DIAMATIX × Acronis at Municipal EXPO 2026: Cyber Resilience Starts with Confidence, Preparedness and Response
11-13 October 2026
Three days, dozens of conversations and one recurring question: how can municipalities continue delivering critical public services when cyber risk has become part of the everyday operating environment?
From 11–13 October, DIAMATIX and Acronis jointly participated in Municipal EXPO 2026 in Albena, part of Bulgaria’s Annual Meeting of Local Authorities. We met representatives of municipalities, public-sector organisations and partners to discuss cybersecurity, data protection, recovery, NIS2 and, importantly, the confidence that when an incident occurs, the organisation knows how to respond.
What we heard from municipalities
The conversations at our stand reinforced an important point: technology is only one part of cyber resilience.
Many questions focused on practical operational issues:
- Who monitors the environment outside normal working hours?
- What happens if an incident occurs overnight, during a weekend or on a public holiday?
- Who coordinates the response?
- Are employees sufficiently prepared?
- How can NIS2 requirements be translated into everyday operational processes?
- Can the organisation restore not only its data, but the service itself quickly enough?
Some conversations also highlighted uncertainty around the practical implementation of NIS2 and a need for more training and clearly defined procedures. ENISA findings show that these challenges extend beyond individual organisations: public administration remains highly exposed to cyber threats, while operational preparedness and training continue to require attention.
Cybersecurity in municipalities is also about public trust
For public organisations, the consequences of a cyber incident cannot be measured only in affected devices.
Municipalities manage personal data, administrative records, financial processes, citizen services and infrastructure of public importance. A disrupted system can therefore quickly become a disrupted public service.
When citizens cannot access a service or their data is affected, cybersecurity becomes a question of trust in the institution.
Resilience therefore means more than preventing an attack. It means detecting an incident early, limiting its impact, responding in a coordinated way and restoring operations.
Public administration remains a primary target
The latest ENISA data confirms the scale of the challenge. The ENISA Threat Landscape 2026 again identifies public administration as the most targeted sector in the EU. Ransomware remains one of the most impactful incident types in the short term, while DDoS campaigns continue to affect public and essential entities. enisa.europa.eu
ENISA’s dedicated public-administration analysis identified 586 publicly reported incidents in 2024, including 143 targeting local administrations. DDoS accounted for almost two-thirds of the observed incidents, while ransomware represented around 10% but remained capable of causing substantial operational disruption.
An international Sophos study provides another perspective: 34% of surveyed state and local government organisations reported being hit by ransomware in 2024, and attackers attempted to compromise backups in almost all affected organisations. Sophos’ 2025 ransomware study also shows that state and local government organisations faced the highest median ransom payment among the sectors surveyed, at $2.5 million. SOPHOS
This is why backup can no longer be discussed separately from detection, response and proven recovery.
DIAMATIX × Acronis: Partnership for the Public Sector
For DIAMATIX, participating together with Acronis was a natural continuation of our long-standing partnership.
Today, DIAMATIX works with 50 Bulgarian municipalities, combining Acronis technologies for data protection, backup and recovery with our own capabilities for 24/7 monitoring, detection and response.
The goal is not to add another tool to the municipal technology stack.
It is to establish an operational model with continuous monitoring, timely detection, clear response ownership, protection of critical systems and data, recovery readiness, regulatory support and access to expertise beyond standard business hours.
The DIAMATIX Perspective
A resilient municipality is not one that assumes an incident will never happen.
It is an organisation that understands its risk, monitors its environment, identifies abnormal activity early and has a prepared model for response and recovery.
This is why DIAMATIX approaches cybersecurity as a continuous operational capability rather than a collection of individual technologies.
Public services do not stop at 5:30 PM. Cyber protection should not stop then either.
Thank you for the conversations
We thank Acronis for the partnership and joint participation, NAMRB and NAMRB-Activ for bringing the community together, and every representative of a municipality, public institution and partner organisation who visited our stand.
The conversations, questions and perspectives shared over the three days gave us an even clearer view of the challenges facing the public sector.
And those conversations will continue beyond Albena.
Explore the gallery from DIAMATIX × Acronis at Municipal EXPO 2026.
