falls into the critical, sensitive, or public category, it is not possible to apply appropriate security controls to this data and protect sovereignty effectively.

    As Ömer Akın, I evaluate data classification as the cornerstone of corporate security strategy and draw particular attention to several critical points in this process. First, classification must be dynamic, not static. The sensitivity of data can change over time; a product plan kept confidential temporarily may move to the public category after launch. Second, classification must be done with the participation of not only technical teams but also the business units that produce and use the data. A classification process that does not include the data owner cannot sufficiently reflect real sensitivity levels. Third, classification must be directly linked to protection mechanisms. For classification not to turn into a mere labeling exercise, it is essential that which security controls will be applied for each class is predefined.

    Encryption and Key Management: The Technical Guarantee of Sovereignty

    When addressing data sovereignty from a cyber security perspective, it is necessary to focus separately on the issue of encryption and key management. Encryption is the most basic technical mechanism for protecting data against unauthorized access. However, for encryption to truly provide sovereignty, encryption keys must also be kept within the scope of sovereignty.

    This issue is of critical importance, especially in the context of cloud services. Even if an institution stores its data encrypted in a cloud provider, if the encryption keys are managed by the same provider, it becomes debatable whether encryption will protect sovereignty in the event that the provider or the legal jurisdiction of the country in which it operates creates a request for access to this data. For this reason, adopting customer-side key management models for sensitive data is a critical control mechanism that strengthens data sovereignty at the technical level.

    As Ömer Akın, I consistently recommend the following to corporate clients on this issue: Trust your cloud provider, but keep your encryption keys under your own control. This approach both technically strengthens data sovereignty and provides a strong compliance argument in regulation and audit processes.

    Artificial Intelligence, Data Sovereignty and Security

    The integration of artificial intelligence into corporate infrastructure adds new and complex dimensions to the issue of data sovereignty. Training artificial intelligence models requires large amounts of data, and how this data is collected, where it is processed, and who can access it raises critical questions in terms of both sovereignty and security.

    As Ömer Akın, there are two issues I would like to draw particular attention to in this area. First is how the corporate data used by artificial intelligence systems in the training process is processed in the infrastructure of the providers of these systems. Some artificial intelligence services may use the data provided by users for model development purposes. This situation carries a serious risk in terms of corporate data passing to third parties in an uncontrolled manner and creating a loss of sovereignty.

    Second, the threat of artificial intelligence-supported attacks to data sovereignty is growing. Artificial intelligence-driven data theft, classification, and analysis tools make it possible for stolen data in a cyber breach to be evaluated much faster and much more deeply. This development indicates that we are entering an era where a data breach results not only in unauthorized access to data, but also in that data being instantly processed and transformed into strategic value.

    Corporate Data Sovereignty Strategy: Practical Steps

    Institutions need to take concrete steps to move the issue of data sovereignty beyond theory and turn it into an operational strategy. As Ömer Akın, I summarize these steps over five main priorities.

    The first is data inventory and mapping. Systematically documenting which data the institution has, where this data is stored, who accesses it, and which countries’ legal frameworks it is subject to forms the basis of the sovereignty strategy. The second is the creation of classification and protection policies. Classifying data according to its sensitivity level and defining appropriate security controls for each class brings sovereignty to the operational level.

    The third is the review of cloud and supplier policy. It is essential to create clear policies on which data can be stored in which cloud providers, how key management will be carried out, and what contractual data processing guarantees should include. The fourth is strengthening the encryption architecture. Applying strong encryption both during storage and transmission and structuring key management in accordance with the principle of sovereignty is the basis of technical sovereignty.

    The fifth and perhaps most critical is the establishment of a regulatory compliance monitoring mechanism. Data sovereignty legislation is rapidly changing and proliferating. As Ömer Akın, I observe that the biggest risk for institutions in this area is noticing legislative changes with delay. Proactively monitoring regulatory developments and updating the compliance strategy according to these developments is the basic mechanism for protection from both penal sanctions and competitive disadvantage.

    Conclusion

    Data sovereignty constitutes one of the most strategic issues of the digital age. For both states and institutions, questions about where data is, who can access it, and how it is protected have turned into questions that require not only technical decisions but also strategic preferences and geopolitical positioning.

    As Ömer Akın, I can summarize my basic conclusion in this area as follows: Data sovereignty is a goal, and cyber security is the means to achieve this goal. When the two are handled separately, both become dysfunctional; when handled together within an integrated strategy framework, they make real sovereignty over your digital assets possible.

    As Quantum Intelligence Hub, we advocate more strongly every day the importance of designing data sovereignty and cyber security strategies as an inseparable whole of institutions’ digital infrastructure. The studies carried out under the leadership of Ömer Akın adopt as their main goal contributing to institutions being both compliant and truly secure in the increasingly complex regulatory environment.

    About the Author

    Ömer Akın is a strategist and corporate consultant specializing in cyber security, digital intelligence, global trade, and digital operations management. Serving as the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides data security, digital sovereignty, and corporate cyber security consultancy services in the international arena with its operations based in the United Kingdom and the Netherlands. The articles and analyses he has written on data sovereignty, cyber security strategy, and international data regulations are used as reference sources by decision makers and security professionals in the field.

    For more information and corporate consultancy:

    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın

    Founder and Strategic Intelligence Director

    Quantum Intelligence Hub (QIH)

    qihhub.com | qihnetwork.com | omerakin.nl

  • Risk Management in Cyber Security

    Risk Management in Cyber Security

    Risk Management in Cyber Security

    Article No: 3495

    Category: Risk and Security Analysis

    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub

    Written by: Ömer Akın, Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    The healthiest way to evaluate an organization’s cyber security posture is to examine that organization’s approach to risks. No matter how strong the technology investments are, how skilled the security team is, or how advanced the tools used are; without a risk management understanding, these resources cannot be directed correctly, priorities cannot be determined accurately, and an effective defense against real threats cannot be built. Risk management in cyber security is the fundamental discipline that transforms all these efforts into a meaningful strategy.

    As Ömer Akın, in the corporate consultancy work I have carried out in the field of cyber security, I have witnessed a common misconception of many organizations: Risk management is often perceived as a subheading of security audits or as a technical procedure included in annual compliance reports. However, risk management in cyber security is the very strategy for protecting an organization’s digital assets. Compliance is an output of this strategy; not the strategy itself.

    In this article, I will comprehensively address what risk management in cyber security means, how it is structured, which methodologies stand out, and how organizations can truly build an effective program in this area.

    The Critical Difference Between Risk Management and Security Management

    To correctly interpret risk management in cyber security, it is first necessary to clarify the difference between security management and risk management. These two concepts are often intertwined and sometimes used interchangeably. Yet the distinction between them is of decisive importance for the strategic clarity of a security program.

    Security management focuses on the implementation of technical controls, the enactment of security policies, and the operation of security tools. Managing firewall rules, carrying out patching processes, implementing access controls; all of these are within the scope of security management. Risk management, on the other hand, steps back and looks from a broader perspective: What are these technical controls being applied to protect? To what extent are they effective against which threats? And are we directing our resources to the areas that will reduce the highest risk?

