What is the biggest vulnerability of the Romanian state when it comes to digital transformation, and how can it be addressed?
The answer is complex, but the first thing that comes to mind is cybersecurity, particularly in critical systems. This is not just a digitalization challenge; it is a systemic vulnerability.
Think about what unprotected or poorly protected critical infrastructure means in today’s world: transport, energy, utilities, communications networks, financial systems, and healthcare infrastructure becoming vulnerable to external attacks. The more digital our society becomes, the more essential resilience and security become.
At the same time, one of Romania’s structural challenges is not technology itself, but continuity. Large-scale digital transformation projects require multi-year budgets, long-term planning, and the ability to maintain direction beyond political cycles.
Too often, new decision-makers arrive with new priorities, while projects initiated by their predecessors are delayed, reshaped, or abandoned altogether. This creates fragmentation, slows progress, and reduces the overall return on public investments.
European funding mechanisms, including the Recovery and Resilience Facility (PNRR), have helped improve continuity by linking financing to clearly defined milestones.
However, even in areas supported by structural funds and long-term sectoral programs, continuity remains one of the key challenges that Romania still needs to address.
Another major vulnerability of Romania’s digital infrastructure is closely linked to cybersecurity: the lack of a Secure-by-Design approach in the development of digital systems.
In practice, there are two ways to build software and technology solutions. The first is to develop the system and only assess its cybersecurity posture at the end, once it has already been deployed. At that stage, vulnerabilities can still be identified and fixed, but often at a significantly higher cost and with greater operational risks.
The second approach is Secure-by-Design, which integrates cybersecurity requirements from the very beginning of the development process. Security is treated as a core component of the system architecture, not as an additional layer applied after deployment.
With the second approach, the resulting systems are inherently more resilient to cyber threats and better prepared to withstand future risks.
In our view, the limited adoption of this mindset across public-sector digital projects remains a significant vulnerability.