Cyberattacks are increasing but Sweden practices the least cyber preparedness in the Nordic countries

One of the most important security measures a business can take is to practice its emergency response plan. Sweden lags behind other countries in Northern Europe in this regard, according to the CIO Analytics survey. The least common occurrence is in municipalities, which highlights the need for more efforts in the sector.

CIO Analytics is an annual survey of IT decision-makers in the Nordics and Baltics. In 2026, 1,478 IT leaders answered questions on everything from AI use to resource challenges and security preparedness. When it comes to the latter, Sweden stands out, in a negative way.

– Only 15 percent of Swedish businesses regularly practice their emergency plans. This is significantly fewer than in our neighboring countries, where one in four practices continuously. This is despite the fact that we are more likely to report that we have been exposed to attacks that have impacted our operations, says Carl Johan Ekelund, head of security at Atea Sweden.

The survey shows that the private sector works more frequently with emergency preparedness training and that one in five companies does it on an ongoing basis. The fact that the public sector in general, and municipalities in particular, exercises less is due to several factors. This may be because security does not receive the attention of municipal management, that exercises are considered to take up too much time and costs, or that people are naive about the effects an attack can have.

– It may seem strange since we have seen several high-profile attacks on municipalities and municipal operations in the past year alone. But for preparedness work to have a real impact, it needs to be a shared responsibility between IT, operations and management, says Carl-Johan Ekelund.

To support municipalities and other businesses in developing their preparedness, we offer Atea Sweden training sessions in a mobile "Escape Room" during its IT summit Atea Bootcamp, and later in the autumn in Stockholm. Once inside, businesses get to test being under sharp attack, reflect on how they themselves react and practice handling an incident together with other businesses. All sessions during Atea Bootcamp were booked up within the first hour, which shows that many understand the importance of training their preparedness.

– This type of initiative shows that the will to strengthen preparedness is high. At the same time, the conditions are different and the resources differ between, for example, a small and a large municipality. The private sector can take greater responsibility in this and help municipalities through more flexible security arrangements. Among other things, we have a number of municipalities that are collaborating within the ”Safer Together” initiative, which enables joint development and shared investments, says Carl-Johan Ekelund.