The engineering team of C1 Holding, which includes CyberTactics LLC, has completed an intensive advanced training course delivered by RED SOFT. The program was held as part of a strategic partnership and focused on developing practical skills for building comprehensive IT architecture based on trusted local software.

The course covered key components of the RED SOFT ecosystem required to create secure and reliable infrastructure for high-compliance and mission-critical environments. Particular attention was given to migration from foreign solutions and the transition to independent technology stacks.

C1 specialists studied the following products in detail:

RED OS: the team mastered the new certified version of the operating system, explored flexible configuration of graphical environments, including KDE, GNOME, and MATE, and practiced migration scenarios from version 7.3.

RED ADM: participants gained skills in centralized domain infrastructure management, including the use of migration tools from Microsoft Active Directory and configuration of enhanced password policies.

RED Virtualization: the course covered management of virtual hosts and clusters, configuration of fault-tolerance mechanisms, and use of the new disaster recovery module.

RED Database: specialists reviewed the architecture and configuration of a secure Firebird-based DBMS designed for operation in protected infrastructure environments.

Containerization tools: the team completed practical training in working with Kubernetes and Docker within a secure environment.

RED VDI: participants studied the infrastructure management system for virtual workplaces in detail.

The acquired competencies are already being applied in practice. C1 Holding, together with RED SOFT, is currently implementing a major project for a strategic customer. The project involves migrating critical IT infrastructure to a trusted software stack in full compliance with applicable regulatory requirements

C1 Holding, which includes CyberTactics LLC, has developed and released a specialized guide titled "Who Is Not a Friend Online?" to mark International Children’s Day. The guide covers current fraud schemes targeting minors and provides practical digital hygiene rules, including password protection, blocking suspicious contacts, and avoiding QR codes from unverified sources.

"As a socially responsible company, our holding cannot remain indifferent to one of the most pressing issues of modern society: the growing number of new digital threats targeting children. Today, young users often cannot independently recognize manipulation or identify malicious intent behind the image of a ‘peer friend,' while the consequences of such attacks quickly affect both children and their parents. As part of the initiative, we are holding a Children’s Cybersecurity Day within the company: children will take part in a company tour, attend a dedicated lecture on safe online behavior, and receive gifts along with our new guide, which will help them avoid becoming victims of cybercriminals," said Yulia Vorobyeva, Deputy CEO for Strategic Development and Marketing at C1 Holding.

The need for such a guide is supported by concerning statistics: according to available industry data, over the first nine months of 2025, the number of minors affected by cybercrime increased by 120%. Fraudsters now use a full range of psychological manipulation techniques specifically adapted for children, targeting them to steal significant sums of money. The C1 Holding guide explains common deception schemes, teaches children how to respond to requests from "online friends," and reminds them that the main protection for a child is a trusting conversation with parents and open discussion of any suspicious situations online

SecPost Analytics has published a large-scale review, "Who Is Who in the Domestic Information Security Integration Market." The shortlist included 20 of the industry’s largest players, with C1 Holding, formerly Tsikada, taking a strong position in the ranking.

Experts highlighted the holding’s broad service portfolio. Its key competencies include cybersecurity management, protection of industrial systems and container infrastructure, security event monitoring, including centralized incident response frameworks, and ensuring compliance with regulatory requirements.

Analysts also emphasized C1 Holding’s strong licensing foundation. Today, the company holds one of the most comprehensive sets of permits in the market: 7 licenses covering classified-information projects, cryptography, and special checks for protected infrastructure, as well as 4 licenses in technical information protection. This allows the holding to handle tasks of any complexity, from protecting confidential information to building systems for highly restricted environments

The domestic information security market continues to face an acute talent shortage. Companies are competing for a limited number of professionals, while salary bidding alone is no longer seen as a universal solution. According to experts, the issue can be addressed through long-term strategies rather than short-term attempts to poach ready-made specialists.

Vitaly Tyurin, HR Director at C1 Holding, which includes CyberTactics LLC, described the current situation in a comment for CISOCLUB as a "familiar but solvable shortage." He noted that the market is under pressure from the specifics of the integration business, sharply increased demand, and broader industry trends. In these conditions, relying only on experienced senior specialists leads to a dead end.