    As Ömer Akın, I like to explain this distinction with the following concrete example: Two companies both perform firewall management. However, the first has a team that operates the firewall, while the second has a team that knows which risks it operates the firewall to reduce, understands how these risks overlap with corporate priorities, and monitors new risk areas that the firewall no longer covers. The second approach is the model in which the risk management understanding is integrated into security practice, and it reveals in the simplest way the security maturity difference between these two companies.

    Core Components of Cyber Risk Management

    An effective risk management program in cyber security encompasses multiple interconnected components. As Ömer Akın, I address these components from both a theoretical and a practical perspective.

    The first component is risk identification. For a risk management program to be functional, the risks to which the organization may be exposed must first be systematically identified. This process should include not only the detection of technical vulnerabilities, but also weaknesses in business processes, supply chain risks, human-originated threats, and regulatory compliance risks. A scope definition that narrows the risk identification process makes it impossible to manage unseen threats.

    The second component is risk assessment. For each identified risk heading, two fundamental questions must be answered: What is the likelihood of this risk materializing, and what would be the cost to the organization if it does materialize? The intersection of these two dimensions determines the priority order of the risk. Risks with high likelihood and high impact require the most urgent intervention, while risks with low likelihood and low impact can be accepted or kept under monitoring.

    The third component is the determination of risk treatment strategies. For each risk heading, one or a combination of four basic approaches can be adopted. Risk mitigation aims to reduce the likelihood or impact of the risk through technical and administrative controls. Risk transfer ensures that the financial consequences of the risk are transferred to a third party through mechanisms such as cyber security insurance. Risk acceptance means that the organization prefers to consciously assume a certain level of risk. Risk termination covers the complete elimination of the activity or asset that creates the risk.

    The fourth component is risk monitoring and reporting. Risk management is not a one-time assessment but a dynamic process that needs to be continuously renewed. As the threat environment changes, the organization’s digital infrastructure evolves, and business processes transform, the risk profile also changes. Monitoring this change and regularly reporting the findings to senior management is the fundamental mechanism for the integration of risk management into corporate strategy. As Ömer Akın, I observe serious gaps especially in the reporting dimension; when the findings produced by technical teams do not reach senior management in an understandable and actionable form, risk management efforts lose their strategic impact.

    Risk Assessment Methodologies: Qualitative and Quantitative Approaches

    The methodologies used in cyber risk assessment can be considered in two main categories: qualitative and quantitative. Both approaches have their own strengths and weaknesses, and the most mature risk management programs use these two approaches in a complementary manner.

    Qualitative risk assessment is an approach that evaluates risks in relative categories such as low, medium, high, and critical. It relies on expert opinions, experience-based judgments, and qualitative criteria. Its implementation is relatively fast and can be carried out without a large amount of technical data. However, the fact that this approach is open to evaluator bias and that different analysts can reach different results for the same risk constitutes a significant weakness.

    Quantitative risk assessment, on the other hand, attempts to express risks numerically. Financial metrics such as expected annual loss and return on investment for a security control constitute the main outputs of this approach. Quantitative assessment is extremely valuable especially for supporting budget decisions and conveying risks to senior management in financial language. However, the need for accurate statistical data and the historically insufficient cyber risk data constitute the main difficulty in implementing this approach.

    As Ömer Akın, I argue that a hybrid methodology is the most pragmatic option in corporate risk assessment processes. A quick prioritization is made with qualitative assessment, and then quantitative analysis is deepened for high-priority risks to add a financial dimension that will support budget and strategy decisions. This approach presents a model that is both practical and provides maximum value to decision makers.

    International Risk Management Frameworks

    There are several international frameworks and standards that provide guidance in the field of risk management in cyber security. As Ömer Akın, I evaluate these frameworks as reference points that I frequently refer to in corporate consultancy processes, and I discuss below to what extent each responds to different corporate needs.

    The NIST Cybersecurity Framework is a comprehensive guide developed by the US National Institute of Standards and Technology and widely accepted globally. Built on five core functions listed as Identify, Protect, Detect, Respond, and Recover, this framework integrates risk management into all layers of the cyber security program. It constitutes a strong starting point especially for organizations operating in critical infrastructure sectors.

    ISO 27005 is an international standard that focuses on information security risk management and works in harmony with the ISO 27001 standard. This standard, which defines the risk management process in detail, offers organizations a systematic methodology and constitutes a strong reference in terms of global compliance.

    The FAIR (Factor Analysis of Information Risk) framework is a model that offers a specific focus on quantitative risk assessment and aims to express cyber risks in financial terms. It is an extremely valuable tool for organizations that want to discuss risk management at the board level and support budget decisions with numerical data.

    The CIS Controls, on the other hand, offer a more practical and implementation-oriented approach. This framework, which lists prioritized security controls, ensures that organizations with limited resources focus on the areas that will create the highest impact. As Ömer Akın, I emphasize that CIS Controls constitute an extremely valuable entry point especially for organizations just starting a risk management program, as they offer concrete and measurable goals.

    Defining Corporate Risk Appetite

    One of the most neglected yet most decisive elements of risk management in cyber security is the clear definition of the organization’s risk appetite. Risk appetite expresses the amount of risk an organization is willing to accept in order to achieve its strategic objectives.

    A risk management program carried out without defining risk appetite produces inconsistent decisions. Some risks are managed with more resources than necessary, while others may be completely ignored. The ongoing uncertainty between senior management and technical teams regarding the acceptability of risks leads to operational friction and strategic inconsistencies.

    As Ömer Akın, I consider the active participation of senior management and the board of directors mandatory in the process of defining risk appetite. The perspective of the finance director, the legal director, and the operations director on cyber risks creates a much more robust and sustainable framework than a risk appetite definition produced solely from the perspective of the security team. While conducting such multidisciplinary studies within Quantum Intelligence Hub, I have repeatedly confirmed how much the alignment of risk appetite with the organization’s strategic priorities increases decision quality.

    Third-Party and Supply Chain Risk Management

    The scope of risk management in cyber security extends far beyond the organization’s own digital boundaries. Suppliers, business partners, cloud service providers, and externally sourced software components are among the risk sources that directly affect the organization’s risk profile but are often not adequately managed.

    Supply chain attacks such as SolarWinds have indisputably revealed how critical this dimension is. As Ömer Akın, I argue that it is mandatory to address third-party risk as a separate heading in corporate risk assessments. A supplier’s cyber security maturity, data processing practices, and incident response capacity directly shape the risk profile of the organization that works integrated with that supplier.

    To structure third-party risk management, suppliers must first be segmented on a risk basis according to the data and systems they can access. Suppliers with access to critical systems and sensitive data are subject to the highest level of audit, while lighter assessment procedures can be applied for suppliers with limited access. Clarifying contractual security requirements and audit rights before the relationship begins forms the legal infrastructure of this risk management.

