Cyber defence: the plan is in place, but politicians have yet to act on it

Two dates are enough to illustrate the paradox of Italian security. On 17 November 2025, Guido Crosetto presented a document on hybrid warfare to the Supreme Defence Council: it is not enough to react to attacks; they must be prevented. Almost a year later, amidst tampered-with fridges, false bomb alerts and personal data leaked onto the dark web, the minister is once again calling for a strategy. A legislative response, however, has not yet become law.

Strictly speaking, the bill has not been stalled in the Senate for a year: approved by the Council of Ministers in August, it was tabled on 10 September and is currently under consideration by the Foreign Affairs and Defence Committee. For a year, however, the assessment that is supposed to justify its urgency has been known. The political issue is the gap between that assessment and the means to address it.

Crosetto’s text, comprising fifteen articles, answers one question: who does what when the battlefield is a network? Article 7 defines the Defence’s cyber domain: data, networks, sensors and control systems for military assets. The Minister must identify and update this. The Chief of the Defence Staff would become the military cyber authority, responsible for personnel, network protection and defensive operations, including those abroad. The remit of other state bodies remains unchanged.

It is not merely a matter of organisational charts. The measure renames the General Staff’s Information and Security Department as the Joint Cyber-Intel Command and establishes a centre to train the Armed Forces to counter hybrid threats. It introduces the ‘Military Cyber Specialist’ qualification, training, an additional five years’ service and incentives to retain professionals who are also in demand in the private sector. The fund for cyber incentives starts at around 1.6 million in 2027 and grows in subsequent years. According to estimates reported by ANSA, the aim is to reach around 1,200 specialists.

“The point is not merely to recognise that hybrid warfare exists. It is to decide how much time we can afford to waste once we have recognised it.”

The draft bill alone will not prevent the sabotage of a fridge. The security of civilian networks involves other authorities, starting with the National Cybersecurity Agency, and the text does not introduce a general authorisation to launch a counter-attack. Structures are already in place, as is a law to strengthen cyber security, which was passed in 2024. But it is precisely for this reason that the new bill must be judged on what it actually promises: to make the military component of digital defence clearer, more stable and more professional.

This week’s attacks call into question the state’s ability to formulate a response ahead of the forthcoming emergency summit. If hybrid warfare is a permanent feature, then the timetable for responses must also be clear. In the Senate, a vote is expected in December. This would be a step along the way, not the end goal: once the law is passed, implementing decrees, training, the organisation of units and resources will be required. And coordination between the Ministry of Defence, the intelligence services, the Home Office and the National Agency will remain an ongoing process. These are not mere bureaucratic details: they define who intervenes, with what powers and by what means.

Politicians cannot claim to have been taken by surprise. The minister responsible had outlined the vulnerabilities well in advance. The majority then adopted a plan that recognises the need for change. Putting this into practice, and measuring the results rather than merely convening meetings after incidents occur, is the real test that now lies ahead. Because the difference between a strategy and an alarm is simple: the former provides the tools before the next attack strikes.