"We have been able to address information security hiring challenges quite successfully thanks to a clear long-term development strategy, a well-structured approach to recruiting niche specialists, and a targeted internship program with subsequent competitive employment. The steady and consistent growth of the holding, supported by major active information security projects, helps us avoid intense salary competition and gives employees opportunities for professional growth through real project cases," emphasized Vitaly Tyurin

Within the holding, CyberTactics is responsible for the information security area, including related services.

The analysts reviewed companies that take on the key security challenges faced by businesses: 24/7 monitoring, attack response, incident investigation, and compliance. In practice, this allows companies to obtain enterprise-grade security on a subscription basis without spending resources on hiring system administrators or purchasing expensive equipment.

The holding ranked 9th, providing further confirmation of its expertise in areas where the cost of error is especially high. C1 covers the full cycle of tasks, from concept development to implementation and ongoing support of security systems. The security level of its partners is ensured through proprietary solutions and the ability to integrate into any infrastructure

System integrator and vendor Tsikada JSC has changed its name to C1 as part of a planned renaming process. All other companies within the holding will continue operating under their existing names.

The decision to rename the parent company was driven by the intention to align the holding’s positioning with its current role in the physical and information security market. The new brand moves away from figurative metaphors in favor of concise technological language understood by the professional community. The name C1 refers to the binary logic of digital systems: the core principle where one means an operational and protected state, while zero indicates a failure or vulnerability.

"We are consciously moving away from loud promises, which the market is full of today. Our task is to offer customers an architecture of trust built on measurable and predictable results. The new name reflects the principle we have followed for many years: a system is either protected or it is not. There is no third option. This is an evolution from the natural precision of Tsikada to the strict certainty of digital code," said Alexander Kolosov, CEO of C1 Holding.

The holding emphasizes that the renaming of the parent structure will not affect the operations of its subsidiaries. C1 will continue managing a portfolio of specialized assets, each covering a specific segment of comprehensive protection for mission-critical infrastructure.

"The holding structure is designed as a fault-tolerant distributed system, where each module is responsible for its own function and performs it with high precision. For the customer, implementing C1 solutions should mean entering a predictable state: the facility is protected, processes are stable, and risks are calculated. We expect that over time, the holding’s name will be perceived not only as a brand, but also as an industry index of reliability," said Yulia Vorobyeva, Deputy CEO for Strategic Development and Marketing at C1 Holding.

C1 Holding includes Infotaktika Group, which specializes in classified information protection and special checks; KorBit LLC, which develops and manufactures firewall solutions; and CyberTactics LLC, which focuses on cybersecurity and confidential information protection

The holding’s total revenue reached RUB 6.2 billion. The company once again exceeded the previous year’s results and doubled the number of customers in the information security segment. CyberTactics made a significant contribution to this growth, as it is responsible for information security and cybersecurity within the holding’s structure.

"Revenue growth in 2025 was driven by increased demand for information security products and services. During this period alone, the number of projects almost doubled. In addition, the company achieved stable revenue from the sale of proprietary hardware and software systems developed under its own brand for regulated-sector customers and large enterprises. The key objectives for the coming year include continuing to develop cyber resilience for key customers, launching sales of the Bioklyuch trusted boot solution, and strengthening specialized competencies through closer cooperation with universities," said Alexander Kolosov, CEO of Tsikada Holding.

In 2025, the holding completed several large-scale projects for strategic organizations and major businesses. Its key customers included major utility, security, urban development, digital infrastructure, and social-sector organizations.

"The holding has once again demonstrated stable financial growth, outpacing the market average. Tsikada protects against physical and digital threats while relying primarily on an integrated security approach and combining best-in-class solutions. This is its key advantage over competitors. In 2026, the company plans to enter new markets, expand its regional presence, and increase sales of its own products after completing the required certification procedures," said Yulia Vorobyeva, Deputy CEO for Strategic Development and Marketing at Tsikada Holding

This year, the holding acted as a forum partner, participated with its own exhibition stand, and presented an expert talk as part of the conference program. The presentation focused on "Managed Compromise: How to Build Infrastructure with Controlled Attack Consequences."

