Bulgaria is replacing the patchwork of cyber defences at its state bodies with a single national system that monitors them around the clock and spots threats earlier, national cybersecurity coordinator Velizar Varbanov said in Sofia today.

More than 50 state bodies are already linked to the system. Another 28 will join over the next year and a half, and will get protection tools and round-the-clock monitoring.

Varbanov heads the cybersecurity and protection directorate at the Ministry of Innovation and Digital Transformation. He opened the third conference on digital identity, which this year focuses on managing digital identity and access. The Bulgarian Industrial Association is the institutional partner. Experts from Germany and other European countries, business, state administration and academia are taking part.

Varbanov said cybersecurity had until now been split between different institutions. Many bodies had only one or two staff working on it, often alongside other tasks. The plan is to centralise monitoring in an operations centre that watches the state bodies. More than 20 hardware and software systems, covering different types of attack, have been installed over the past year.

The system detects threats and responds to them on end-user devices and in networks. It also protects email, manages privileged access and stops data leaks. Artificial intelligence looks for unusual behaviour in networks and devices, analyses threats and writes reports.

The aim is to move from a reactive to a proactive approach and catch threats before they become incidents, the coordinator said. The integrated system has already uncovered incidents from years ago that were missed because monitoring was fragmented.

The human factor remains decisive. Specialists judge whether a signal is a real incident or a false alarm.

Ivan Pepelov, chief executive of the consultancy IDVKM, said companies are squeezed at once by rising regulatory demands, cyberattacks and tight budgets. More pressure comes from foreign clients, who increasingly ask suppliers to prove they meet cybersecurity standards. Pepelov pointed to a large German financial institution that dropped 20% of its suppliers because of such demands.

Pepelov named control over AI agents as the main issue, because it is unclear what they are used for and what actions they can take. Another risk is staff who leave and take confidential information or client data with them. Managing digital identity and access helps limit this, he said.

Varbanov called for the EU's NIS2 directive not to be used to pressure clients when selling cybersecurity services. The directive aims to raise protection, not to scare companies, he said. In his view, national cyber resilience cannot be achieved in isolation, so institutions in Bulgaria must work together and with partners in the EU and NATO.

Bulgaria's rules under the directive are still being drafted, and the Council of Ministers is due to adopt them.