Sarajevo and the Cybersecurity Questions No Organisation Can Solve Alone
Semir Dedic, Cyber Security Summit
A city becomes relevant to cybersecurity when it can host the questions organisations cannot resolve on their own. Who has the authority to disconnect a production system at two in the morning, and does that person need to wake a minister first? How long are authentication logs retained, and could you reconstruct ninety days of privileged sign-ins if asked tomorrow? Can you produce a list of internet-facing systems that is accurate today rather than at the date of the last audit? Has a restore from backup been timed, and what was the measured recovery time against copies that were offline or immutable? Does a supplier’s remote access expire by default, or does it persist until someone remembers to revoke it? And what does the board actually receive: an account of consequences and cost, or a slide of traffic-light indicators?
The European evidence base has become more specific about which of these matter. ENISA’s 2025 Threat Landscape examined 4,875 incidents between 1 July 2024 and 30 June 2025. Distributed denial of service accounted for roughly 77 per cent of reported incidents, largely hacktivist activity against public-facing websites, and only a small share produced meaningful service disruption. Ransomware remained the most damaging threat by impact. Just over half of the recorded incidents involved entities that would fall within the scope of NIS2 as essential entities. The distinction between volume and consequence is the useful part for anyone building a programme: a plan driven by incident counts will spend on the noisiest category, while the losses continue to come from encryption, extortion and fraud. The same report also shows how access itself has become commoditised, with Initial Access Brokers selling compromised access at scale, while phishing, credential theft and information stealers continue to feed that ecosystem. For organisations, that puts greater emphasis on identity, credential and session security, phishing-resistant authentication and control of privileged access.
Bosnia and Herzegovina has a recent case that illustrates the point without any need for dramatisation. On 24 July 2026, Igman d.d. Konjic, a majority state-owned company in the defence sector, was the subject of a business email compromise. The precision and timing of the fraudulent instruction strongly suggest that the attackers had visibility into the underlying business communication, whether through a compromised mailbox or another source. Publicly available information, however, does not establish exactly where that access occurred. What is publicly confirmed is that the fraudulent instruction came from an address almost identical to that of an existing business partner and resulted in a transfer of approximately EUR 780,000. The case was taken over by the criminal police of the Herzegovina-Neretva Canton Ministry of the Interior, with the cantonal prosecutor’s office in Konjic and SIPA notified. Investigators traced a large part of the money to an account in the Netherlands, where it was blocked, while roughly EUR 180,000 reached accounts in the United Arab Emirates. The Centre for Security Studies put the total exposure at more than 1.5 million BAM.
Nothing in that sequence required an unusual capability on the attacker’s side. It is not publicly established where in that chain the attacker gained visibility into the correspondence, whether through a compromised mailbox or another means. The loss happened because a change of banking details was not verified through a channel independent of email. The partial recovery depended on how quickly a recall was issued and on cross-border cooperation between banks and police, which is a coordination capability rather than a product. Each of those stages corresponds to a control that is cheap to specify and awkward to enforce: supplier email authentication and monitoring, a mandatory out-of-band callback for any change of payment data, and a rehearsed escalation path to a bank and a police unit that answers at the weekend.
This is where the institutional gap in Bosnia and Herzegovina becomes a technical problem rather than a political complaint. In September 2025, the OSCE Mission noted that Bosnia and Herzegovina remained the only country in South-East Europe without a state-level cybersecurity strategy and a fully operational state-level computer emergency response team. Bosnia and Herzegovina is only beginning the process of establishing the capacities required for a functional state-level CERT. A Government CERT / Team for Response to Computer Incidents in Institutions of Bosnia and Herzegovina formally exists, and the initial steps now under way are encouraging. The country, however, still lacks a fully operational national CERT with the staffing, mandate, procedures and response capacity required for effective coordination of serious cyber incidents. I hope this process will continue in the right direction and develop into a capability that institutions and critical sectors can rely on when it matters.