The attacker is already inside the infrastructure: an attack takes 12 to 24 hours to develop, legitimate accounts are used in 60−80% of cases, and recovery of critical systems can take from 3 to 14 days.

We are used to protecting the perimeter, but the attack is already inside. Budgets are spent on perimeter defense, while internal interactions within the infrastructure remain uncontrolled.

Pavel proposed a shift in paradigm: instead of fearing compromise, organizations should manage it as a standard scenario. The attacker chooses the entry point, but the scale of the consequences is determined by the architecture. Using the example of a major customer with a vulnerable video conferencing service, he showed how an attacker used architectural weaknesses to disrupt business operations.

The key takeaway: compromise is not just a risk, but a scenario that must be managed

The domestic information security industry is undergoing a structural transformation. After several years of rapid growth driven by the transition to local technologies, the market has slowed down, regulatory requirements have become stricter, and the first major fines under the new data leak rules have already been issued. In these conditions, only companies that can scale, comply with the rules, and compete for scarce talent are able to remain strong.

Market: From Rapid Growth to Consolidation

According to Kontur.Focus and Kontur.Egida analysts, in 2025 the number of information security companies in the domestic market grew by only 3%, reaching 12.1 thousand. This is exactly half the growth rate of the previous year, when the figure stood at 6%. At the same time, the number of liquidated legal entities and individual entrepreneurs increased by 15.9%. Experts attribute this to market saturation and higher customer requirements.

“The space for a quick entry of new players has closed,” comments Daniil Borislavsky from Kontur.Egida. “Competition has shifted from simply entering the market to being able to stay in it. Smaller companies struggle with rising operating costs and the need to meet strict industry standards set by technical, security, and financial regulators.” The market is moving toward consolidation: major players are either acquiring entire teams or taking over smaller competitors.

Regulators Are Raising the Bar

Against this background, regulators continue to tighten the rules of the game. The technical regulator has published new recommendations for protecting the network perimeter, including stricter requirements for device administration, network segmentation, DDoS protection, and mandatory backup of configurations. The document was developed based on the analysis of real attacks involving remote exploitation of vulnerabilities.

At the same time, enforcement practice under the updated legislation is gaining momentum. A Moscow commercial court issued one of the first fines under the new rules, ordering the online school Ukids to pay RUB 400,000 after a data leak affecting 500,000 clients. The leaked data included full names, phone numbers, and email addresses. The incident occurred due to the compromise of an account in the Bitrix24 CRM system, presumably because two-factor authentication was not enabled. Although the applicable article provides for a fine starting from RUB 10 million, the court reduced it to RUB 400,000 because the company is classified as a microenterprise. Nevertheless, this is the first precedent under the tightened rules and a clear signal for the entire market.

Talent Is Becoming the Main Resource

The paradox of the current situation is that while the growth in the number of companies is slowing down, demand for information security specialists is not declining, and requirements for them are increasing. In 2025, almost 9,000 people enrolled in publicly funded places in the Information Security field, making it one of the top 10 IT specializations.

However, as a survey of CISOs and information security vendors conducted by SecPost showed, universities are not keeping pace with the market. The list of leading educational institutions included ITMO, MIPT, MEPhI, Bauman Moscow State Technical University, HSE, as well as regional universities such as Voronezh State University, Ural Federal University, and Tomsk State University. Still, graduates often lack practical skills. AppSec engineers need stronger experience in code vulnerability analysis, while SOC specialists need better knowledge of data query languages, Linux, Python, and, most importantly, proactive threat hunting.

“Universities do not have sufficient budgets for modern laboratory environments, and there is a severe shortage of instructors with practical industry experience,” Gazprombank notes. “Bureaucracy and outdated teaching methods are the main areas for improvement.” Positive Technologies suggests defining the profile of an in-demand entry-level specialist at the industry level and scaling best practices across universities.

