Cybersecurity: Protecting Europe's Critical Digital Economy

At 4impact capital, we invest in digital businesses building resilience into the systems people and the planet depend on, from Satelligence's satellite monitoring of deforestation risk to Deftpower's platform turning electric vehicles into flexible storage for the energy grid. Cybersecurity is what enables trust in innovative digital infrastructure like this in the first place: none of it delivers impact if it can't be relied on to keep running.

As societies become increasingly digital, criminal networks continue to exploit technological developments and vulnerability to carry out cyber attacks. That's why we've been studying cybersecurity as an investment category on its own terms. The case is hard to ignore: cybercrime now costs the global economy an estimated $10.5 trillion a year (Cybersecurity Ventures, 2025), more than the GDP of every country in the world except the US and China. Attacks on European energy infrastructure double in frequency between 2020 and 2022 (Eurelectric, 2025), victims of cyber extortion are up 77% year-on-year (Orange Cyberdefense, 2024), and criminals are increasingly using AI to make their attacks faster, cheaper, and harder to detect.

The scale of the threat

Cybercrime used to be a back-office IT concern, but is now a board-level, national-security-level and societal issue. The numbers make clear why:

Where impact and cybersecurity meet

Cybersecurity isn’t a traditional impact category on paper. However, we believe there are clear impact opportunities within this space: cybersecurity provides the digital trust that increasingly underpins a well-functioning digitized society - protecting essential services, critical infrastructure and individuals from disruption and harm. And the consequences of cybercrime extend well beyond financial losses: they can interrupt these crucial services, threaten livelihoods, and create real-world social and economic costs. In that sense, strengthening society’s resilience to cyber threats can itself be a meaningful form of impact.

Human & social cost

Globally, 103.9 million people fall victim to cybercrime every year, losing an estimated $1.24 trillion between them, an average of $9,468 per crime (Comparitech, The Cost of Cybercrime). However, this harm extends beyond just the financial; Research done by the UK’s Police Foundation found that 92% of fraud victims experienced emotional or mental-health symptoms, 58% experienced physical-health symptoms and 64% changed their behaviour following the crime.

Small and medium-sized businesses, which typically cannot absorb the cost of a breach the way a large enterprise can, are disproportionally exposed. Beyond the financial burden, 32% of SMEs hit by a cyberattack saw employees experience burnout in the aftermath (Hiscox Cyber Readiness Report 2025). That burnout statistic highlights the human toll of a breach falling on employees and founders, not just on the business itself, and that a single incident can threaten jobs and livelihoods well beyond the immediate financial loss.

Healthcare & essential services

We’ve seen firsthand at OurMind, one of our portfolio companies, how central digital systems have become to day-to-day hospital operations. Because of this dependency, the clearest illustration of cybercrime’s social cost is healthcare. A 2026 study published in the American Economic Journal: Economic Policy, linking a database of ransomware attacks against US hospitals with Medicare claims data, found that attacks reduced patient volumes by 17-24% during the initial week of an attack, and in-hospital mortality increased 34-38% among patients already admitted when an attack began. The findings demonstrate how disruption to digital infrastructure can translate into tangible real-world harm: when hospital systems go down, care is disrupted, capacity falls and patient outcomes can deteriorate.

European hospitals carry a disproportionate share of this risk on their own: ENISA’s health-sector threat landscape assessment found hospitals alone were the target in 42% of the publicly reported EU incidents it analysed, at a median cost of EUR 300,000 per major incident (ENISA, Threat Landscape: Health Sector). The same underlying risk exists across other essential services, from utilities and transport to emergency response, where prolonged digital disruption can have consequences far beyond the financial cost of an attack.

Critical infrastructure & environment

Attacks on critical infrastructure such as energy, water, and transport systems carry a different kind of risk: the potential for physical and environmental harm if critical systems fail and bottlenecking innovation that can enable more sustainable systems. In 2025, Poland’s electrical grid was hit by a first-of-its-kind coordinated cyberattack targeting distributed energy resources. While swift operator actions averted a widespread crisis, a parallel attack on a combined heat and power plant briefly shut down a CHP plant disrupting public heat supply to 50,000 residents (Dragos, 2025). In October, researchers identified 8.5k internet-exposed solar park and wind farm control and management systems across 35 European countries (Modat, 2026). Although with varying degrees of security, this widespread visibility allows adversaries to target critical infrastructure and leaves Europe’s power grid vulnerable to cyber attacks.

As energy grids, public utilities and other essential infrastructure become more connected and automated, cyber resilience is increasingly about protecting the physical services on which society depends - not simply protecting data.

Cybersecurity does not fit our impact mandate uniformly. Instead, we focus on areas where the link to social or environmental impact is tangible and measurable: protecting critical infrastructure and essential services such as energy, healthcare, water and transport; making robust cybersecurity accessible to SMEs that lack the resources for enterprise-grade protection; and addressing the human vulnerabilities behind many successful attacks. Impact therefore depends less on the technology itself, and more on the use cases and outcomes of the protection. Depending on the use cases, cybersecurity may generate impacts towards SDG 16 (peace, justice, and strong institutions) and increasingly overlaps with SDG 9 (resilient infrastructure), SDG 11 (resilient communities) and SDG 3 (health, through the healthcare findings above).

