Cybersecurity: what it is, how it works, and its main technological challenges

The growing interconnection of digital systems has expanded the scope of cyber threats, particularly in sectors where operational continuity depends on complex technological infrastructures. Data manipulation, communication disruptions, or unauthorized access to control systems can compromise industrial processes, healthcare services, energy networks, and transportation systems, highlighting the close relationship between cybersecurity and the operation of critical infrastructure.

The scale of this challenge becomes clear when examining the evolution of vulnerabilities. In 2025, more than 48,000 new cybersecurity vulnerabilities were identified, approximately 22% more than the previous year. This increase does not necessarily mean that all systems are becoming less secure, but it does reflect the complexity of an constantly expanding technological ecosystem in which software, hardware, distributed services, and connected devices coexist.

The challenge is not limited to detecting and correcting vulnerabilities. Today’s infrastructures depend on multiple components and providers, meaning that a localized vulnerability can spread through shared services or compromise functions that initially appeared independent. Security must therefore consider both the individual behavior of each system and the interactions between them.

In this context, cybersecurity has become a multidisciplinary research field in which cryptography, systems engineering, applied mathematics, and artificial intelligence converge.

To mark European Cybersecurity Month, held every October, we examine the technological foundations of this discipline, the advances transforming its protection mechanisms, and the scientific challenges that remain unresolved.

What Is cybersecurity from a technological perspective?

Cybersecurity encompasses the principles, architectures, and mechanisms designed to ensure that digital systems maintain their security properties even when exposed to failures, unauthorized access, or malicious behavior.

Its purpose is not exclusively to prevent intrusions, but also to preserve process integrity, information confidentiality, and service availability. These principles, known as the CIA triad, provide a fundamental reference framework, although their application depends on the technological context.

In industrial infrastructure, for example, the integrity of control signals may be just as critical as data confidentiality. In space communication systems, the authenticity of received commands and the ability to maintain operations during disruptions become particularly important. Security must therefore be adapted to the physical, operational, and functional characteristics of each environment.

From an engineering perspective, one of the fundamental concepts is threat modeling, which identifies the assets that need protection, the vulnerabilities that could be exploited, and the potential consequences of a system compromise. This analysis informs decisions concerning network architecture, authentication, encryption, segmentation, and recovery mechanisms.

Current research also places particular emphasis on security throughout the entire technology lifecycle. Protection cannot rely solely on controls introduced after development; it must be integrated from the design stage and maintained throughout operation, updates, and system decommissioning.

This approach is reflected in the Cybersecurity Framework 2.0, which organizes risk management around six complementary functions: Govern, Identify, Protect, Detect, Respond, and Recover. Its significance lies in understanding cybersecurity as a continuous operational capability rather than a static collection of tools.

From individual vulnerabilities to systemic risk

The increasing interconnection of digital infrastructures has transformed how cybersecurity is understood. Many applications that previously operated as relatively independent systems now rely on distributed architectures, where cloud services, connected devices, and external platforms work together to perform a single function. This structure provides flexibility and scalability, but it also introduces new dependencies and expands the attack surface: the points through which a system could potentially be compromised.

However, risk does not depend solely on the number of existing vulnerabilities, but also on how components interact, which permissions they share, and how far unauthorized access can spread. The emergence of artificial intelligence agents capable of performing tasks and interacting with external systems adds a new dimension to this challenge.

A particularly illustrative case occurred in July 2026, during internal cybersecurity evaluations conducted by OpenAI. Several AI agents managed to bypass restrictions in their execution environments, exploit vulnerabilities, and interact with infrastructure they were not authorized to access, including the Hugging Face platform. The incident, which occurred in an evaluation environment, highlighted the challenges of controlling autonomous systems capable of performing operations beyond their intended scope.

Situations of this kind raise a fundamental question: how can we ensure that a system respects its operational boundaries when it has access to tools capable of interacting with other services? Modern cybersecurity therefore requires analyzing infrastructures as interconnected systems, where protecting individual components does not necessarily guarantee the security of the system as a whole.

Artificial Intelligence: new detection capabilities and new challenges

Artificial intelligence is transforming cybersecurity from two perspectives. On the one hand, it enables the analysis of large volumes of information and the identification of anomalous behavior that might go unnoticed using traditional methods. On the other, it introduces vulnerabilities associated with the operation of AI models themselves and their interactions with external systems.

Machine learning techniques can be used to analyze network traffic, activity logs, or authentication patterns to detect deviations from normal behavior. However, their effectiveness depends on data quality and the ability of models to adapt to operational changes. This phenomenon, known as concept drift, can reduce the accuracy of detection systems and generate false alerts as conditions evolve.

At the same time, AI models can themselves become targets of attacks. Among the most extensively studied threats are adversarial attacks, which manipulate input data to trigger incorrect responses, and data poisoning, which seeks to alter model behavior through manipulated training information.

In generative AI systems, prompt injection is another significant threat. This technique introduces malicious instructions into content that a model is expected to process. The risk increases when the system has access to external tools, as it may attempt to execute unauthorized actions.

These threats form part of the research field known as Adversarial Machine Learning, which studies how models can be manipulated and develops mechanisms to improve their robustness.

Post-Quantum Cryptography: preparing for the next security transition

Cryptography is one of the mathematical foundations of digital security. However, advances in quantum computing pose a challenge to certain public-key algorithms currently in use.

In 1994, mathematician Peter Shor theoretically demonstrated that a sufficiently advanced quantum computer could solve certain mathematical problems, such as integer factorization, far more efficiently than the best known classical methods. This discovery has direct implications for cryptographic systems such as RSA and those based on elliptic curves.

One of the main responses to this challenge is post-quantum cryptography, which develops security algorithms based on mathematical problems for which no efficient solutions are currently known, using either conventional or quantum computers. Unlike other alternatives, such as quantum cryptography, these algorithms can be integrated into existing digital infrastructures without requiring specialized quantum communication equipment. In August 2024, the first three post-quantum cryptography standards were published, designed to protect key establishment and digital signatures.

The need to prepare in advance is also driven by the risk known as harvest now, decrypt later, which involves collecting encrypted communications today with the intention of decrypting them in the future, once sufficient quantum computing capabilities become available.

This transition presents technical challenges related to energy consumption, memory requirements, and execution times, particularly in industrial systems, embedded devices, and space communications. Research therefore focuses not only on ensuring the mathematical security of algorithms, but also on developing efficient implementations for practical applications.

Cybersecurity at ARQUIMEA Research Center

Research at ARQUIMEA Research Center also addresses the security challenges associated with emerging technologies. One of its key research areas is post-quantum cryptography, which combines mathematical research, electronic engineering, and computational optimization to develop protection mechanisms adapted to future technological requirements.

One of the developments within this research area is an implementation of the FrodoKEM post-quantum cryptographic algorithm on programmable hardware devices (FPGAs), which has achieved a tenfold performance improvement compared with certain conventional software-based implementations. This work forms part of a broader research effort combining hardware and software development to accelerate cryptographic operations, strengthen resistance to attacks that exploit the physical characteristics of devices or deliberately induce faults, and facilitate adaptation to new security standards. The team has also developed implementations of digital signature algorithms, such as Falcon and MAYO, and key encapsulation mechanisms for secure cryptographic key establishment, including ML-KEM and HQC.

This research area is connected to the capabilities of QCIRCLE, the International Centre of Excellence led by ARQUIMEA Research Center, which includes communications and cryptography among its technological areas, alongside quantum computing and photonics.

The connection between these disciplines is essential for anticipating future digital security challenges. As computing capabilities evolve, so must the mechanisms that protect our infrastructures. In this context, scientific research plays a decisive role in developing security technologies capable of addressing both current threats and those that will emerge over the coming decades.