The domestic cybersecurity market is entering a new reality: the number of companies is stabilizing, the strongest players are surviving, regulatory pressure is increasing through fines and new requirements, and the key shortage is no longer security tools themselves, but qualified specialists capable of operating them and resisting real threats.

Tsikada JSC, a system integrator in the field of information security, which includes CyberTactics LLC, and RUDN University have signed a strategic partnership agreement.

The agreement provides for joint work on introducing a practice-oriented approach to training IT students, preparing in-demand specialists for the industry, and implementing initiatives under the new co-financing framework for educational programs with business participation.

"Today, the role of IT companies goes far beyond using institutional support measures. We must actively shape the future of the industry through the development of education. The center of expertise within Tsikada Holding is Infotaktika Group. As a developer of information security tools and an integrator of information security services, it has unique experience that we intend to bring into cooperation with the university. Our goal is to create a sustainable model of interaction: from the joint development of educational programs to mentoring by our experts. I am confident that the combination of academic knowledge and practical skills held by our team will make it possible to train a new generation of professionals ready for the challenges of the modern IT industry. This is not just a partnership, but a strategic contribution to the long-term talent resilience of the sector," said Alexander Kolosov, CEO of Tsikada Holding

Analysts are seeing a shift in attackers' priorities: their main goal is no longer immediate financial gain, but the creation of long-term reputational risks for companies. As penalties for compromising personal data increase, hackers are shifting their focus to stealing customer databases and using management’s fear of multimillion-ruble sanctions as the main argument in ransom negotiations.

Timur Dzhafarov, Head of Network Security at Tsikada Holding, commented on the situation and warned companies against a critical mistake: attempting to pay off criminals. Under the new legal framework, such a "deal" may lead to consequences far more severe than even the strictest official penalties.

"Attempting to negotiate with an extortionist is a deal with a knowingly losing outcome, where legal and financial risks far exceed even the most severe fines for a data leak. Beyond the absence of any guarantees, companies may face the risk of account freezes under 115-FZ and direct criminal liability for financing terrorism, given the politicized nature of many attacks. That is why, despite growing regulatory pressure, we do not expect businesses to become widely willing to make concessions to criminals. The cost of such a mistake is too high to risk the future of the entire organization," said Timur Dzhafarov

The project became part of a respected selection showcasing examples of modern web design and usability on the Tilda Publishing platform.

The Tilda Publishing design team included the CyberTactics corporate website in its gallery of best projects, Made on Tilda. This curated selection features projects that combine contemporary design, clear structure, high-quality content, and strong technical execution.

Being featured in the #madeontilda gallery is a recognition of the website’s visual and user experience quality. Tilda designers select projects based on strict criteria, including alignment with current trends, an intuitive UX, well-considered layout, and concise presentation of information.

For CyberTactics, this is an important milestone in the digital space, confirming that complex technological and expert topics, such as cybersecurity, can and should be presented in a modern, aesthetic, and client-friendly format. The website effectively fulfills its purpose, helping users quickly navigate the range of services, explore practical case studies, and contact specialists

The transition to local software has moved from isolated projects to the creation of a full-scale national ecosystem, where security is becoming an integral foundation. Successful cases across different sectors, supported by the development of domestic hardware solutions and the regulatory framework, show the emergence of a new IT security landscape based on technological independence.

The aviation sector has become a clear example of a systematic approach. According to senior industry representatives, more than 60 airports and dozens of airlines have already moved to domestic solutions developed through industry competence centers. Projects such as a digital airport ecosystem and the BAGS Search baggage tracking system do more than replace previously used foreign products. They also improve operational efficiency. Thanks to the introduction of AI modules, Sheremetyevo Airport, for example, was able to save RUB 1 billion, proving the economic value of moving to domestic platforms.

At the same time, the hardware component of security is also developing. Tsikada Holding is bringing to the market a new family of trusted boot solutions called Bioklyuch, developed on domestic microcontrollers. As Alexander Kolosov, CEO of Tsikada JSC, noted, this is a strategic response to cybersecurity challenges, offering the market an integrated platform for protection, from individual workstations to servers used in mission-critical infrastructure. The solution addresses a key need: protecting the devices from which work with digital systems begins.