How cybersecurity fits our impact thesis

Cybersecurity sits within two of our existing impact pillars, one environmental and one social, as set out in our 2025 Impact Report.

The areas within cybersecurity we find most interesting

Cybersecurity is a broad market, and not every segment fits within our investment scope. We are particularly interested in areas where impact, opportunities for disruption and structural growth intersect - and where our background in investing in digital technologies and AI gives us a particular ability to understand and support the companies being built. Two areas stand out:

AI security

AI is transforming both offence and defence in cybersecurity. This is the single biggest force reshaping the sector, creating an ongoing arms race for increased and more sophisticated cyber security. 63% of organizations now are now self-hosting AI models (Wiz, 2026), meaning more independent control of their AI stacks, but also more security burden. Additionally, in 2025, there was an 89% increase in attacks by AI-enabled adversaries year-over-year (Crowdstrike 2026 Global Threat Report, 2026).

Our definition of AI security is applied in two ways: (1) protecting artificial intelligence systems - including their data, code, models, agents and infrastructure - from threats like data tampering and cyberattacks, and (2) defending against AI-enabled threats, AI-driven social engineering and fraud.

Examples of relevant solutions: AI usage control and governance, LLM and model security (prompt injection, sensitive data leakage, model theft), AI supply chain security (model tampering, open-source vulnerabilities, missing provenance), AI agent control, AI impersonation and deepfake defence.

Cyber-physical systems security

As operational technology (OT) systems grow increasingly interconnected to corporate networks and the internet, protecting them from cyber threats is essential. We use the term cyber-physical systems in the broad sense: industrial OT and control systems, building management systems, connected medical devices (IoMT) and distributed energy assets. Because many vulnerabilities directly target OT environments, a breach can severely disrupt industrial operations; in a survey of OT security leaders, 60% of industrial organisations experienced OT security incidents, of which 96% originated from IT-level compromises (txOne 2026 Annual OT/ICS Cybersecurity report, 2026).

Examples of relevant solutions: Asset visibility and inventory, network segmentation and zoning, OT and IIoT threat detection and anomaly monitoring, secure remote access for OT, governance and cross-functional collaboration.

These are areas where we see the strongest convergence of impact, technological disruption and venture-scale opportunity - but also where we believe 4impact has a genuine right to play. The technologies reshaping cybersecurity are closely connected to the fields we have spent years investing in and supporting, from AI and big data to IoT. That gives us both a foundation for evaluating emerging security technologies and relevant experience to bring to the founders building them.

What we look for in a cybersecurity startup

Given how well-funded the $272 billion cybersecurity market has become - Global VC funding into cybersecurity reached $13.97 billion in 2025 (SecurityWeek, 2026) - we are deliberately selective about where and when we invest. In practice, we look for:

•     A genuine and measurable impact case. Where impact is intentional and there is clear vertical integration within impactful sectors and use-cases. We want to understand the real-world harm the product helps prevent and, where possible, how that impact can be measured.

•     Focus on mission-critical sectors with structural demand. Particularly where the consequences of failure are high and regulation is raising the minimum standard of cyber resilience. Healthcare, energy, financial services and other critical infrastructure are especially interesting where frameworks such as NIS2, DORA and the EU Cyber Resilience Act reinforce an already compelling need for protection.

•     Clear and defensible technical differentiation. Cybersecurity is intensely competitive, with many categories already dominated by large incumbents and heavily funded startups. We look for products where data, integrations and sector know-how mean that advantage will become harder to replicate over time - not simply another point solution competing for the same security budget.

•     A capital-efficient path to market. Enterprise cybersecurity can involve long sales cycles, demanding procurement processes and high customer-acquisition costs. We favour teams that understand these dynamics and have a credible route to distribution - whether through product-led adoption, channel partners, managed service providers or a focused vertical strategy.

•     A clear and measurable customer ROI upfront. Risk reduction is fundamental to cybersecurity, but it can be difficult to quantify and does not develop immediate purchasing urgency. We are particularly interested in products that can demonstrate near-term economic value; e.g. reducing security workload and operating costs, accelerating compliance or remediation, reducing downtime, or enabling customers to adopt new technologies securely.

4impact's view

Cybersecurity has moved from a defensive necessity to a structurally important, high-growth category, and one of the more resilient corners of enterprise technology to invest behind. It is also, without question, a crowded and competitive market: strong technology alone is not enough, and we are realistic about the fact that many of the categories we find most interesting already have well-capitalised players. That's precisely why we believe the impact lens matters here: it helps us focus our limited capital on the startups protecting the people, sectors, and infrastructure where resilience matters most, rather than trying to compete for allocation in a high growth category.

Get in touch

We are actively sourcing in this space and would love to hear from founders, co-investors, and anyone in our network who knows a cybersecurity startup worth a look, particularly teams protecting critical infrastructure, essential services, or individuals from cybercrime.

Know a founder building in this space, or a co-investor we should be talking to? We want to hear from you. You can also sign up for our newsletter or submit a deal for consideration through our website.