ByJERUSALEM POST STAFF

JUNE 9, 2026 16:00

State Comptroller Matanyahu Englman cautioned that Israel cyber readiness shortfalls before and during the Israel-Hamas war represented a broad and serious alert, based on a report issued Tuesday regarding the nation preparedness for cyber events and its performance in wartime. The review covered the Prime Minister Office, the National Cyber Directorate, the Shin Bet, the National Security Council, government ministries, sector cyber teams, and 21 major economic entities from February 2023 through June 2025.

The findings showed that cyberattacks on Israeli targets grew in scale, force, boldness, and ingenuity following the start of the war on October 7, 2023. Initial strikes centered on influence campaigns and access denial events, whereas later strikes moved to destructive actions such as data deletion, and in 2024 toward gathering data on civilians, specific targets, and operations inside Israel.

Cyber threat grew during the war

Per the National Cyber Directorate evaluation, the danger from cyberattacks is expected to keep rising. The report noted that from the war start until the audit ended in June 2025, Israel avoided a cyber event that caused major economic harm, yet it recorded hundreds of events with notable damage potential between October 7, 2023, and April 30, 2024.

The report referenced the National Cyber Directorate projection that cyberattacks impose NIS 12 billion in yearly costs on the Israeli economy. It added that worldwide cybercrime losses reached about $8 trillion in 2023, roughly 15 percent above the 2022 figure.

Cabinet lacked complete cyber overview

The report determined that from 2020 until June 2025, the National Cyber Directorate failed to deliver required semiannual updates on the security status of computerized systems in Israel, including critical state infrastructure entities, to the prime minister, cabinet secretary, head of the National Security Council, head of the Shin Bet, and chair of the Knesset Foreign Affairs and Defense Committee.

It further noted that the steering group tasked with essential computerized systems in critical state infrastructure entities did not meet in 2021 and skipped meetings for one year and two months after the war began. The group gathered in December 2020, January and December 2022, June 2023, and December 2024.

Prime ministers did not call for focused security cabinet talks on cyber issues in the ten years before the war and up to June 2025, aside from one dedicated session in 2018, according to the report. While cyber topics appeared in wider talks such as yearly intelligence summaries and multi-front reviews, the cabinet did not receive the complete view of cyber risks, readiness shortfalls, and possible harm.

Protection standards fell short in economy segments

The National Cyber Directorate had alerted before the war that cyber protection standards in economy segments outside critical state infrastructure entities were inadequate. These alerts reached several groups, including an interministerial panel, then-intelligence minister Gila Gamliel, and once a ministerial panel led by Prime Minister Benjamin Netanyahu.

In October 2024, roughly one year after the war started, then-National Cyber Directorate head Gaby Portnoy stated that the maturity of cyber protection across the economy stayed insufficient and might fail to address upcoming threats. Portnoy noted that the sharp rise in attack speed and skills called for steps to bolster Israel defense line and secure operational continuity at economic and security levels.

The report indicated that some critical state infrastructure entities held certification levels before the war that showed limited capacity to counter attackers. By June 2025, certification marks had risen, yet a shortfall persisted.

Cyber law stalled for over ten years

The report faulted the lack of progress on dedicated cyber legislation for more than ten years, despite internal government consensus on the need for a legal structure for cyber defense. Such a law, the report stated, was required to direct and monitor essential entities, mandate suitable protection standards, require reports on major cyberattacks, and enforce state directives during attacks.

The report noted several government resolutions on the matter from 2011 to 2021, while an international review by the National Cyber Directorate revealed that Israel lagged notably in cyber rules. Earlier State Comptroller reports had also flagged delays in advancing Israel cyber law.

In January 2024, after the war began and amid rising cyberattacks in civilian areas, Netanyahu directed officials to present a cyber bill draft for approval by the Ministerial Committee for Legislation within three months, by April 2024. As of June 2025, the bill remained unfinished, ministry disputes stayed unresolved, and no schedule existed for bill submission, the report found.

National drills absent for six years

The report also identified major shortfalls in national and sector cyber drills before the war. At the national level, the National Emergency Authority and the National Cyber Directorate skipped a national cyber drill for six years before the Israel-Hamas war.

Only in November 2024, about a year after the war started, did a national cyber drill occur in tabletop form. In March 2025, the National Emergency Authority conducted a wider national drill covering both war and cyber scenarios, which the National Cyber Directorate helped design and joined.

