A Regional Blind Spot: Closing the Cybersecurity Gap in the V4 Regional Cooperation

Péter Magyar's landslide victory over Viktor Orbán in Hungary's April 2026 parliamentary election did more than end sixteen years of Fidesz rule. It reopened a regional format, the Visegrad Four,  that had been effectively dormant since Russia's full-scale invasion of Ukraine. On June 23, Magyar hosted the prime ministers of Poland, Czechia, and Slovakia at the Grassalkovich Palace in Gödöllő for the first V4 summit in two years, declaring simply, "V4 is back." The four leaders agreed to resume pre-summit consultations ahead of every major European Council meeting and identified a working list of shared priorities: the next Multiannual Financial Framework of the European union, including cohesion and agricultural policy; energy prices and cross-border energy corridors; and merit-based EU enlargement. However, the coordination of cybersecurity and resilience activities got little attention.

Cybersecurity was not entirely absent from the record. The joint statement issued after the summit names "cross-border cybersecurity" among a cluster of areas - alongside digitalization, artificial intelligence, and digital public services  - where the four governments agreed that "intensified cooperation is needed." But that is where the commitment ends. Unlike energy, agriculture, or the MFF, cyber received no working group, no ministerial follow-up, no timeline, and no line in the joint statement's list of concrete priority projects, which instead centered on a Warsaw-Budapest-Bratislava-Prague high-speed rail link and expanded energy interconnection. For a region that sits on NATO's eastern flank, hosts the bulk of the EU's exposure to Russian hybrid activity, and shares a deeply integrated industrial and financial base, that omission is not a footnote. It is a strategic gap the V4's revival should be focusing on and closing, rather than carrying forward.

Cyber threats, and the multinational companies that operates in the region and must face these do not stop at the border, thus their effect cannot be considered alone in countries but rather in the whole region. However, the countries cybersecurity policies and strategies, by contrast, remains almost entirely nationalized - a mismatch this paper examines through two lenses: how each V4 state frames cooperation in its own national strategy, and how the EU's flagship cyber directive, NIS2, is being transposed in ways that fragment rather than unify the region's defenses.

National Cybersecurity Strategies: Shared Threats, but Fragmanted Response

Each V4 country has published or substantially updated its national cybersecurity strategy within roughly the last year, and the resemblance among them is striking. Poland's amended National Cybersecurity System Act, Slovakia's national strategy, the Czech Republic's framework, and Hungary's national cybersecurity strategy documents all, to a certain degree, name a nearly identical threat set: a volatile geopolitical environment, data and privacy exposure tied to deepening digitalization; supply-chain vulnerabilities in critical infrastructure; shortfall of cyber workforce capacity and public awareness. This convergence is not a coincidence, but rather it reflects a genuinely shared threat environment. Where the strategies diverge is in how they define the cooperation they say they need. The documents call for deeper international collaboration, but that language is directed almost exclusively toward the European Union and NATO frameworks, including ENISA coordination mechanisms, the EU's CSIRTs Network, NATO's collective cyber defense arrangements. The V4 framework itself, or the wider Central and Eastern European region, is largely absent as a named partner. Regional cooperation is treated as something that happens through Brussels or through NATO channels, not as a distinct track worth building in its own right. This is a strategic oversight: EU- and NATO-level mechanisms are necessarily built for twenty-seven or thirty-two members and move at the pace of the slowest common denominator. A V4-specific track - sized to four states with comparable institutional maturity, overlapping threat profiles, and, in many cases, shared critical infrastructure and cross-border industrial supply chains - could move faster and address problems that are simply too regionally specific to surface at the EU level.

NIS2 Implementation across the V4: A Fragmated Compliance Landscape

The EU's revised Network and Information Security Directive (NIS2) was designed precisely to close this kind of gap, obligating member states to cooperate on supply chain vulnerabilities, incident response, information-sharing, and supervision of critical-sector entities. In practice, its transposition has produced divergent technical baselines and mismatched timelines within the V4 itself. Hungary's implementing legislation ties required security controls directly to NIST SP 800-53, an American federal framework built around detailed, prescriptive control catalogues. The Czech Republic and Slovakia went the other direction, building their cybersecurity acts around the ISO/IEC 27000 family instead. Furthermore, the compliance calendars diverge just as much as the standards do: Slovakia's regulation has been in force since January 2025 with audits phased in over five years, while the Czech law only took effect in November 2025, and Poland's amended framework entered into force in April 2026 but front-loads registration by October 2026 while pushing full technical compliance and audits out to 2027 and 2028 respectively. A company operating across the region is not just filing paperwork with four different regulators - it is building toward structurally different control frameworks with four different timelines.

The practical consequence is that a company operating across all four V4 markets  - a defense contractor, a bank, an energy operator, a logistics firm  - faces four different registration processes, four different competent authorities, four different incident-reporting portals, and four different timelines for reaching full compliance. NIS2 was meant to harmonize the substance of EU cybersecurity law, and on paper it has: the baseline obligations, reporting windows, and penalty ceilings look broadly similar across member states. But the procedural detail underneath that shared baseline has fragmented rather than converged. Within a region as economically integrated as the V4, where firms routinely operate subsidiaries or shared infrastructure across two or three of the four states, this procedural fragmentation imposes a real and avoidable cost, and it complicates exactly the kind of rapid, coordinated incident response that NIS2 was written to enable.

An Opportunity for Cyber Cooperation

The Gödöllő summit's real significance is that it reopened a channel that had been closed for years, now  the countries have both the opportunity and the institutional mandate to decide what fills it. The leaders' own joint statement already names cybersecurity as an area needing intensified cooperation, however what is missing is the machinery to act on that language, and the region has models close at hand. A standing V4 cyber working group under the CSIRT network, a shared framework for aligning NIS2 supervisory practice across the four competent authorities, and joint threat-intelligence sharing focused specifically on Russian-origin hybrid activity in Central Europe would cost little relative to the rail and energy projects the group has already prioritized. None of this requires new treaties or institutions - it requires the V4 to treat cyber the way it is already treating energy and infrastructure, thus as a shared problem best solved regionally, not deferred indefinitely to the European Union.

The alternative is that cybersecurity remains what it has been for the past several years of V4 drift: a line in a communiqué rather than a line of effort. Given the threat environment all four national strategies already describe in nearly identical terms, that would be a costly inconsistency for a region that is, on every other file, trying to prove it can act together again.

_________________________________________

By Balazs Iszak - Fellow of Cyber and Emerging Technologies Program at the Strategic Security Initiative (SSI)

Photo: OpenAI