Companies should not assume their cyberdefences can keep nation-state attackers out, warned the an executive from telecommunications firm ATN International, the US parent company of One Communications.

“Nation-states will always get in,” said vice-president of security and architecture Rich Casselberry, recounting advice from Jake Williams, a United States government intelligence operative.

Speaking at the Protect What You’ve Built: Bermuda Cybersecurity Summit 2026, Mr Casselberry advised businesses to focus on detecting intruders and removing them quickly.

Nation-state cyberattacks are sponsored by sovereign governments or directed or tolerated by them to achieve political, military or economic goals.

He explained that organised cybercrime is about getting money, but nation-state attacks are more targeted.

“They are actually out to get you,” he said.

There can also be collateral damage to businesses and people not directly in the cyberattackers’ crosshairs. Mr Casselberry said they can take down relied-upon partners in sectors such as finance or communication.

He also talked about ransomware, saying it has grown from the stereotypical teenager in the basement with a hoodie, to being incredibly organised.

Ransomware attackers can be well-funded and adept at building trust with victims. He added that when attackers contact potential victims there is often a sense of urgency from the attacker.

“They are remarkably good at convincing you that you need to do something right now,” he said. “Anytime someone sends me a message saying I need to do something right now, I usually just delete it because it is very rare that I would need to do anything right now.”

Another clue was that the attacker often had excellent customer service skills when contacting potential victims.

“When people call you and pretend to be your helpful IT desk, they are amazing,” Mr Casselberry said.

The financial fallout from a ransom attack can go far beyond the actual ransom.

He described a tabletop exercise where the modelled incident cost $21 million in damages, with $18 million of that attributed to customer notifications and regulatory fines.

He urged companies to create a culture where it is safe for workers to push back against and question unusual instructions.

Artificial intelligence is making it even easier for cyberattackers, Mr Casselberry said.

“Deepfakes once cost hundreds of thousands of dollars, and it took about 20 hours of video,” he said. “Now you can do it almost for free with eight minutes of video. Audio calls are even easier — you need about eight seconds of audio.”

Cybercriminals were also changing their phishing techniques, he said.

“We used to say, if you want to know if it’s a phishing e-mail, check and see if there is bad spelling or bad grammar,” Mr Casselberry said. “If there is, it is probably a phishing attempt and you should ignore it. I would almost say the opposite of that is true now.”

The executive said some organisations keep extra copies of data around “just in case” which can leave more data exposed if a breach occurs.

“Clean-up matters,” he said. “Clean stuff quickly.”

Back-ups should be tested because having them is not the same as knowing they can be restored, he said.

He advised leaders to prepare for disruption before an incident and decide in advance which systems and customer services must come back online first.

The summit was held at the Hamilton Princess & Beach Club, hosted by Brava and powered by One Communications.