Speaking to our sister aviospace’s magazine Airpress during Cybertech Europe 2026 in Rome, Campora described a cyber environment in which vulnerabilities can now be exploited within hours or even minutes, while autonomous agents are changing both offensive and defensive operations.
Why it matters: Europe still has competitive cyber capabilities, but fragmentation remains a major weakness. For Campora, technological sovereignty will depend less on rebuilding every component domestically than on retaining control over critical capabilities, integrating platforms and creating enough European scale to compete globally.
Q: Cyber threats are evolving at unprecedented speed. How has time become such a critical factor in the contest between attackers and defenders?
A: Time is one of the clearest ways to understand how cybersecurity is changing. For years we focused mainly on the volume of attacks. Today, what is changing most is their nature. We increasingly live in an environment of autonomous digital systems that can interact with their surroundings and make decisions. Cybersecurity is no longer simply a confrontation between human specialists supported by technology, but increasingly between intelligent systems supervised by humans.
- In 2018, some statistics suggested that more than two years could pass between the publication of a vulnerability in the Cve register and its first exploitation. Today, that window can be reduced to hours or even minutes.
- Large language models used as agents can identify vulnerabilities, combine several apparently minor weaknesses and exploit them before they are widely known. This is what we call “negative time.”
- The same pressure applies to defense. Leonardo serves more than 200 customers worldwide. When we identify a vulnerability affecting one of them, we need to understand immediately who else may be exposed, assess the impact and update operational procedures.
- That is why we use the metaphor of a cybersecurity “immune system”: once a threat is identified, countermeasures must be distributed rapidly across customers and institutions. Cooperation is no longer only about sharing information, but also capabilities.
Q: Artificial intelligence is becoming increasingly important on both sides of the cyber contest. How is it changing defense in practical terms?
A: The introduction of AI has been gradual. At our Global cybersec center, we have used machine learning for many years to detect threats. The real step change has been moving from AI applied to individual tasks, such as detection or automated response, to a multi-agent approach.
- Today, different intelligent agents can each perform a specific function and interact with one another across the entire process. That allows them to analyze the environment and coordinate responses more effectively.
- It also changes system architecture. We can no longer rely on many specialist products operating separately. We need connected platforms in which different functions constantly communicate with one another.
- We call this “platformization,” and it is becoming essential to effective cyber defense.
Q: How does Zero trust fit into Leonardo’s approach, particularly when it comes to technological sovereignty in Europe?
A: At Leonardo, we follow what Forrester calls a “pragmatic sovereignty” approach. We do not believe Europe needs to reinvent everything, but it must maintain control over the capabilities and technologies on which its sovereignty genuinely depends. For years, the sovereignty debate focused largely on infrastructure that hosted passive data and deterministic software. With the spread of intelligent agents, control over data becomes even more important.
- On Zero trust, we have accelerated our technological development through corporate operations as well, including the acquisition of Sweden’s Axiomatics, which specializes in authorization, and our investment in Finland’s SSH, active in authentication and security.
- The core idea behind Zero trust is that a breach must always be considered possible. That means abandoning implicit trust and continuously verifying identities and devices.
- But Zero trust itself must now evolve. If thousands of agents can launch attacks simultaneously at machine speed, verification also needs AI to operate at the same pace.
- Another key element is observability: understanding whether an agent with legitimate credentials is behaving correctly. In a world where there may no longer be a human directly behind every action, behavior must be constantly compared with predefined rules and policies.
- In that sense, identity is becoming the new security perimeter.
Q: Cyber threats do not stop at national borders. How important is stronger European coordination between governments, institutions and companies?
A: This is one of the central problems. Former Finnish President Sauli Niinistömade the point clearly in his report on European preparedness: threats do not stop at national borders, while responsibility for security still largely remains with individual states. That creates a structural tension. Sharing responses can make them much more effective.
- One example is the European commission’s proposal for a single entry point for incident reporting. If a multinational operates in all 27 Eu countries and suffers a cyberattack, it should not have to submit 27 separate reports to national authorities. One notification, shared according to agreed criteria, would be more efficient.
- Yet the proposal has faced resistance from several member states. That shows that the obstacles are not only technological, but also cultural and organizational.
- There is also an industrial dimension. Critical mass matters in global technology competition. Europe has lost ground in some sectors, but in cybersecurity it remains competitive.
- To preserve that position, however, we need shared investments and European alliances. Otherwise, marginalization risks becoming inevitable.
Q: How well prepared are Italy and Europe today, from institutions and large companies to smaller firms in the supply chain?
A: The Nis2 Directive has represented an important step forward. One of its main achievements has been to make clear to company boards that cybersecurity responsibility cannot simply be delegated: it remains with corporate leadership. That principle, together with the broader requirements introduced by Nis2, has accelerated change. Implementation remains uneven across Europe, but overall the impact has been positive.
- Europe also still has important technological and industrial capabilities. Leonardo’s participation in the Gcap sixth-generation fighter program, for example, involves not only cybersecurity but also data management. These experiences have strengthened our position in European tenders and in programs such as Nato’s protected business network, where we are working with Accenture on the digital transformation of infrastructure serving around 29,000 Alliance users.
- Cybersecurity is not only about technology. It also depends heavily on services and human skills, areas in which Europe and its universities remain strong.
- One concern, however, is the new European competitiveness fund. Unlike the previous framework, it does not include a dedicated funding line for cybersecurity.
- Cybersecurity may still be financed through broader programs, but when it competes with other priorities there is no guarantee it will receive sufficient resources.
- That is why we have sent an open letter to the European cmmission. The issue is not only the level of funding, but the need to recognize cybersecurity as a strategic area with its own programmatic autonomy.
