Poland cybersecurity capacity building

In late July 2026, Poland announced that its Technical Supervision Office will launch a sector‑specific Computer Security Incident Response Team (CSIRT) on 3 October 2027. The new CSIRT will serve about 38,000 entities across public and private sectors, offering threat identification, incident handling, monitoring, warnings and coordination with other national CSIRTs. At the same time, local authorities began publishing public guidance on common cyber threats and basic protective measures.

A few weeks later, in early August 2026, the Ministry of Digitisation secured 230 million zł from the EU’s Digital Development Fund to create a Joint Cybersecurity Operational Centre (PCOC). The centre will bring together national CSIRTs, special services and other cyber‑security bodies to improve information sharing, threat analysis and rapid response. Additional funding of 30 million zł will support satellite‑signal services for the Main Office of Geodesy and Cartography. Both initiatives are part of a broader effort to strengthen Poland’s digital resilience and align with EU cyber‑security programmes.

On 7 August 2026, security researchers Robert Kruczek and Kamil Szczurowski presented findings at the Def Con conference regarding significant vulnerabilities in Poland's public internet infrastructure. The researchers reported that approximately 250,000 websites belonging to over 10,000 public entities, including hospitals, airports, and government offices, are susceptible to cyberattacks.

Notably, the researchers found that the websites of approximately 245 courts—nearly two-thirds of the judiciary—were exposed. These vulnerabilities were attributed largely to the use of obsolete software, such as the Pad CMS platform, which allows unauthorized access to over 300 official websites without a password due to its "end of life" status. The researchers cited a lack of vendor updates and bug bounty programs as contributing factors to these systemic risks.