    The Human Factor in Cyber Risk Management

    One of the most frequently overlooked dimensions of corporate cyber risk management is the human factor. It is now a well-known fact that the vast majority of security breaches involve human error or social engineering in some way. Nevertheless, many risk management programs focus on technical risks while not addressing behavioral and cultural risks in a sufficiently systematic manner.

    As Ömer Akın, I address human-originated risks in two main categories. The first is awareness risks. Employees’ lack of knowledge about cyber threats, secure behaviors, and corporate security policies is at the forefront of risks in this category. These risks can be significantly reduced with a conscious awareness program. The second is malicious insider threats. The risk that people within the organization intentionally harm the organization’s data or systems or use these resources in an unauthorized manner constitutes one of the most difficult threat categories to detect and manage.

    When designing risk reduction mechanisms for both categories, not only technical controls but also process design and corporate culture should be addressed. Implementing the principle of separation of duties, linking critical transactions to multi-layered approval mechanisms, and establishing reward systems that encourage secure behavior cover both the technical and cultural dimensions of managing human-originated risks.

    Integration of Incident Response and Risk Management

    Risk management and incident response planning are two disciplines that are closely linked but are often carried out separately in most organizations. As Ömer Akın, I define the practical result of this disconnect as follows: An incident response plan without risk management cannot clearly reveal which systems are critical, which risks should be addressed first, and which decisions will be made by whom during an attack.

    Several critical steps need to be taken to integrate incident response planning with risk management. First, the findings obtained from risk assessment should be used to determine the most likely attack scenarios. Developing response procedures specific to these scenarios ensures much faster and more accurate decisions during a real incident. Second, systems that are critical for business continuity should be prioritized according to their risk profile. Which systems need to be recovered in the shortest time during an attack should be directly derived from previously conducted risk assessments. Third, simulation exercises should be fed with risk scenarios. Exercises based on realistic threat scenarios both test the preparedness of response teams and provide valuable feedback for updating risk assessments.

    Cyber Risk Management at Board Level

    For risk management in cyber security to fully produce its corporate value, it must be owned at the board level. This is one of the most prominent corporate governance trends of recent years and is rapidly becoming widespread under the influence of regulatory pressures.

    For boards of directors to meaningfully assess cyber risks, the information presented must be stripped of technical jargon, structured around business impact, and supported by financial dimensions. As Ömer Akın, in the processes where I present cyber risk to boards of directors, I have consistently observed that conveying risks in relation to daily operations, financial targets, and corporate reputation creates a much stronger awareness in decision makers.

    Regulatory frameworks such as the European Union’s NIS2 directive have begun to clearly define the cyber security responsibility of senior management and boards of directors. These regulations legally certify that cyber risk management is now within the responsibility area not only of technical teams but also of the organization’s top management level.

    Conclusion

    Risk management in cyber security forms the strategic backbone of an organization’s digital security program. This discipline, which reveals the real value of investments in technical tools, security policies, and incident response capacity, makes it almost impossible to direct security resources correctly without it.

    As Ömer Akın, as someone working in this field, I can say this clearly: A perfect security program is born from a perfect understanding of risk. Identifying risks, prioritizing them, monitoring them, and making strategic decisions based on these findings is the fundamental condition for organizations to survive in this era where cyber threats are becoming increasingly sophisticated.

    As Quantum Intelligence Hub, supporting organizations in establishing their risk management programs from scratch, maturing their existing programs, and integrating risk findings into strategic decision mechanisms constitutes one of our primary missions. The studies carried out under the leadership of Ömer Akın contribute to organizations gaining a perspective that will allow them to see not only today’s risks but also tomorrow’s threats.

    About the Author

    Ömer Akın is a strategist and corporate consultant specializing in cyber security, digital intelligence, global trade, and digital operations management. Serving as the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides risk management and cyber security consultancy services in the international arena with operations based in the United Kingdom and the Netherlands. The articles and analyses he has written on cyber risk management, security strategy, and corporate resilience are used as reference sources by security professionals and managers in the field.

    For more information and corporate consultancy:

    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın

    Founder and Strategic Intelligence Director

    Quantum Intelligence Hub (QIH)

    qihhub.com | qihnetwork.com | omerakin.nl

  • The Role of Digital Intelligence in Modern Security Strategies

    The Role of Digital Intelligence in Modern Security Strategies

    The Role of Digital Intelligence in Modern Security Strategies

    Article No: 3489

    Category: Cyber Security / Security Analysis

    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub

    The Role of Digital Intelligence in Modern Security Strategies

    By: Ömer Akın, Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    Security can no longer be reduced to building walls, locking doors, or installing alarms. In the digital age, the essence of security is based on information. An organization that can understand in advance who will act, when, and with what intent reaches a position far beyond reactive defense. At this point, the concept of digital intelligence sits at the center of modern security strategies. Not intervening after a threat has materialized, but recognizing and neutralizing it before the threat forms; this is the most fundamental value that digital intelligence adds to corporate security.

    As Ömer Akın, I have been working for years at the intersection of both cyber security and digital intelligence. What I have seen most clearly in this process is this: Even institutions with strong technical infrastructures can turn blind without the right intelligence. A security team equipped with technology but lacking intelligence is no different from a sentry with his eyes closed. In this article, I will comprehensively address the role of digital intelligence in modern security strategies, its forms of implementation, and how institutions can build a structure in this field.

    What Is Digital Intelligence and Why Is It So Valuable

    Digital intelligence is the process of collecting raw data from open or closed digital sources and analyzing it to turn it into meaningful, actionable information for decision makers. The difference between raw data and intelligence lies precisely in this process of making sense. Millions of log records, social media posts, forum messages, or network traffic data may not mean anything on their own; but when brought together with the right analytical framework, they can clearly reveal the intentions, targets, and methods of threat actors.

    The scope of digital intelligence is quite broad. Open Source Intelligence, known as OSINT, benefits from all kinds of publicly available digital sources, from social media, news sites, academic publications, domain name records, and even geographic data. Technical intelligence includes network traffic analysis, malware reverse engineering, and mapping of attack infrastructures. The digital leg of human-source intelligence, HUMINT, monitors actor behavior on online platforms, forum interactions, and activity in underground markets.

    As Ömer Akın, I must clearly state this: Digital intelligence is not limited to cyber threats only. It provides critical input across a wide spectrum, from physical security planning to reputation management, from competitive analysis to the assessment of supply chain risks. For institutions to fully evaluate this potential, they must make intelligence a part of not only security teams but also strategic decision-making processes.

    The Intelligence Cycle: The Path from Data to Action

    To understand the integration of digital intelligence into corporate security, it is essential to grasp the intelligence cycle. This cycle consists of six basic stages, and each stage feeds the next.

    The first stage is the direction and planning stage. At this stage, intelligence needs are determined. Which threats, which actors, or which risks do we want to understand? The answers to these questions shape the type of data to be collected and the focus of the analysis. As Ömer Akın, I want to emphasize a critical point: Many institutions skip this stage and move directly to data collection. Yet data collected without direction is nothing but meaningless noise.

    The second stage is the collection stage. Data is collected from various sources according to the identified needs. Open web sources, social media platforms, dark web forums, threat intelligence feeds, network sensors, and endpoint data are among the leading sources. Diversity in data collection is of critical importance; intelligence based on only a single source can be blunt and misleading.

    The third stage is the processing stage. The collected raw data is transformed into a form that can be analyzed. At this stage, data cleaning, classification, normalization, and storage operations are carried out. Automation and machine learning tools are increasingly playing a decisive role in processing large data volumes.

    The fourth stage is the analysis and production stage. This stage is the heart of the intelligence cycle. Meaningful inferences are made from raw data, threat actors are identified, attack patterns are interpreted, and possible future movements are predicted. As Ömer Akın, I would like to make an important warning at this point: Analysis is not just a technical process. Human intelligence, contextual interpretation, and domain expertise provide a depth that automated tools cannot produce.

    The fifth stage is the dissemination stage. The produced intelligence is delivered to the right decision makers at the right time and in the right format. An intelligence report presented to a technical security analyst and an executive summary prepared for senior management require different formats. The value of intelligence is largely proportional to the quality of communication.

    The sixth stage is the feedback stage. Feedback from decision makers shapes the direction stage of the next cycle. This cyclical structure makes it possible for intelligence to adapt to the changing needs of the institution.

    Threat Actor Profiling: Knowing Your Opponent

    One of the most powerful applications of digital intelligence in modern security strategies is threat actor profiling. When an attack occurs, it is not enough to analyze only the technical indicators; understanding the motivation, capacity, and targeting logic behind the attack is much more valuable in terms of predicting future attacks.

    Threat actors are generally classified into four main categories: state-sponsored actors, organized crime groups, hacktivists, and insider threats. Each of these categories has different motivations, different technical capacities, and different targeting criteria. While state-sponsored actors generally focus on long-term strategic goals, organized crime groups prioritize financial gain. Hacktivists try to convey an ideological message, while insider threats often constitute the most difficult threat category to detect, originating from within the institution itself.

    In the threat intelligence studies carried out within QIH, I, as Ömer Akın, have observed many times: Tactical, technical, and procedural patterns obtained from a threat actor’s previous attacks provide an extremely reliable reference framework for predicting possible future targets and methods. These profiling studies, enriched with global threat databases such as MITRE ATT&CK, allow defense teams to concentrate their defenses exactly on the points that attackers want to hit.

    Open Source Intelligence: The Power of the Visible

    The most accessible and at the same time most overlooked dimension of digital intelligence is open source intelligence. OSINT, which means the systematic collection and analysis of publicly available information on the internet, becomes a very powerful intelligence source when applied correctly.

    It must be clearly stated: The vast majority of publicly available information on the internet is never invisible; it is simply not compiled correctly. The LinkedIn profiles of a company’s employees can reveal the organization’s structure and critical roles. Domain name registration information allows tracking of the geographic and technical traces of an attack infrastructure. Social media posts can unknowingly announce an attacker’s intentions or an institution’s vulnerabilities.

    As Ömer Akın, there is a point I would like to draw particular attention to on this subject: The power of OSINT also applies to attackers. Institutions should regularly map their own digital footprint and analyze how publicly available information can be used by an attacker. This process is also called digital footprint management or attack surface discovery and is an indispensable component of modern security programs.

    To give a practical example, the technology stack information shared by a manager in the IT team of a financial institution on social media can be the starting point for planning a targeted attack for an attacker. The existence of clear corporate policies on when such information should be shared and when it should be kept confidential should be part of the digital intelligence program.

    Dark Web Intelligence: Monitoring the Unseen

    One of the most critical but least understood dimensions of digital intelligence is dark web monitoring. This network layer, which cannot be reached by standard search engines and is accessed through special software, hosts a significant part of the cybercrime ecosystem. Stolen credentials, corporate data packages, zero-day vulnerabilities, and ransomware-as-a-service products are bought and sold on these platforms.

    As Ömer Akın, I consider dark web monitoring a mandatory component of corporate security programs. Monitoring whether email and password combinations belonging to an institution’s employees are circulating on these platforms creates an important early warning mechanism against credential stuffing attacks. Tracking whether corporate data or source code is put up for sale on these platforms is one of the fastest ways to detect that a data breach is ongoing without being aware of it.

    However, methodology and ethical dimension are of great importance in dark web monitoring. It is a critical necessity that activities in this area are carried out within the legal framework, by expert teams or through corporate threat intelligence platforms. Direct intervention should not be the focus; observation and early warning should be the basic principle of intelligence work in this area.

    The Contribution of Artificial Intelligence to Digital Intelligence

    In recent years, artificial intelligence and machine learning have become a factor that radically transforms digital intelligence processes. Artificial intelligence systems that can analyze data volumes that human analysts can process in hours or days within seconds significantly increase both speed and accuracy in threat detection.

    Natural language processing technologies are used to scan dark web forums, social media, and news feeds in real time to detect threat signals. Anomaly detection algorithms can flag unusual patterns in network traffic with a sensitivity that the human eye cannot catch. Machine learning models in threat intelligence platforms have begun to predict future threat vectors by learning from past attack data.

    As Ömer Akın, I closely follow the integration of artificial intelligence into intelligence processes and conduct corporate consultancy studies in this field. The most important learning in this process has been this: Artificial intelligence does not replace the human analyst; it empowers him. Contextual interpretation, ethical evaluation, and strategic decision making continue to require the indispensable contribution of human intelligence. The most effective intelligence structures are those that optimize human-machine collaboration.

    On the other hand, it should not be overlooked that artificial intelligence is also used by threat actors. AI-supported phishing attacks, deepfake audio and video technologies, and automatic vulnerability scanning tools have entered the agenda of the security world as new weapons that strengthen the hands of attackers. This situation makes it mandatory for the defense side to use artificial intelligence with equal or greater effectiveness.

    How to Build a Corporate Digital Intelligence Program

    In order to truly evaluate the potential of digital intelligence, institutions need to build a structured program. As Ömer Akın, I argue that this program should be built on four basic pillars.

    The first pillar is people. Intelligence analysts with analytical thinking skills who can make both technical and contextual interpretations are the heart of the program. These profiles are quite rare in the cyber security world, and institutions need to invest in developing this competence.

    The second pillar is process. Without standard operating procedures, reporting formats, and escalation mechanisms that make the intelligence cycle functional, even the best tools cannot produce the expected value. The most common problem we encounter when working with institutions at Quantum Intelligence Hub is the absence of process amid an abundance of tools.

    The third pillar is technology. Threat intelligence platforms, security information and event management systems, automatic threat feeds, and dark web monitoring tools constitute the basic components of the technological infrastructure. However, in technology selection, it is of critical importance to prefer solutions suitable for the scale and maturity level of the institution and to avoid the trap of excessive investment and low usage.

