Cyprus startups focusing on international expansion must prioritise cybersecurity to mitigate potential risks, according to Andrey Leskin, CTO at Qrator Labs. With fintech and iGaming companies looking to enter high-growth markets, the underestimation of cyber threats poses a significant risk. Leskin warns that firms venturing abroad may encounter targeted digital attacks from competitors and ideological groups.
Cyber Risks Often Overlooked
“Cyber risks simply are not top of mind during international expansion,” Leskin remarked. He explained that in the rush to hire talent, ensure compliance, and ramp up marketing efforts, cybersecurity is often relegated to a secondary concern.
Many executives tend to assume that cybersecurity measures beyond basic data protection are unnecessary, particularly as such measures are not always mandated by law. “Expanding into a new market already involves a lot of moving pieces, and cybersecurity often gets pushed down the list,” he added.
Changing Threat Landscapes
Leskin noted that companies in Cyprus, accustomed to relatively fair competition, may not be prepared for the aggressive tactics prevalent in emerging markets. “In some emerging markets, competitors may resort to unethical tactics, including cyberattacks, to discourage new entrants,” he stated.
As firms begin serving customers outside of Cyprus or Europe, their threat profile shifts significantly. “A company’s threat profile is shaped not only by where it is headquartered but also by where it operates and where its customers are,” Leskin explained.
Regions like Latin America and Southeast Asia introduce new risk factors, including local cybercriminals and ideologically motivated groups that may target businesses they oppose. “In certain regions, organisations that oppose industries such as betting or interest-based lending may be willing to use cyberattacks against businesses they oppose,” he mentioned.
Cyberattacks as Competitive Strategy
Leskin described some cyberattacks as extensions of competitive strategy rather than purely criminal activity. “In some regions, cyberattacks can be part of the competitive toolkit rather than being driven purely by criminal motives,” he said.
These attacks are designed to disrupt new entrants and increase the costs associated with market entry. “The objective is to make expansion more expensive and disruptive through DDoS attacks, data theft, or other incidents that slow down operations,” he noted.
The ramifications of these threats extend beyond local systems, impacting a company’s global infrastructure. “A company’s global digital assets may also be targeted, because that creates even greater business disruption,” he explained.
Challenges in Emerging Markets
Leskin cautioned that European firms, including those in Cyprus, might be unprepared for these risks when entering volatile environments, placing their operations at risk. “These tactics have become an accepted part of aggressive competition in some markets,” he continued.
Cyber threats often emerge during critical growth phases. “These threats are most likely to surface during market entry and periods of rapid customer growth, when local competitors begin to see the company as a serious challenger,” he said.
Attackers usually make their intentions clear, which can involve hostile media campaigns or even threats. “The perpetrators want the company to understand exactly why it is being targeted and what they expect it to do,” he added.
Regulatory Frameworks and Compliance
Leskin pointed out that many firms treat cybersecurity as merely a compliance exercise tied to regulatory requirements. “If regulators require a particular measure, companies implement it; if not, they assume the risk is not significant,” he stated. However, this approach can leave Cyprus-based firms exposed when operating abroad.
In emerging markets, regulatory frameworks may be limited or focused on different priorities, meaning compliant companies can still face substantial cyber risks. “In some markets, limited resources, insufficient expertise, or corruption can make support from authorities far less reliable,” he added.
Integrating Cybersecurity into Business Strategy
For founders in Nicosia and Limassol, Leskin emphasised the importance of integrating cybersecurity into early-stage planning. “Companies should treat cybersecurity as part of market-entry due diligence rather than an afterthought,” he advised.
He identified three primary threats that businesses should prioritise: DDoS attacks, data theft, and data destruction. While local insights and public reports can be useful, they often provide only a partial picture of the risks involved.
“The best approach is to treat every new market as potentially high-risk until proven otherwise,” Leskin suggested. Practical steps must be taken before onboarding international users to ensure a strong defensive posture.
Practical Steps for Startups
Leskin recommended that startups ensure they have DDoS protection, implement measures to prevent data leaks, and maintain reliable backups for quick recovery. “These measures provide a strong foundation for operating securely in unfamiliar markets,” he said.
For companies already operating internationally without a regional threat assessment, he advised leveraging existing experience to enhance understanding of the local threat landscape. “Companies with an established presence can draw on their own experience to better understand the local threat landscape,” he noted.
While core protections remain essential, they can be introduced more gradually if a company is already established in a market. “DDoS protection, data leak prevention, and resilient backup processes remain essential, but there is less immediate pressure than during initial market entry,” Leskin concluded.
