Cybersecurity in Belgium in 2026: 5 Key Takeaways from the CCB Report

Cybersecurity maturity is improving in Belgium, but this progress still masks significant disparities among organizations. SMEs, NIS2, artificial intelligence, OT environments, and the skills shortage are among the key challenges highlighted in the new CCB/NCC-BE report on the Belgian cybersecurity market.

What specific takeaways should Belgian companies take from this?

At Shinka, we’ve analyzed this report and selected five key takeaways that we believe are particularly important for executives, CIOs, IT managers, and cybersecurity leaders.

Cybersecurity risk is now a business risk

The report’s first conclusion is likely the most fundamental: cybersecurity now extends far beyond the scope of the IT department.

According to the data included in the study, 44% of companies view a cyberattack as an existential threat, while 53% to 60% report that their concern about cyber risk is increasing.

However, this awareness does not always translate into appropriate governance. 25.2% of organizations identify the lack of priority given to cybersecurity at the management level as an obstacle to their progress.

Why is this important?

Today, a cyberattack can directly affect:

• business continuity;
• production;
• company data;
• reputation;
• relationships with customers and suppliers;
• regulatory compliance.

Cybersecurity must therefore be viewed as a business risk, just like financial, operational, or regulatory risks.

Question to ask yourself
Does your organization regularly address cybersecurity risk at the management level, or is it still primarily managed by IT?

SMEs continue to face a significant cybersecurity maturity gap

The study reveals a major disparity based on the size of organizations.

Only 16.7% of micro-enterprises and 23.4% of small businesses have a formal cybersecurity policy, compared to 61% of large enterprises.

This difference cannot be explained solely by budget constraints. The report highlights several challenges: a persistent perception that small businesses are less likely to be targeted, competition between cybersecurity and operational priorities, and the difficulty of transforming the vast amount of available information into concrete, prioritized actions.

What Should Be a Priority for an SME?

An SME does not necessarily need to stockpile security tools. Above all, it must be able to answer a few essential questions:

1. What are our critical assets?
2. What are our main risks?
3. Who has access to our critical systems and data?
4. Are we able to quickly detect a compromise?
5. What specific steps would we take in the event of a major incident?

The priority, therefore, is to establish a cybersecurity roadmap tailored to the actual level of risk, rather than simply piling on solutions.

NIS2 must become a driver of resilience, not just a checklist

NIS2 is currently one of the main drivers of the Belgian cybersecurity market.

In the spring of 2026, the report indicates that more than 8,100 organizations were registered with the CCB, including more than 4,300 as NIS2 entities.

But one of the document’s key takeaways is precisely that NIS2 should not be reduced to a mere administrative process. The goal must remain the effective reduction of cyber risk.

What does it mean, in practical terms, to be more resilient?

A meaningful NIS2 approach should, in particular, lead the company to better understand:

• its critical assets;
• its vulnerabilities;
• its identities and access;
• its dependencies on third parties;
• its detection capabilities;
• its incident response procedures;
• its ability to ensure business continuity and recovery.

Key Takeaway
Compliance can be the starting point. Resilience must remain the goal.

Artificial Intelligence and OT Are Transforming the Attack Surface

Two technological developments stand out in particular in the report: artificial intelligence and the convergence of IT and OT.

AI Now Plays a Role on Both Sides

76% of the organizations surveyed view artificial intelligence as an opportunity for cybersecurity, and 51% report already using it to strengthen their security. But at the same time, 91% believe that AI facilitates cyberattacks.

In particular, automation can make phishing, deepfakes, vulnerability scanning, and the industrialization of malicious campaigns more accessible or more effective. The report also draws attention to new risks associated with the accelerated development of applications using AI.

OT poses another major challenge

The convergence of IT networks, industrial systems, and connected devices also increases the number of assets that may be exposed. 21% of Belgian organizations surveyed expressed concern about a compromise of their ICS/OT systems.

The report highlights several very concrete issues: legacy systems, forgotten devices, incomplete inventories, and outdated vendor access credentials.

For an industrial organization, one question therefore becomes fundamental: Do you know exactly which devices are connected to your environment and who can access them?

Asset visibility, network segmentation, and access control are becoming essential prerequisites even before considering more advanced detection tools.

The skills shortage is pushing companies toward new models

Technology is only part of the equation.

The report cites an estimate of 6,190 cybersecurity professionals expected to be in short supply in Belgium by 2025. In the cybersecurity sector itself, 1,170 positions were vacant, representing a vacancy rate of 12.4%.

Not all organizations will therefore be able to build an in-house team covering the full range of necessary skills.

This makes an approach combining the following particularly relevant:

• in-house expertise;
• specialized partners;
• managed security services;
• automation;
• controlled use of artificial intelligence.

The report also highlights the role that Managed Service Providers can play in improving the resilience of SMEs.

The Right Question
Do we have access to the right skills and capabilities when we need them?

What Should We Take Away About Cybersecurity in Belgium in 2026?

Ultimately, the report presents a rather mixed picture. Awareness is growing, regulation is accelerating investment, and defense technologies are evolving. But gaps in maturity remain significant, particularly within small organizations.

1. Make cybersecurity a management priority. Cyber risk must be understood and monitored at the enterprise level.
2. Know your assets and your risks. It’s hard to protect what you don’t know.
3. Transform NIS2 into a genuine resilience strategy. Compliance alone does not guarantee security.
4. Anticipate changes in the attack surface. AI, OT, identities, the cloud, and interconnections must be part of a comprehensive strategy.
5. Organize access to the necessary skills. The model combining internal teams, specialized partners, and managed services is becoming increasingly relevant.

How can you quickly assess your level of cyber resilience?

Before investing in a new solution, an organization can start by answering six simple questions: