Dr. Richard Browne:

The Senator referred to MTU and the types of incident we see. I was at MTU last week to discuss with it the incident's aftermath and the process. That incident was a good example of the types of issues we all face in dealing with a complex legal, political and technical challenge. We have learned a great deal from the incident and a range of others in the recent past. We continue to review incidents and build into our process what we need to learn from each.

The risks and challenges vary, but the costs of these incidents are what people often miss. Leaving MTU aside, the cost of dealing with even a moderate incident can run into the millions of euro in a great number of cases. Organisations need to bake that into their processes.

Regarding indigenous companies, we do not tend to rely on the large consultancy companies, by and large. We procure some of our services from them, but most of our services are cybersecurity specific. We do not tend to point victims towards particular companies, but in some cases, very large incidents can only be dealt with by a small global pool of companies. The attack on the HSE is a case in point. We put the HSE in contact with what we believed was the only company in the world that could deal with an incident of that scale. The HSE had hundreds of thousands of endpoints. If you are looking for an incident response, that narrows it down to one or two companies globally. The same team that handled the HSE incident handled the Colonial Pipeline in the US – not the same company, but the same people. When playing at this game, you play internationally or you do not play at all. There is a space for indigenous companies and we have some very gifted niche individual players. I was at the RSA conference in San Francisco in the past two weeks picking up stickers from Irish companies that sell internationally. Our ecosystem is not just about acting as a home for foreign direct investment. We have innovative Irish companies that are out there selling globally.