Background

CERT.hr, Croatia’s National Computer Emergency Response Team, was founded in 2007 as part of the Croatian Academic and Research Network (CARNET). Its mission is to prevent, detect, and respond to cybersecurity incidents affecting public information systems, including in key sectors such as banking, education, digital infrastructure, and financial services.

As cyber threats continue to grow across Europe and the Adriatic, CERT.hr’s mission has become even more critical. In 2024 alone, Europe recorded an 18% rise in state-sponsored attacks. Alongside these, ransomware operations, credential leaks, and phishing campaigns, have continued to put more pressure on national cybersecurity authorities like CERT.hr, which safeguard both local networks and essential infrastructure.

To keep pace with threats, CERT.hr’s responsibilities have evolved well beyond traditional incident response. The team is now engaged in forensic investigations, real-time risk assessments, and compliance efforts aligned with the EU’s NIS2 Directive and other regulatory requirements.

To support this expanded mandate, the team required a solution capable of delivering real-time, contextual threat intelligence that could be integrated with existing systems and that would enhance both technical and strategic decision-making. This led to the start of the CERT’s collaboration with Group-IB

Why Group-IB?

Group-IB was selected through a public procurement process in which the company’s solution met all the technical and support criteria while offering the best value under Croatian law. What followed was a seamless deployment, supported by detailed onboarding, monthly check-ins, and fast resolution of any technical requests. Smooth integration with the SIEM was achieved via Splunk thanks to Group-IB’s dedicated app. Group-IB’s team worked closely with CERT.hr to help the organization not only operationalize threat intelligence but also tailor the platform’s capabilities to the National CERT’s unique mission and workflows.

Outcomes

With Group-IB Threat Intelligence integrated into its workflows, CERT.hr has made its operations more effective across several dimensions. The team gained visibility into previously undetected exposure points across its constituency, which has allowed analysts to detect early signs of credential leaks and infrastructure compromise with greater speed and precision.

By segmenting organizations by sector, CERT.hr sharpened its threat monitoring and response strategies to match the specific needs of each regulated domain. The platform’s dark web monitoring capabilities also enabled early alerts about potentially exploited credentials, which has given the team time to intervene before incidents can escalate.

Access to structured, high-confidence intelligence about threat actors has allowed for more in-depth reporting and gave CERT.hr the ability to track adversary infrastructure more proactively. As a result, the team not only enhanced its day-to-day operations but also bolstered its strategic advisory role within Croatia’s cybersecurity framework.

With Group-IB’s intelligence capabilities, CERT.hr has reinforced its national cybersecurity role with improved visibility, faster incident response, and greater alignment with regulatory obligations under Croatia’s Cybersecurity Act. The partnership has made the organization better equipped to protect digital infrastructure across sectors all the while strengthening collaboration between government, academia, and critical industries.

National regulations and industry requirements are tightening by the day. Group-IB solutions help you stay compliant, resilient, and ready for modern threats all the while meeting regulatory demands. Learn more