After two days of fake bomb threats hitting thousands of schools, on Thursday a headline in Repubblica summed up the situation perfectly: the intelligence services had flagged the threat, no plan was ready, and now there’s “the idea of a spam filter.”
I confess we laughed.
Then we stopped, because that headline describes an awful lot of Italian and Sammarinese companies.
The comic part is obvious.
Everyone’s talking about hybrid warfare, intelligence agencies, emergency meetings at Palazzo Chigi, and in the end the countermeasure is that thing that shifts mattress ads into a folder.
The serious part is that it works.
On Wednesday the email reached 6,300 schools and triggered evacuations in about three hundred of them: most, according to AGI, had ended up in spam. Between panic and a normal morning, in many schools, sat a folder nobody ever checks.
Then there’s the part that concerns you.
There really was no plan: headteachers say so themselves, and schools’ emergency procedures cover fires and earthquakes, not emails. So everyone made their own call. In Florence, the school was evacuated “since the responsibility is mine,” the principal explained to Il Post.
In the province of Vicenza, one school only noticed the email an hour later.
Now drop the word “school” and swap in the word “company.”
The day your email server goes down, your management software won’t open, or a wire transfer fires off that nobody authorized, the questions are exactly the same as Wednesday’s: who decides, and who gets the call.
I know: coming from someone who works in cybersecurity, it’s a bit like asking the innkeeper if the wine is good. That’s why we’re only sharing things you can do without buying anything, from us or anyone else.
A small company’s plan fits on a single sheet of paper.
One name: whoever decides on that day, a person, not a committee meeting. Three phone numbers: the IT technician, the bank, law enforcement. Where the data backups are, and when someone last actually tried reopening them. Who holds the keys to email, the management system and the bank account, including former employees. The sheet should be printed, because that day the computer might not even turn on.
Almost nobody does this, and it isn’t a question of money.
Real security is boring.
Nobody has ever felt like James Bond while checking a backup. People feel like James Bond talking about hybrid warfare.
Meanwhile, attackers go after whoever is cheapest to hit, which means the small players.
And the numbers keep climbing: in Italy, the National Cybersecurity Agency recorded more incidents in the first nine months of this year than in all of 2025 combined.
The State had its intelligence services, and still had no plan.
A company in San Marino doesn’t have intelligence services. All it has is the sheet of paper.
Monday morning is a good time to write it.
Osservatorio Strategic.sm