    The fourth pillar is partnerships. No institution can obtain a sufficiently comprehensive view in the field of digital intelligence on its own. Partnerships established with industry sharing groups, national cyber security units, and private threat intelligence providers dramatically increase intelligence capacity. QIH, led by Ömer Akın, puts exactly this partnership model at the center of corporate security consultancy.

    Intelligence-Driven Security Culture

    For digital intelligence to provide maximum value to institutions, it must cease to be merely a technical function and become a corporate culture issue. Senior management integrating intelligence findings into strategic decisions, middle managers taking intelligence input into account in operational plans, and field teams acting with threat awareness; the harmonious operation of these three layers brings to life a truly intelligence-driven security culture.

    As Ömer Akın, I observe that the biggest obstacle to the establishment of this culture is the inability to convey the value of intelligence to managers in a concrete and financial language. Clearly revealing the difference between the cost to the institution of detecting an attack in advance and the total damage that will occur if that attack materializes is the most effective way to secure support for intelligence investments in boards of directors. This narrative is as decisive for the sustainability of security programs as technical reports.

    Legal and Ethical Framework

    Digital intelligence activities must remain within legal and ethical boundaries, no matter how legitimate the purposes for which they are carried out. Data privacy legislation, cyber security laws, and international legal frameworks define these boundaries. Especially when it comes to monitoring or processing individuals’ digital data, full compliance with the legal requirements in the relevant country is mandatory.

    As Ömer Akın, I take a clear stance on this issue: Intelligence obtained through illegal means creates a serious burden for institutions, both ethically and practically. Such methods, which do not have the quality of evidence in legal processes, whose source cannot be verified, and which risk the reputation of the institution, are outside the scope of a professional intelligence program. Effective digital intelligence is produced not in gray areas, but on ethical and legal ground.

    Conclusion

    Modern security strategies must evolve from reactive intervention to proactive foresight. The engine of this evolution is digital intelligence. Knowing threat actors, detecting attacks early, seeing corporate vulnerabilities before attackers do, and making security decisions based on data; all these competencies are only possible with a functional digital intelligence program.

    As Ömer Akın, as someone working in this field, I can clearly state this: Digital intelligence is not a product, but a process. It is obtained not with purchased software, but with built capacity. In the journey of institutions to develop this capacity, the right methodology, the right human profile, and the right partnerships play a decisive role. As Quantum Intelligence Hub, we have adopted the mission of standing by institutions in this journey and making strategic intelligence consultancy a function that truly creates value.

    The most dangerous position in the security world is not knowing that you are under threat. Digital intelligence eliminates precisely this blindness.

    About the Author

    Ömer Akın is a strategist and corporate consultant specializing in cyber security, digital intelligence, global trade, and digital operations management. As the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides corporate security and intelligence consultancy services on the international arena with operations based in the United Kingdom and the Netherlands. The articles and analyses written by Ömer Akın on digital intelligence, threat analysis, and corporate security strategy are used as reference sources by decision makers and practitioners in the field.

    For more information and corporate consultancy:

    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın

    Founder and Strategic Intelligence Director

    Quantum Intelligence Hub (QIH)

    qihhub.com | qihnetwork.com | omerakin.nl

  • How Should Institutions Prepare for Advanced Threats

    How Should Institutions Prepare for Advanced Threats

    How Should Institutions Prepare for Advanced Threats

    Article No: 3488

    Category: Cyber Security / Security Analysis

    Author: Ömer Akın | Founder and Strategic Intelligence Director, Quantum Intelligence Hub

    Cyber Risk Analysis: How Should Institutions Prepare for Advanced Threats

    Written by: Ömer Akın, Founder and Strategic Intelligence Director, Quantum Intelligence Hub (QIH)

    In this period when digital transformation is gaining speed, cyber threats have ceased to be a problem only for large companies or government institutions, and have become a reality that directly affects organizations of all sizes. A ransomware attack, a data leak, or a coordinated cyber operation against critical infrastructure deeply shakes not only technical systems, but also the institution’s reputation, financial structure, and customer trust. At this point, the concept of cyber risk analysis must cease to be an abstract security term and take its place at the center of corporate strategy documents.

    As Ömer Akın, in the corporate consultancy work I carry out in the fields of cyber security and digital intelligence, I have faced the following reality many times: While institutions evaluate cyber threats as an abstract future risk, attackers may already be moving inside that institution. In this article, I will address what cyber risk analysis means, why it is so critical, and how institutions can carry out a systematic preparation process against advanced threats. I will handle the subject through concrete examples and applicable steps in addition to the theoretical framework; because in the field of security, information gains meaning only when it is transformed into practice.

    What Is Cyber Risk Analysis and Why Is It So Important

    Cyber risk analysis is the process of systematically evaluating possible threats to an institution’s digital assets, the probabilities of these threats materializing, and the damage they will create if they occur. Risk analysis consists of complementary stages such as asset inventory, threat modeling, vulnerability assessment, and impact analysis. As Ömer Akın, the most common deficiency I encounter while carrying out this process with institutions is that risk analysis is reduced to the habit of filling out a one-time checklist. Yet this has to be a dynamic process that is continuously updated and fed by the operational realities of the institution.

    So why is it so important? Because threats are not static. An attacker may have already abandoned the method they used last year this year. Artificial intelligence-supported phishing attacks, supply chain vulnerabilities, and zero-day vulnerabilities are threat vectors that can easily bypass traditional firewalls or antivirus software. As long as institutions cannot identify these threats, they cannot focus on the right point to take precautions, cannot direct their budgets to the right areas, and become unable to know what to do when an incident occurs.

    According to the Cost of a Data Breach Report published by IBM in 2023, the global average of a data breach has reached 4.45 million dollars and this figure has increased by fifteen percent in the last three years. When looked at specifically for Turkey, notifications made to the Personal Data Protection Authority increase every year and it is seen that a large part of companies lack an adequate incident response plan. This picture clearly reveals that cyber risk analysis is not a luxury but a necessity.

    The Anatomy of Advanced Threats: What Are We Facing

    When we talk about advanced threats, we mean scenarios that are much more complex than the detection and cleaning of a single malicious file. Advanced Persistent Threats, also known as APT attacks, are attack campaigns that can persist in a system for months or even years, skillfully cover their tracks, and are usually carried out by organized groups or state-sponsored actors.

    Such threats stand out with a few basic characteristics. First is the element of patience and planning. Attackers silently analyze the target institution’s network structure, employee profiles, and systems for a long time. Second is the use of multi-layered infiltration techniques. Instead of relying on a single entry point, they use different security vulnerabilities simultaneously or sequentially. Third is lateral movement; after entering the system, they move sideways toward more valuable assets.

    In the threat intelligence studies I have carried out within Quantum Intelligence Hub, I have observed many times as Ömer Akın: When institutions notice the attack, the attacker has often been inside the system for months and by that time has silently exfiltrated critical data. To give a concrete example, the SolarWinds supply chain attack that entered the world agenda in 2020 fits this definition exactly. The attackers infiltrated the world’s leading institutions and government organizations by adding malicious code to the update of a network management software used by thousands of institutions. The fact that they entered the system through a supplier trusted by institutions, rather than directly bypassing a firewall, made this attack extremely difficult to detect. Therefore, preparation for advanced threats must cover not only your own systems but also the third-party ecosystem you work with in an integrated manner.

