Alfatec Retains Its Legal Identity as 10XPay and 10XTrust Launch in 2027

With its acquisition of Alfatec, Sweden’s Verisec is expanding across the Adriatic region and strengthening its expertise in cryptography, data protection and AI development. For the Croatian company, the transaction creates opportunities to enter markets where its new owner already operates, while no immediate changes to its organisational structure or workforce have been announced.

“Alfatec will continue to operate as the same legal entity, under the same name and at the same address,” Marko Kornfeld, Managing Director of Alfatec Group, tells ICTbusiness Media - ICTbusiness.info. In this interview, he discusses the rationale behind the sale, plans for expansion, the introduction of 10XPay and 10XTrust in the first quarter of 2027, and why regulatory compliance is not the same as genuine resilience against cyberattacks.

What was the value of the transaction, how was the price determined, and were any deferred or performance-related payments agreed?

All details relating to the transaction are confidential business information and cannot be disclosed.

What does Verisec gain from acquiring Alfatec, and what did its former owners seek to achieve through the sale?

All of the above. This acquisition is part of Verisec’s strategic initiative, specifically its expansion into the Adriatic region, further consolidating its position as one of the leading providers of general-purpose and payment cryptography solutions in Southeast Europe. By acquiring Alfatec, it gains a substantial client base and specialists in cryptography, AI development, data management and proprietary products, along with experience in EU co-financed projects.

For Alfatec, the transaction creates the conditions for continued growth through expansion into international markets where Verisec already operates.

How will the acquisition affect Alfatec’s operations, workforce and relationships with customers and partners, including Entrust and Thales?

Our customers and partners will see no change in business continuity or the way we work together. Our existing technology partners, including Entrust, Thales and others, have given us their full support, further strengthening our market position.

Alfatec will continue to operate as the same legal entity, under the same name and at the same address. There are no changes to our organisational structure or personnel, and I, Marko Kornfeld, will continue as Managing Director.

What are your plans for business development, the introduction of Verisec products, investment and recruitment?

Our entire existing portfolio remains focused on the Adriatic region, and we also expect to enter additional markets in Central and Eastern Europe (CEE).

In the first quarter of 2027, we will introduce two Verisec solutions that are new to our region, 10XPay and 10XTrust, in the IT security segment. We expect stronger growth in the period ahead through a combination of our existing IT security solutions and the new Verisec products.

Verisec aims to strengthen Alfatec’s capabilities and support their growth. We expect to continue developing our existing products and investing further in them. To achieve this, we also plan to recruit additional specialists.

Which cyber threats are growing most rapidly, and what do incidents in Croatia reveal?

There is no single threat growing at the same rate across every sector. However, the NCSC’s latest overview for the third quarter of 2026 indicates that phishing and other forms of fraud are among the frequently reported incidents in Croatia, while ransomware remains a serious risk.

AI-assisted attacks deserve particular attention. According to the NCSC, attackers used AI tools in incidents targeting Croatia during 2026 to accelerate the discovery and exploitation of vulnerabilities, especially in custom-built web applications that had not undergone appropriate security testing. Supply-chain risks are also significant because an organisation’s security depends on its suppliers, their systems and access privileges.

Have NIS2 and the Cyber Resilience Act (CRA) made companies more secure, or is compliance too often reduced to paperwork?

Stricter rules can improve security, but only if their requirements translate into real processes and controls. NIS2, transposed into Croatian law through the Cybersecurity Act, establishes requirements for risk management and the reporting of significant incidents. The CRA introduces security requirements for products with digital elements throughout their life cycle and will apply in full from December 2027.

The risk is that compliance is treated as a one-off documentation exercise. The NCSC’s guidance describes cyber-risk management as an ongoing process linked to business decision-making. It must be regularly updated and cover IT, operational technology, cloud environments and suppliers. In other words, formal compliance is not in itself evidence of resilience. What matters is whether an organisation can detect a threat, respond to it and continue operating.

How will AI, automated attacks and post-quantum cryptography reshape security over the next five years? What should organisations do now?

We are seeing new and increasingly sophisticated cyberattacks involving AI practically every day. This is already driving significant improvements in defensive security solutions.

Over the next five years, the biggest change will not be what attackers do but how quickly and at what scale they can do it. AI is already lowering the barriers to launching attacks. Phishing messages are becoming convincing and personalised; deepfake audio and video are being used to impersonate executives and suppliers; and automated tools can discover and exploit a vulnerability within hours of its disclosure. The time organisations have to react will increasingly be measured in hours, not weeks.

At the same time, AI is becoming a vital ally for defenders. Organisations using it for anomaly detection, analysis of large volumes of logs and automated incident response will be better able to keep pace. Those relying exclusively on manual processes will be at a disadvantage. Yet AI systems also introduce new risks, including data leakage through unsupervised employee tools, model manipulation and attacks on software supply chains.

A third, often underestimated risk is cryptographic. The development of quantum computers could one day compromise algorithms that currently protect almost everything, from banking transactions to the management of energy networks. Attackers can collect encrypted data today with the intention of decrypting it later, an approach known as “harvest now, decrypt later”. Data that must remain confidential for ten years or longer, including healthcare, financial and government information, is therefore particularly exposed. Post-quantum cryptography standards already exist, and the European framework envisages the migration of critical infrastructure to such protection by the end of this decade. That is a short timeframe for large systems. We are also seeing companies take security more seriously primarily when they operate in sectors subject to binding regulatory requirements.

That is why IT security must be treated as a necessity and an investment in business survival, not an unnecessary expense. The market needs better education about cybersecurity before an incident occurs and causes damage.