The institutional framework is also creating the regulatory and infrastructure conditions needed to accelerate these processes. By June 1, 2026, the digital development authority plans to approve a concept for creating an ecosystem of national open-source repositories. This step is strategically important, as it helps ensure technological independence and build a local innovation ecosystem. Open-source software is becoming a critical tool for checking code for vulnerabilities and creating transparent, secure solutions.

The results of this comprehensive work are already visible in practice. One of the country’s largest postal operators, with an extensive mission-critical infrastructure, has reported a full transition to domestic solutions for its key protected assets. According to its Deputy CEO for Digital Transformation, where the market lacked ready-made alternatives, as in the case of the OracleTMS transport management system, the company chose to develop its own platforms, which may later become available to the wider market

In 2025, domestic IT infrastructure faced unprecedented pressure from cyber threats. According to data presented at a high-level interagency security commission meeting, the number of attacks on mission-critical information infrastructure increased fourfold over the year. At the same time, despite a general slowdown in the growth of cybercrime, remote theft and computer-related offenses remain consistently high, while the financial sector recorded a 13% increase in attacks in the first half of the year.

These alarming figures are supported by official statistics. On September 16, senior ICT official Tatiana Matveeva stated that more than 63,000 IT attacks were recorded in the first six months of 2025, which is 27% more than in the same period of 2024. Two thirds of them were deliberately targeted at mission-critical infrastructure.

Economic Damage and Shifting Attack Vectors

The direct economic damage caused by cybercrime remains enormous. According to Deputy Head of the Digital Development Authority Ivan Lebedev, in 2024 it was estimated at RUB 160 billion, while some estimates place the figure at up to RUB 250 billion annually. In 2024, the number of IT-related crimes increased by 34.8%, with theft and fraud accounting for 70.2% of them, confirming financial motivation as the main driver of cybercrime.

This year, attackers are actively changing their tactics. According to Kaspersky Lab, although the number of attacks using backdoors decreased by 63%, incidents targeting financial organizations through online resources increased by 81%. Malware used to steal funds via remote access also became 2.4 times more common.

The Human Factor as the New Weak Link

Alongside infrastructure attacks, another threat is gaining momentum: corporate networks are being compromised through employees’ personal devices. The number of such attacks increased by 30% in the first half of 2025. Experts link this trend to the shift toward remote work, which has blurred the line between personal and corporate digital environments.

Smartphones are infected through malicious applications from unofficial sources or phishing messages in messengers, while laptops are most often compromised through phishing emails with infected attachments or illegal software.

Business Takeaways: The Need for Comprehensive Protection

The statistics clearly show that traditional security measures are no longer sufficient. Attackers deliberately target both mission-critical assets and less protected personal devices used by employees to gain access to corporate networks.

In an environment where the financial sector consistently ranks third in the number of threats after industry and highly regulated institutional segments, while the clearance rate for IT crimes, despite growing to 28.9%, remains low, businesses must take much greater responsibility for their own security.

Against the backdrop of growing business investment in digital transformation, which may exceed RUB 6.1 trillion in 2025, institutional efforts to build a comprehensive cybersecurity system are intensifying. In recent months, several key initiatives have been launched, from a centralized anti-fraud platform to long-awaited penetration testing methodologies. Together, these steps point to a new, more mature stage in the regulation of the digital environment.

A Unified Front Against Cyber Fraud

One of the most significant operational decisions was the clarification of timelines for creating a centralized platform to combat cyber fraud. According to the digital development authority, a system for interaction between regulators, banks, and telecom operators is expected to be launched on a unified technology platform by March 1, 2026. This step implements recently adopted legislation and is aimed at automatically exchanging signals about suspicious events, identifying phishing websites, and quickly restricting access to fraudulent resources.