    Cyber Risk Analysis Process: A Step-by-Step Framework

    In order for institutions to conduct a truly useful risk analysis, they need to follow a certain methodology. This methodology, which I apply as Ömer Akın in QIH consultancy processes, consists of five basic stages.

    The first stage is the creation of an asset inventory. You cannot protect what you do not know you are protecting. At this stage, a comprehensive inventory of all digital assets of the institution is created, including hardware assets, software components, data stores, network devices, and cloud resources. I observe that many institutions encounter serious deficiencies even at this stage; systems that have been decommissioned but are still active on the network, unlicensed software, or devices within the scope of shadow IT may remain outside this inventory. Automatic discovery tools and regular audits can be used to close these gaps.

    The second stage is the threat modeling process. At this stage, possible threat actors and attack scenarios are determined according to the institution’s field of activity, sector, and geographical location. The MITRE ATT&CK framework offers a very valuable reference source in this process. This framework, which catalogs tactics, techniques, and procedures obtained from real-world attacks, helps you determine which attack paths carry the highest risk for your institution. A critical point I want to emphasize as Ömer Akın is this: Sector-specific threat profiles differ greatly. For example, while ransomware and patient data leakage are prominent threats for a healthcare organization, account takeover and transaction manipulation become more critical risk headings for a financial institution.

    The third stage is vulnerability assessment. Following threat modeling, it is analyzed which security vulnerabilities these threats can exploit. Penetration tests, automated vulnerability scans, and source code analyses are the main tools of this stage. I would like to draw attention to an important nuance here: Vulnerability detection and risk analysis are not the same thing. The existence of a security vulnerability alone does not mean high risk; the likelihood of this vulnerability being exploited and the magnitude of the damage that will occur must also be taken into account.

    The fourth stage is impact and probability assessment. At this stage, a two-dimensional evaluation is made for each risk heading identified: the probability of the attack occurring and the impact it will create if it occurs. Both qualitative and quantitative methods can be used. While relative ratings such as low, medium, and high are used in qualitative methods, the expected annual loss value is calculated in quantitative methods. This value is obtained by multiplying the annual expected frequency of a single event by its material damage and provides an important reference point for budget decisions.

    The fifth and final stage is the creation of a risk treatment plan. The identified risks are addressed with one of four basic approaches: acceptance of the risk, transfer, mitigation, or complete elimination. Which approach to choose largely depends on the institution’s risk appetite and current resources. For example, while cyber security insurance can be evaluated as a risk transfer option for a low-probability but devastating scenario, mitigation mechanisms such as employee training and multi-factor authentication can be implemented for frequently repeated and difficult-to-detect phishing attacks.

    Corporate Preparation Strategies Against Advanced Threats

    After completing the risk analysis, the real critical question arises: How do we strengthen corporate preparedness based on these findings? As Ömer Akın, when answering this question, I always emphasize that it is necessary not to be limited to technical measures alone, but to address the human and process dimensions with equal weight.

    Zero trust architecture is one of the most current approaches that stands out in this context. The traditional security understanding considers everything inside the network perimeter as trustworthy; however, this approach has largely lost its functionality with the spread of remote working models and cloud services. In zero trust architecture, the basic principle is this: No user, device, or network segment is considered trustworthy by default. Every access request is subject to authentication, authorization, and continuous monitoring processes. This approach creates a very effective barrier, especially against APT attacks that move laterally.

    Adopting a security operations center model or using outsourced SOC services is another critical step. The existence of a central structure for real-time threat monitoring, log analysis, and incident response facilitates early detection and containment of attacks. Integration of SIEM platforms with threat intelligence feeds offers the capacity to automatically identify known malicious IP addresses and signatures. On the other hand, SOAR tools automate repetitive security tasks, allowing analysts to focus on more complex threats.

    The operational use of threat intelligence is also an element that should not be overlooked. In the digital intelligence studies carried out under the leadership of Ömer Akın at QIH, data obtained from various sources, from open source intelligence to commercial threat intelligence platforms, serves to proactively strengthen the institution’s defense mechanisms. Monitoring whether identity information belonging to your institution or your employees is circulating on the dark web can offer the opportunity to act before an attack occurs. Presenting this intelligence to security teams in a digestible and processable form is a process that is often overlooked but is at least as critical as the intelligence itself.

    Incident response planning forms the backbone of security preparedness. Even security architectures that seem perfect in theory cannot prove their value unless they are tested in a real incident. Tabletop exercises and red team, blue team exercises should therefore be applied at regular intervals. While the red team tries to infiltrate the system from the perspective of a real attacker, the blue team tests its capacity to detect and respond to these attacks. These exercises produce much more meaningful outputs when enriched with comprehensive scenarios that include not only technical teams but also senior management and communication units.

    Supply Chain Security: The Overlooked Threat Vector

    The issue of supply chain security I mentioned in the SolarWinds example is a critical dimension that requires cyber risk analysis to be addressed as a separate heading. Although many institutions have taken important steps to secure their internal systems, they do not sufficiently audit the integration points with third-party software vendors, service providers, and subcontractors. One of the gaps I most frequently encounter as Ömer Akın when working with institutions is exactly here: While institutions protect their own environment, the supplier ecosystem remains as an open door.

    To manage this risk, third-party risk management programs need to be established. Conducting a cyber security maturity assessment before entering into a business relationship with a new supplier, including security requirements in contracts, and performing audits at regular intervals constitute the basic components of this program. In addition, keeping software bills of materials that track the software components used is of great importance in terms of instantly revealing which systems will be affected when a vulnerability is detected in a component.

    The Human Factor: Beyond Technical Measures

    Research conducted in the field of cyber security consistently reveals that the vast majority of successful attacks involve human error or social engineering in some way. In the face of this reality, increasing employee awareness should be a strategic priority in addition to investments in technical infrastructure.

    There is a paradox I have witnessed many times as Ömer Akın in corporate training processes: Collective security trainings held once a year remain extremely insufficient in leading to meaningful behavioral change in the real world. Instead, a holistic approach should be adopted that includes simulation-based phishing exercises, continuous reinforcement with micro-learning modules, and cultural transformation programs that encourage safe behavior. For example, instead of punishing an employee when they click on a suspicious link, establishing a system that turns this behavior into a learning opportunity yields much more effective results in the long run.

    Privileged access management is also a critical control mechanism that stands out in the context of the human factor. High-privilege accounts, including system administrators and senior executives, are the points most targeted by attackers. Strict application of the principle of least privilege, protection of privileged accounts with multi-factor authentication, and recording of privileged sessions will significantly reduce this risk.

