Current situation analysis in cyber security from the perspective of private company employees on the european side of İstanbul

Cybersecurity is the practice of protecting computers, networks, software applications, critical systems, and data from potential digital threats. Private and public institutions alike bear the responsibility of safeguarding data to maintain customer and citizen trust and to comply with regulatory requirements. Cybersecurity measures and tools are employed to protect sensitive information from unauthorized access and to prevent disruptions in business operations due to unwanted network activity. Private enterprises operating in diverse sectors such as energy, transportation, retail, and manufacturing utilize digital systems and high-speed internet connections to deliver effective customer services and conduct cost-efficient business operations. Just as they secure their physical assets, they must also protect their digital assets and systems against unauthorized access. A deliberate activity that involves breaching a computer system, network, or connected facilities to gain unauthorized access is defined as a cyberattack. Cyberattacks targeting private companies not only cause direct financial and reputational losses to the affected firm but can also inflict significant financial and non-financial damage on affiliated organizations. In line with the issues outlined above, this research focuses on the threat of cyberattacks targeting private companies in Türkiye, examining their underlying causes, types, impacts, and consequences. As digital transformation accelerates across sectors, cybercriminals increasingly exploit vulnerabilities within corporate systems, leading to substantial financial, reputational, and operational damage. Within the scope of this thesis, common cyber threats faced by private companies—such as phishing, malware, distributed denial-of-service (DDoS) attacks, man-in-the-middle attacks, and eavesdropping—have been categorized. The causes and consequences of these threats, corporate response strategies, types of damage incurred, mitigation measures, recovery methods, and risks of repeated exposure have been investigated through face-to-face survey interviews. The significance of the findings was assessed using IBM SPSS Statistics 27.0.1, and relationships among variables were determined by applying the Chi-square test. According to recent data, there are approximately 2 million active joint stock and limited liability companies operating in Türkiye. For this research, the target population was limited to companies located on the European side of Istanbul, estimated at 500,000 businesses. Based on a 5% margin of error, a 98% confidence level, and an anticipated response rate of 98%, the required sample size was calculated as 43. To increase participation, face-to-face interviews were conducted, and despite ethical concerns often raised by large-scale companies with extensive staff, a total of 50 company representatives agreed to participate in the study. The evaluation of the survey results revealed that 44% of the participating companies were small and medium-sized enterprises (SMEs) employing between 11 and 50 personnel. This finding indicates that SMEs are active stakeholders in cybersecurity research and that cyber threats have a pronounced impact on firms of this scale. Notably, 90% of the participants stated that they had been targeted by externally sourced cyberattacks, demonstrating that a significant proportion of Turkish companies are exposed to external threats. This finding suggests that cybersecurity policies should be shaped not only by internal threat parameters but also by a clear understanding of external risks. An analysis of attack types revealed that phishing attacks were the most common, with an incidence rate of 94%. This remarkably high percentage highlights the critical importance of user awareness and training, as phishing primarily exploits human error. Therefore, user education should be treated as a strategic priority alongside technical measures. Additionally, 76% of respondents identified "outdated software" as one of the primary reasons for cyberattacks. This underscores how neglecting software security and regular updates exposes organizations to increased cyber risk, as outdated systems harbor vulnerabilities easily exploited by attackers. Regarding post-attack response behavior, 56% of companies reported ignoring the source of the attack, which resulted in 66% experiencing data loss. This shows that failing to take attacks seriously has direct negative implications for information integrity and data security. On the other hand, 74% of participants indicated that identifying and addressing security vulnerabilities was the most common method for mitigating damage. This highlights the importance of technical interventions as a crucial post-incident recovery measure. Similarly, 78% reported that the preferred method of response following an attack was "system isolation and cleaning," indicating that while companies are somewhat prepared for incident response, they tend to take action only after an attack occurs. The findings of this research reveal that companies operating in Türkiye generally have an insufficient perception of the threat posed by cyberattacks and often do not fear falling victim to such attacks. Consequently, potential threats are frequently overlooked, and losses incurred are not adequately addressed due to the lack of competent in-house personnel. This situation highlights the need for external expert support. Furthermore, the results demonstrate that it is essential for companies to have cybersecurity software in place and to ensure that these tools are regularly updated. In addition, periodic training of employees on cybersecurity is identified as a key measure. In conclusion, to enhance cybersecurity awareness, strengthen risk management, and establish a sustainable security culture, companies must prioritize not only investments in technical infrastructure but also the human factor. In this context, strategic planning, staff training, and continuous updates of security technologies must be addressed as priority areas.