The Basque Country is an attractive region for investment in cybersecurity, thanks to public-private collaboration and housing an avant-garde ecosystem.

• A conclusion from the report presented at the conference 'Basque Digital Security: a benchmark ecosystem in Europe', which was organised by GAIA, Cybasque, and the Basque Government through SPRI.

The Basque Country is an appealing location for cybersecurity investment due to its favourable tax environment and various public-private collaboration initiatives. This is supported by the third edition of the White Paper on Cybersecurity in the Basque Country, presented at the ‘Basque Digital Security' conference in Bilbao. A benchmark ecosystem in Europe organised by the Association of Knowledge and Technology Industries (GAIA), the Association of Cybersecurity Companies in the Basque Country (Cybasque), and the Department for Economic Development, Sustainability, and Environment through SPRI.

The White Paper concludes that the future of industrial cybersecurity in the Basque Country is “promising”. Its consolidation depends on maintaining a “solid and collaborative commitment between public and private institutions. This commitment is necessary to establish the region as an internationally recognised industrial cybersecurity hub.”

The Basque Country has a strong ecosystem of business support instruments, in which cybersecurity and businesses play a prominent role. Differential institutional support in specific focus areas such as R&D, innovation, entrepreneurship, internationalisation, and access to funding is crucial for promoting the growth and strengthening of companies in the Basque cybersecurity ecosystem.

The Department for Economic Development, Sustainability and Environment, through SPRI, will continue to promote the enhancement of cybersecurity in the business sector. This year, the programme will receive a minimum of 3.5 million euros.

At a media briefing prior to the Conference, Estíbaliz Hernáez, the Basque Government's Deputy Minister for Technology, Innovation and Digital Transformation, and Xabier Mitxelena, the President of the Association of Cybersecurity Companies of the Basque Country (Cybasque), discussed the current state of business cybersecurity in the region.

Main conclusions from the White Paper

The White Paper draws the conclusion that the Basque Country has a significantly higher number of cybersecurity companies per million inhabitants compared to both Spain and further afield in Europe. The Basque Country has over 79 cybersecurity companies per million inhabitants, which is higher than the figures for Spain and Europe, standing at 28 and 22.8 companies per million inhabitants respectively. The Basque Country is among the regions in the European Union with the highest concentration of cybersecurity companies, making it one of the most active in Europe.

There are currently 59 cybersecurity startups dedicated to various areas such as cloud security, data protection, identity and access management, and infrastructure.

However, the cybersecurity ecosystem in the Basque Country is notable for its diversity, with a wide range of specialised agents. This creates a heterogeneous environment. The Basque Country is a region with devolved powers capable of comprehensively addressing cybersecurity projects. The Basque Country has various local entities involved in the cybersecurity sector, including Technology Centres, Universities, Integrators/Consultants, distributors/wholesalers, and manufacturers. This allows for comprehensive coverage of all links in the value chain.

The White Paper indicates that there is a significant disparity between the supply and demand of professionals in the sector. Despite a growing supply of professionals, it is not growing fast enough to meet the industry's needs. 

In this regard, efforts to promote specialised talent align with the educational sphere. Universities in the Basque Country strive to adapt, improve, and include new studies each year. In the business sphere, workers are being trained to redirect their careers towards cybersecurity by acquiring new skills and competences. Additionally, talent is being attracted from outside the region due to the Basque Country's notable power in the sector.

Report: Characterisation of the Cybersecurity Sector in the Basque Country

This morning, the report 'Characterisation of the Cybersecurity Sector in the Basque Country' was presented. The report analyses the current and future situation of the sector to identify the employment and qualification needs of Basque companies.

Xabier Mitxelena, the president of Cybasque, highlighted that “cybersecurity is a rapidly growing industry. Despite the Basque Country's leading position in European cybersecurity infrastructure and personnel, there is a growing challenge of talent shortage.” He went on to say: “In order to take the necessary measures, including investment, innovation and cultural change, knowledge of the state of the sector is essential”.

Some of the Cybasque report's conclusions highlight the following:

• "The objective of the ‘Strategy for the Digital Transformation of the Basque Country 2025’ is to reach 300 new companies specialised in cybersecurity, AI, quantum computing, artificial vision, blockchain, IoT, augmented reality, big data, robotics, etc., which implies the need for qualified professionals.”
• The number of ICT professionals decreased by 5% in 2022, despite the growth in ICT users. The shortage of advanced digital experts is hampering the country's growth prospects. Therefore, it is necessary to focus on this issue.
• Recruitment forecasts in the Basque Country’s private sector indicate a higher demand for candidates with higher education profiles compared to other profiles. Although all universities in the Basque Country offer various master's degrees and even an undergraduate degree in cybersecurity, the sector's breadth and required knowledge may necessitate exploring other options.
• In the case of the cybersecurity skills gap, companies should seek to retrain or find internal talent for these positions. Alternatively, they can hire professionals who may not have high levels of education but can still fit into teams with varying levels of experience and qualifications. Cybasque highlights that vocational education and training in the Basque Country aligns with current demands.
• However, the report highlights that the sector requires qualified professionals and experts. The focus should be on attracting and retaining individuals with higher education and professional certification. Additionally, it is worth noting that there are unused capacities within the production sector.

Xabier Mitxelena emphasised: “in the digital world, cyberattacks are a permanent threat. Cybercrime is the third largest economy in the world and is expected to reach 10.5 trillion dollars by 2025. There are over 1,000 automated data hijacking cyberattacks every minute.”

Regarding this matter, he stated that Cybasque was created to establish a public-private partnership that assists companies and society in building resilient infrastructures, products, and services that are “competitive and can withstand the impact of cyberattacks. Our initiatives aim to create a world-class digital future and become a European benchmark. Together, we are stronger. To achieve this, there must be an investment in cybersecurity services and tools, plus collaborative work to address the employment and qualification needs of Basque businesses, focusing on creating and retaining the professional profiles needed. This report provides a current snapshot of the situation.” He concluded: “It is now time to continue working and take the necessary measures.”

‘Basque Digital Security: a benchmark ecosystem in Europe’ Conference

The conference will be held at GAIA headquarters in the Bilbao Berrikuntza Faktoria (BBF) auditorium. The Basque Government’s Department for Economic Development, Sustainability and Environment will open the conference, followed by the White Paper presentations by SPRI on the 'Characterisation of the Cybersecurity Sector in the Basque Country'. Two half-hour round tables will be held discussing cybersecurity in industry and the regulatory environment. The first will feature representatives from the Basque Government and the companies MB Sistemas and Secure&IT. The second will include representatives from Merytronic and Orbik Cybersecurity. The discussions will be led by Cybasque and SPRI, who provide services and support programmes for business cybersecurity.