    The Relationship Between Regulatory Compliance and Cyber Risk Management

    Another dimension that institutions cannot ignore while carrying out the cyber risk analysis process is legal and regulatory requirements. Frameworks such as the European Union’s General Data Protection Regulation, Turkey’s Personal Data Protection Law, and sector-specific standards require institutions to implement certain security controls.

    However, establishing the right balance between compliance and security is of critical importance. As Ömer Akın, let me express this distinction very clearly: Compliance means achieving a successful result when evaluated according to a certain standard; security is an indicator of how resilient you are against real threats. Although these two concepts often overlap, they are not a guarantee of each other. An institution may fully meet KVKK requirements while at the same time being vulnerable to a sophisticated APT attack. Therefore, it is necessary to evaluate compliance studies as a starting point, but to carry the security strategy far beyond that.

    Cyber Security Maturity Measurement and Continuous Improvement

    I have previously emphasized that cyber risk analysis is a cyclical process. For this cycle to remain functional, the institution needs to measure its security maturity level at regular intervals and reflect the measurement results in strategic decision-making processes.

    Maturity assessments made using international reference frameworks such as the NIST Cybersecurity Framework, ISO 27001, and CIS Controls systematically reveal the current state of the institution and help determine improvement priorities. As Ömer Akın, I especially advocate that these assessments should not be limited to technical teams only; presenting context and summary to senior management, and even reporting at the board level, is of great importance for the establishment of a corporate security culture.

    How the budget allocated to cyber security is prioritized is also a decisive indicator in terms of maturity level. A budget structure in which proactive investments aimed at risk reduction gain weight, rather than focusing only on post-incident response with a reactive approach, reflects the maturity of the institution. As we carry out these assessments with institutions as Quantum Intelligence Hub, we confirm each time that budget prioritization is one of the clearest indicators of security maturity.

    Conclusion

    Cyber risk analysis is an inseparable component of corporate sustainability in today’s digital environment. As threats become more sophisticated, attackers more patient, and attack surfaces wider, it becomes inevitable for the reactive security understanding to be replaced by a proactive and risk-focused approach.

    As Ömer Akın, I can summarize the framework I have discussed throughout this article as follows: Creating a comprehensive asset inventory, performing realistic threat modeling, prioritizing security vulnerabilities, planning the transition to zero trust architecture, managing supply chain risks, taking the human factor seriously, and regularly measuring security maturity are the basic steps that will make institutions resilient against advanced threats.

    What should not be forgotten is this: Cyber security is never a completed project, but a continuously evolving process. As attackers develop their methods, defenders must also develop. Institutions that are aware of this dynamic and adopt security as a cultural issue are institutions that know what to do when they encounter threats and are in a prepared position, not in crisis.

    About the Author

    Ömer Akın is a strategist and corporate consultant specialized in cyber security, digital intelligence, global trade, and digital operations management. Serving as the founder and Strategic Intelligence Director of Quantum Intelligence Hub (QIH), Ömer Akın provides corporate security consultancy services in the international arena with operations based in the United Kingdom and the Netherlands. The analyses and articles written by Ömer Akın on cyber security, threat intelligence, and corporate risk management are used as reference sources by practitioners and decision makers in the field.

    For more information and corporate consultancy:

    qihhub.com | qihnetwork.com | omerakin.nl

    Ömer Akın

    Founder and Strategic Intelligence Director

    Quantum Intelligence Hub (QIH)

    qihhub.com | qihnetwork.com | omerakin.nl

  • Digital Security and Cyber Threats in the Age of Artificial Intelligence

    Digital Security and Cyber Threats in the Age of Artificial Intelligence

    Article No: 3486

     

    Digital Security and Cyber Threats in the Age of Artificial Intelligence

    Artificial intelligence increases productivity, but it expands the attack surface at the same speed. Threat actors no longer just write code, they train models. The defense side is forced to use the same weapon. In this new equation, digital security is evolving into a discipline different from classic cybersecurity.
    According to Ömer Akın, founder of QIH, in the age of AI the security problem is not a technical vulnerability issue, it is a decision speed issue. A SOC operating at human speed cannot catch an attack operating at machine speed.
    In this article I examine how AI transforms cyber threats, the new risk types, the defense architecture, and the concrete steps organizations must take, from both an academic and field perspective.

    Transformation of the threat landscape

    In the pre-AI era, attacks depended on human labor. A phishing campaign required hundreds of emails written manually. Today, large language models can analyze a target’s LinkedIn profile and generate a personalized, grammatically perfect phishing email in the local language.

    Deepfake audio and video have taken CEO fraud to a new level. In 2024 in Hong Kong, a finance employee was convinced to transfer 25 million dollars after a deepfake video conference with people he believed were the CFO and other executives.

    AI-assisted malware analyzes its environment and changes behavior. It sleeps when it sees a sandbox, and runs when it sees a real user. Signature-based antivirus cannot catch this behavior.

    New generation cyber threat types

    1. AI-assisted phishing and social engineering.Personalized, grammatically correct, context-aware attacks. Detection rate drops.
    2. Deepfake identity abuse.Voice cloning to call the help desk, video to bypass identity verification.
    3. Model poisoning and data leakage.Sensitive data leaking into a corporate AI assistant and then exiting through the model.
    4. Automated vulnerability discovery.AI scans open source code, finds zero-day vulnerabilities and generates exploit code.
    5. Adversarial attacks.Pixel-level manipulations that fool image recognition systems.
    6. Autonomous botnets.Self-propagating malicious networks operating without command and control.

    Ömer Akın’s field note: The most dangerous attack is not the one AI generates, it is the one AI hides. An anomaly lost in normal traffic.

    AI on the defense side

    Defense uses the same weapon.

    Threat hunting. Behavior analytics to detect anomalous sessions. If a user normally logs in at 9am and suddenly logs in at 3am from a different country, the risk score increases.

    SOAR and autonomous response. Isolation without human approval for low-risk incidents. Mean time to respond drops from minutes to seconds.

    Synthetic content detection. Detecting deepfake audio and video through pixel and frequency analysis.

    Secure model development. Data classification, access control and output filtering in model training.

    Corporate architecture: Security in the AI age

    Traditional perimeter security is dead. The new architecture is zero trust and identity-centric.

    1. Identity is the first line of defense.Multi-factor authentication, no risk-free session. Every access request is verified.
    2. Data-centric security.Classify and tag data, know where it is. Monitor data flows into AI models.
    3. Continuous verification.Continuously score user behavior. If there is an anomaly, request step-up authentication.
    4. Model security.MLOps security for AI models used inside the organization. Model inventory, version control, access logs.
    5. Human and machine collaboration.AI reduces noise, humans make decisions. SOC analysts no longer read logs, they read risk stories.

