Intel 471 data shows vulnerabilities drive attacks on Italy

Italy is seeing a disproportionately high level of cyberattacks, with threat activity and attack types that differ markedly from other regions, according to new data. Gianluca Tiepolo, cybercrime analyst at Intel471, says Italy is an outlier in the global threat landscape, with organisations there compromised at a rate higher than expected for the country’s size and economy.

Intel471’s data shows Italy accounts for about 7% of all initial access data sold on cybercriminal forums, second only to the United States, and Italy ranks fourth for ransomware victims. The most striking divergence is in how initial access is gained: vulnerabilities account for 57% of Italian footholds, while credentials explain about 23%.

Three theories are presented to explain the pattern. Theory one points to poor cybersecurity hygiene, noting Italy’s slower adoption of defence technologies such as endpoint detection and response (EDR), and the prevalence of end-of-life PHP 4, 5 and 7 versions being exploited. Theory two considers a cyber risk network effect, where widespread technologies in Italy create an economy of scale for attackers, with about 90% of initial access offers to Italian targets sold in bulk.

Theory three cites the country’s strong presence of small and medium-sized enterprises (SMEs) as a factor, since MSMEs make up a large portion of the Italian economy and are disproportionately targeted. Cleafy representatives echo these patterns, citing reuse of tools and infrastructure to scale campaigns across Italian banking targets and noting cases such as the drIBAN Web injection kit affecting PEC. The article situates these findings within Intel471’s 2026 Cyber Threat Trends & Outlook.