The report also noted that political leaders, including the prime minister, security cabinet members, and ministers, skipped the national cyber drills in 2018, 2024, and 2025. At the sector level, shortfalls appeared in cyber drills in 2022 and 2023, even though the National Cyber Directorate had set an annual sector drill as a required element for sector cyber units.

Sector cyber units displayed operational shortfalls

Sector cyber units served as the core structure for guiding, monitoring, and overseeing cyber defense across hundreds of public and private entities delivering essential services. Yet the review found that parts of the sector cyber unit system faced notable operational shortfalls.

Before the war, the National Cyber Directorate skipped intelligence briefings for the sector cyber units, failed to create a steady information exchange platform among them, and did not fully include them in tool development for their use. The professional directives issued to the units remained suggestions only and lacked binding force, while the directorate could not track their application.

The report noted positively that during the review, the National Cyber Directorate started closing some gaps by forming a professional forum with the sector units and sharing an intelligence briefing. It stated that bolstering the sector units mattered because protection levels in some areas stayed inadequate.

National cyber crisis plan was outdated

Although a 2011 government decision required the National Cyber Directorate to create a national plan for managing emergency cases in the cyber area, the report found that the document titled The National Concept for Managing a Cyber Crisis had not been revised for many years.

The document omitted references to cyber defense guides and organizational readiness materials issued by the directorate from 2018 to 2023. It also failed to list all state regulatory bodies in the cyber field, their powers, responsibility areas, or the connections between them.

The National Cyber Directorate did not direct the sector units to follow the concept, even amid the war, the report found. It also spotted shortfalls in cooperation among relevant entities handling cybercrime and financially driven cyberattacks.

21 key entities revealed readiness shortfalls

The report sent questionnaires to 21 key economic entities to gauge their readiness before the war and their capacity to handle cyber events. The entities covered sensitive groups guided by the National Cyber Directorate, government ministries, essential organizations, higher education sites, local authorities, and special groups using self-guidance in cyber matters.

Seven of the 21 entities, or 33 percent, scored 60 or lower on an index tracking organizational structures and tools for managing a major cyber event. These covered naming a cyber officer, forming a management group for a cyber crisis, holding a cyber steering committee at least once every six months, and using an internal or external incident response team.

The report found that four entities, or 19 percent, lacked any internal or external incident response team. It also found that 48 percent of the entities had not held a cyber steering committee as required in the year and a half before the war, 38 percent had not formed a cyber crisis management group, and 90.5 percent lacked cyber insurance.

Director-generals missed cyber risk details

Before the war began, eight of the 21 director-generals, or 38 percent, lacked the situational overview and information base needed to grasp their organization cyber readiness, protection level, and shortfalls. The absent details covered cyber risks, cyber policy, incident handling principles, business recovery plans, exercise lessons, and results from major incident probes.

The report found broad shortfalls in sharing recovery plans for cyber events with director-generals (52 percent) and in sharing exercise lessons (55 percent). It also found that 40 percent of director-generals did not receive critical and high-severity penetration test results, while 52 percent did not get annual reports from their organizational security operations center.

These shortfalls could hinder management ability to assign resources, decide actions, and maintain operations during a major cyber crisis, the report stated.

Risk review and incident planning showed gaps

The reports from 18 of the 21 entities, or 86 percent, showed shortfalls in threat and risk review between January 2022 and July 2023, before the October 7 attack. The report also found shortfalls in some entities in planning and applying tech measures to spot cyber events, though some were fixed during the review.

On the eve of the war, two of the 21 entities, or 10 percent, reported they had not deployed any SIEM or SOC system for tracking and managing cyber events. These entities later reported the issue was resolved after the review.

The reports on 20 of the 21 entities, or 95 percent, showed that before the war, at least one shortfall existed in planning for cyber event handling and integrating those plans into operations. The report warned that weak readiness could weaken entities capacity to manage cyber events effectively and raise the harm they cause.

Lessons from prior cyber events were not fully applied

Among 13 key entities that reported prior cyber events, five, or 38 percent, stated they only partly applied lessons from those events. The report warned that partial application could lead to repeat events in the future.

The report also found that the National Cyber Directorate data on hundreds of wartime events with notable damage potential lacked key details needed to form a complete situational overview, probe events, and draw systemic lessons. The missing data weakened the state capacity to avoid repeats and improve cyber defense steps.