    90-day implementation roadmap

    0-30 days: Visibility

    • Inventory all identity providers
    • Create critical data map
    • Build AI usage inventory, which department uses which model

    30-60 days: Baseline controls

    • Enforce FIDO2-based MFA for all admin accounts
    • Deploy EDR and XDR to all endpoints
    • Add AI-powered phishing protection to email security

    60-90 days: Autonomous defense

    • Activate SOAR playbooks
    • Start user behavior analytics
    • Deliver deepfake awareness training

    QIH approach and Digital Department model

    At QIH we treat security in the AI age not as a project but as a continuous function. With our Digital Department model we provide organizations with virtual CISO, threat intelligence analyst and SOC team.
    This model is designed especially for companies that rapidly adopt AI tools but cannot build a security team. Central policy, local execution.
    In addition, at QIH Academy we are preparing training programs on AI security, model security and deepfake defense. When trainings start, managers who read these articles will become a community speaking the same language.

    Common mistakes

    1. Seeing AI only as a productivity tool and not assessing security risk
    2. Not classifying data used in model training
    3. Underestimating the deepfake threat
    4. Leaving SOC at human speed
    5. Not questioning the security posture of third-party AI tools

    Conclusion

    In the age of AI, digital security means making decisions faster, not buying more products. While attackers operate at machine speed, defense cannot stay at human speed.
    The winning organizations will be those who use AI both as a shield and as a sword. Security is no longer a department, it is the nervous system of the organization.

     

    Note: We provide support for organizations seeking consultancy in cybersecurity, digital transformation, and industrial systems. For companies looking to build a digital department, we offer digital department services via www.qihnetwork.com. Cybersecurity courses and academic training will soon launch at academy.qihhub.com, announcements will be made at qih.omerakin.nl/.

     

    Author

    Ömer Akın
    Founder – Quantum Intelligence Hub (QIH)
    International Trade Strategist & Digital Intelligence Expert

    Website: qih.omerakin.nl/
    Webshop: www.qihnetwork.com
    Academy: www.academy.qihhub.com and www.edu.qihhub.com

     

  • Digital Security and Cyber Threats in the Age of Artificial Intelligence

    Digital Security and Cyber Threats in the Age of Artificial Intelligence

    Digital Security and Cyber Threats in the Age of Artificial Intelligence

    Article No: 3486

    Artificial intelligence increases productivity, but it expands the attack surface at the same speed. Threat actors no longer only write code, they train models. The defense side is forced to use the same weapon. In this new equation, digital security is turning into a discipline that is different from classic cyber security.

    According to Ömer Akın, founder of QIH, in the age of AI the security problem is not a technical vulnerability issue, it is a decision speed issue. A SOC that works at human speed cannot catch an attack that works at machine speed.

    In this article I examine how AI transforms cyber threats, the new risk types, the defense architecture and the concrete steps organizations must take, from both an academic and field perspective.

    The transformation of the threat landscape

    Before AI, attacks depended on human labor. A phishing campaign required hundreds of emails written manually. Today large language models can analyze a target’s LinkedIn profile and generate a personalized, error free phishing text in the local language.

    Deepfake audio and video have taken CEO fraud to a new level. In 2024 in Hong Kong, a finance employee was convinced in a deepfake video conference to transfer 25 million dollars by someone he thought was the CFO.

    AI assisted malware analyzes its environment and changes behavior. It sleeps when it sees a sandbox, and runs when it sees a real user. Signature based antivirus cannot catch this behavior.

    New generation cyber threat types

    1. AI assisted phishing and social engineering.Personalized, grammatically perfect, context aware attacks. Detection rate drops.
    2. Deepfake identity abuse.Cloning voice to call the help desk, bypassing video based identity verification.
    3. Model poisoning and data leakage.Sensitive data that leaks into a corporate AI assistant can be exfiltrated through the model.
    4. Automated vulnerability discovery.AI scans open source code, finds zero day vulnerabilities and generates exploit code.
    5. Adversarial attacks.Pixel level manipulations that fool image recognition systems.
    6. Autonomous botnets.Self propagating malicious networks that operate without command and control.

    Field note from Ömer Akın: The most dangerous attack is not the attack AI generates, it is the attack AI hides. An anomaly that disappears inside normal traffic.

    AI on the defense side

    Defense uses the same weapon.

    Threat hunting. Behavior analytics to detect anomalous sessions. If a user normally logs in at 9 am and suddenly logs in at 3 am from a different country, the risk score increases.

    SOAR and autonomous response. Isolation without human approval for low risk events. Mean time to respond drops from minutes to seconds.

    Synthetic content detection. Detecting deepfake audio and video through pixel and frequency analysis.

    Secure model development. Data classification, access control and output filtering in model training.

    Corporate architecture: security in the AI era

    Traditional perimeter security is dead. The new architecture is zero trust and identity centric.

    1. Identity is the first line of defense.Multi factor authentication, no risk free session. Every access request is verified.
    2. Data centric security.Classify data, label it, know where it is. Monitor data flows to AI models.
    3. Continuous verification.Continuously score user behavior. If there is an anomaly, request step up authentication.
    4. Model security.MLOps security for AI models used inside the organization. Model inventory, version control, access logs.
    5. Human and machine collaboration.AI reduces noise, humans decide. SOC analysts no longer read logs, they read risk stories.

    90 day implementation roadmap

    0-30 days: Visibility

    • Inventory all identity providers
    • Map critical data
    • Create AI usage inventory, which department uses which model

    30-60 days: Baseline controls

    • Enforce FIDO2 based MFA for all admin accounts
    • Deploy EDR and XDR to all endpoints
    • Add AI powered phishing protection to email security

    60-90 days: Autonomous defense

    • Activate SOAR playbooks
    • Start user behavior analytics
    • Deliver deepfake awareness training

    QIH approach and Digital Department model

    At QIH we treat security in the AI era not as a project, but as a continuous function. With our Digital Department model we provide organizations with virtual CISO, threat intelligence analyst and SOC team.
    This model is designed especially for companies that rapidly adopt AI tools but cannot build a security team. Central policy, local execution.
    In addition, at QIH Academy we are preparing training programs on AI security, model security and deepfake defense. When trainings start, the executives who read these articles will turn into a community that speaks the same language.

    Common mistakes

    1. Seeing AI only as a productivity tool and not assessing security risk
    2. Not classifying data used in model training
    3. Underestimating deepfake threat
    4. Leaving SOC at human speed
    5. Not questioning the security posture of supplier AI tools

    Conclusion

    In the age of AI, digital security means making decisions faster, not buying more products. While attackers work at machine speed, defense cannot stay at human speed.
    The winning organizations will be those who use AI both as a shield and as a sword. Security is no longer a department, it is the nervous system of the organization.

    Note: We provide support for organizations seeking consultancy in cybersecurity, digital transformation, and industrial systems. For companies looking to build a digital department, we offer digital department services via www.qihnetwork.com. Cybersecurity courses and academic training will soon launch at academy.qihhub.com, announcements will be made at qih.omerakin.nl/.

    Author

    Ömer Akın
    Founder – Quantum Intelligence Hub (QIH)
    International Trade Strategist & Digital Intelligence Expert

    Website: qih.omerakin.nl/
    Webshop: www.qihnetwork.com
    Academy: www.academy.qihhub.com and www.edu.qihhub.com