The Revolut affair has sparked much debate amongst analysts and those following the story. As some have noted, however, at the heart of the problem lies a concept of ‘misplaced trust’. Revolut appears to have trusted a certified email that it believed to be genuine and authentic and, on that basis, acted without delay.
Some analysts have identified this critical issue and immediately drawn attention to it: is it possible that, in 2026, such sensitive data could be provided simply on the basis of a certified email (PEC)? Without further verification, without using dedicated systems, without implementing mechanisms to verify the sender’s identity (because certified email addresses do not certify the sender’s identity, whereas REMs do) and without a telephone call?
Apparently so, it is possible, and perhaps this should serve as a wake-up call to all those tech enthusiasts who believe that security depends solely on tools and not on processes. If a verification procedure had been put in place, we wouldn’t have had the Revolut incident today, just as there wouldn’t have been the Twitter incident in 2020. So once again we find ourselves talking about cybersecurity without actually talking about cybersecurity: there is no end to the discussions about certified email (PEC), SPID, VPNs and encryption, but few realise that, in order to choose and adopt a tool, one must start by designing a process that coordinates the flows between two or more parties.
Amidst all the bar-room chatter, the essence of the matter gets lost: there is a lack of coordination and no overarching strategic vision. An interesting article in *La Stampa* states:
The answer to the question – subject, as always, to the methodological caveat that this is based on what we know today – is necessarily negative, leaving no room for doubt or interpretation of any kind. And there are many and varied reasons for this. […] The first is disarmingly simple: the office holding the certified email address in question has no jurisdiction over the request for the data and documents sought from the bank
This won’t get us anywhere, that’s for sure. We can ask businesses to adopt cutting-edge technical measures and extremely high service standards, but if we fail to establish secure processes, we will never achieve an adequate level of cybersecurity. This, perhaps, is also down to this regulatory bloat, which leads organisations to make the bare minimum effort to avoid complying with one regulation whilst, at the same time, breaching another.
Privacy engineering
A few days ago, during a meeting, a major healthcare centre in northern Italy presented the security measures it had implemented within its IT infrastructure; there are many reasons for holding an online meeting such as this, one of which is to demonstrate one’s reliability to suppliers and institutions. Around twenty participants of various backgrounds were in attendance: there were representatives from the public sector, as well as suppliers of software, hardware and other services, and the aim was to showcase their ‘newly polished tools’.
During the meeting, following an initial hour of presentations by the suppliers and technicians, time was set aside for questions – and that’s when a Pandora’s box was opened. No risk management plan, no disaster recovery plan, no restore procedures – just a brief description of the backup process – and no business continuity plan. Everything looked polished, but nothing was ready for real-world use because, during those months, nobody had given any thought to what to do if an incident occurred; not a single supplier had written more than a few lines regarding inventory and configuration.
So, when one reads about cases such as Revolut – which many rightly find interesting – others view them with weariness and move on, as they regard them as tragically commonplace and a confirmation of attitudes that have persisted for years and which we cannot seem to shake off.
Conclusions
Processes come first, then technology. Rules come first, then tools. Method comes first, then the use of equipment and software. Unless this principle is truly understood, it will be futile to hope to resolve issues such as those described above. Furthermore, this task must be a joint effort between technicians, lawyers and managers: establishing new processes is a complex undertaking that must be approached holistically.
Understanding the rules means developing a systematic approach to problems: tackling them from multiple angles, depending on the objectives one wishes to achieve.