Technology Transition Strategy: Grants in Exchange for Scalability

In parallel with anti-fraud measures, support for the domestic IT industry is being adjusted, with priority given to projects that can deliver the strongest economic impact. As part of the third wave of selection for major IT projects, RUB 8.3 billion has been allocated in grants. Priority is now given to solutions with the highest potential for scaling, the presence of artificial intelligence modules, and the ability to be used in mission-critical information infrastructure.

The new rules require grant recipients to confirm the return of funds through taxes and contributions equal to 100% of the grant amount. This approach is intended to ensure not only the development of new solutions, but also the creation of products that are truly in demand by the market and ultimately strengthen local technological independence.

The Technical Regulator Sets Security Standards

A major event for the professional community was the approval of the “Methodology for Testing Information Security Systems Using Penetration Testing Methods.” The long-awaited document is mandatory for penetration testing of high-class protected information systems with internet access.

This measure is intended to systematize and unify the process of assessing the security of critical assets. However, market data shows that identifying vulnerabilities is only half the task. Statistics indicate that companies fix only 56% of discovered issues on time, while in sectors such as healthcare and education this figure drops below 30%.

Time for Proactive Action

The set of initiatives clearly signals that the era of uncontrolled digital transformation is coming to an end. Businesses, especially those working with mission-critical infrastructure or actively participating in the digital economy, need to stay ahead of regulatory requirements.

Only a proactive and systematic approach to cybersecurity will allow companies not only to comply with tightening requirements, but also to reliably protect their growing digital assets in the face of hybrid threats.

Tsikada JSC, a leading integrator in the field of information and physical security, and RT Information Security JSC have signed a strategic partnership agreement. The document defines key areas for long-term and productive cooperation.

As part of the joint work, the companies plan to combine Tsikada’s expertise in cybersecurity and data protection with RT Information Security’s strong technological base and infrastructure experience. This synergy will allow the partners not only to significantly expand their own service portfolio, but also to offer the market innovative solutions for institutional and commercial sectors.

The alliance fully aligns with the strategic development priorities of both organizations and is aimed at strengthening their competitiveness and leadership positions in the rapidly growing information security industry

Tsikada Holding, a system integrator in the field of information and physical security, and Solar Group, an architect of comprehensive cybersecurity, have signed a cooperation agreement. As part of the partnership, the companies plan to implement cyber resilience projects for mission-critical infrastructure organizations.

The cooperation will include a pool of Solar information security solutions covering the key technology areas of the cybersecurity market. These primarily include network security and Solar’s flagship solutions, Solar NGFW and Solar webProxy, as well as an access management portfolio, including Solar inRights for account management and Solar SafeInspect for privileged access management. Another important area will be the implementation of best security practices based on the Solar Dozor DLP platform and secure development, DevSecOps, using Solar appScreener, which provides comprehensive application development security through static and dynamic analysis, software composition analysis, and software supply chain analysis, including SAST, DAST, and OSA.

As part of the partnership, Solar’s experience in preparing cyber defense teams through cyber ranges will also be applied, along with the development of information security specialists' skills through Solar Method educational programs and other initiatives aimed at reducing the impact of the human factor on organizational cyber resilience.

"In partnership with major domestic integrators, we are increasing the number of touchpoints with potential customers. This allows us to expand the presence of Solar technologies in projects related to information security solution implementation, technology transition, and the development of comprehensive cybersecurity architecture for major companies. Cooperation with Tsikada Holding opens up new opportunities for working with mission-critical infrastructure organizations and implementing complex projects to protect information assets," commented Nikolay Sivak, Commercial Director of Solar Group.

Tsikada JSC is a vertically integrated holding that implements comprehensive security projects, from concept development to implementation and support throughout the entire system lifecycle.

"Thanks to our cooperation with Solar Group, we can offer customers a wider range of reliable information security solutions that fully meet the high requirements of the modern market for protection against current threats. I am confident that these solutions will attract strong interest from companies that value broad functionality and product quality in maintaining information security," said Alexander Kolosov, CEO of Tsikada JSC.

The partners plan to develop joint projects for implementing Solar information security technologies, with a focus on corporations and mid-sized companies in the financial sector, industry, and highly regulated organizations