A strategic framework exists at the level of Republika Srpska, and EU progress reports have repeatedly asked the state to complete its framework against cybercrime. In July 2026, the Centre for Security Studies noted that after five years the Council of Ministers had approved premises for the state team, but that no staff had been appointed. The consequences are concrete. A bank, hospital or telecommunications operator has no national point of contact with a duty roster at three in the morning. There are no agreed reporting thresholds or a shared incident taxonomy, which means cross-sector reporting cannot be aggregated even in principle. There is no body with a legal basis to receive, sanitise and redistribute indicators of compromise. And there is no baseline against which anyone can say whether several years of donor funding improved the security of essential services. The 2022 incident affecting the Parliamentary Assembly is a useful example: no detailed public post-incident account of the cause, findings or lessons learned has been published, limiting what other institutions can learn from the event.
Coordination work is already happening in the city. In April 2026, representatives of the Ministry of Security of Bosnia and Herzegovina, the government CERT and the Integrative Internal Security Governance initiative met at the Regional Cooperation Council headquarters in Sarajevo to discuss cybersecurity needs, strategic planning and donor coordination. The value of such meetings is not a further declaration. It is whether the operating model becomes legible: which institution leads, which technical team responds, what data can lawfully be shared, and whether external support is tied to capability targets that can be verified, such as a staffed roster, defined service hours, a mandate to handle incident data and an agreed constituency.
The regulatory environment raises the standard of the discussion further, including for organisations outside the European Union. NIS2 covers eighteen sectors across its two annexes and introduces risk-management measures, supply-chain security, senior-management accountability and a staged reporting sequence: an early warning within 24 hours, a fuller notification within 72 hours and a final report within one month.
From 11 September 2026, Article 14 of the Cyber Resilience Act introduces separate reporting obligations for manufacturers of products with digital elements. Actively exploited vulnerabilities and severe incidents require an early warning within 24 hours and a fuller notification within 72 hours. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure becomes available; for a severe incident, the final report is due within one month of the 72-hour notification. Financial entities in the EU have been operating under DORA since January 2025.
For organisations in Bosnia and Herzegovina, the impact is not uniform. Many will encounter these requirements through EU customers, group structures, supply chains and contractual obligations. Others, particularly manufacturers placing products with digital elements on the EU market, may fall directly within the scope of EU rules such as the Cyber Resilience Act.
The practical questions remain the same: could you file an early warning within 24 hours if an incident begins on a Friday evening? Who is authorised to submit it, and to which recipient? Is your asset and component data good enough to answer “are we affected?” in hours rather than weeks? Are vulnerabilities prioritised by exposure and business impact, or simply by the length of a scanner report?
The sixth Sarajevo Cyber Security Summit takes place on 18 and 19 November 2026 at Hills Congress Center Sarajevo, with expert talks, panels, workshops, CyberSec Expo and a Capture the Flag competition. Those formats are not interchangeable, and the programme is stronger when each is used for what it can carry. A policy panel can work through governance, reporting thresholds and the division of responsibility between state and entity level. Technical sessions can address identity management, endpoint telemetry and its retention cost, cloud configuration, OT segmentation and incident triage. A workshop can test whether participants can convert a risk finding into a remediation plan with an owner and a date, or run an exercise with legal and communications staff in the room rather than briefed afterwards. A Capture the Flag competition builds and demonstrates practical skill, and it is more useful when paired with a discussion of how that skill is retained: what institutions pay, what career paths exist, and how much capability the region loses to employers abroad each year.
The failures worth programming for are rarely conceptual. Organisations do not fail because they have not heard of ransomware. They fail because administrators share accounts, because privileged access lacks phishing-resistant multi-factor authentication, because stolen session tokens bypass the multi-factor authentication that does exist, because backups were reachable from the compromised domain, because restore was never exercised under time pressure, because a supplier kept standing VPN access for two years after the project ended, because there is no out-of-band communication channel when email is untrusted, and because nobody is named in advance as the person who can order systems offline.
Sarajevo is becoming a serious venue for this work because it can bring regional institutions, operators and technical specialists into the same room around dependencies they share. The city does not need to claim a mature national cyber architecture. Its value is that the work is unfinished and the cost of weak coordination is documented rather than hypothetical. The measure of the sixth edition will be whether, in the weeks afterwards, specific decisions have owners and dates attached to them.
