Security in both the analogue and digital spheres is a fundamental prerequisite for the success of German industry and, at the same time, one of its greatest challenges. As a leading exporting nation, Germany is closely integrated into global value chains. The risks posed by extremism, political instability, natural disasters and organised crime have increased significantly in recent years. According to the Allianz Risk Barometer 2026, cyber incidents are considered the greatest business risk for companies in Germany – well ahead of business interruptions and regulatory changes. In the long term, too, data breaches, the failure of IT systems and infrastructure, the consequences of cybercrime and the resulting fines will continue to pose a threat to companies.

Digitalisation Increases Both Opportunities and Risks

As digitalisation advances and connectivity increases as a result, the number of potential attacks is steadily rising. Last year, 87 per cent of industrial companies were affected by data theft, industrial espionage or sabotage. Economic criminals are particularly targeting the theft – both analogue and digital – of sensitive corporate data in order to gain competitive advantages, for example in tenders, price negotiations or the development of innovative solutions. The resulting consequences for affected companies are therefore primarily production downtime or financial and reputational damage.

The potential of digital connectivity should therefore be harnessed to minimise potential risks. For example, artificial intelligence can help to identify anomalies in corporate networks and – where necessary – take countermeasures autonomously. It is of paramount importance that companies protect their systems and install the necessary updates and patches. Otherwise, criminals will exploit these vulnerabilities.

New and traditional Challenges in Economic Security

At the same time, the traditional challenges of economic security must also be addressed: these range from maritime piracy, smuggling, theft, extortion, corruption, espionage, sabotage and the manipulation of critical infrastructure, through politically motivated violence, to natural disasters and global pandemics. This affects the safety of employees everywhere, as well as the physical and digital security of logistics and international supply chains, both on land and at sea. A holistic approach to security – from the use of technology to reflecting on one’s own actions – is therefore essential.

Even in the digital age, people remain the weakest link in a company’s security chain. An example of the interplay between traditional security challenges and modern technical capabilities is what is known as social engineering: This involves impersonating a person or organisation in order, for example, to instruct a company’s accounts department to make a payment or to question employees about the current production facilities. In addition to the need for secure IT solutions and products based on ‘security by design’, companies must thoroughly prepare their staff for both analogue and digital threat scenarios.

In addition, drones are an increasingly common attack vector. In early September 2026, the attempted attack on Leipzig/Halle Airport using a drone laden with explosives revealed a serious security gap: organisations can detect and report unmanned systems, but are generally not permitted to interfere with or repel them themselves. At the same time, state authorities cannot guarantee comprehensive protection for all vulnerable sites. There is therefore a need for clear lines of responsibility, sufficient state capacity and legal certainty to enable a tiered response from the state and businesses.

A Holistic Approach to Security Is Essential

German companies will only be able to generate industrial value if the expertise of the industry—which is dominated by small and medium-sized enterprises—as well as its employees, production sites, and supply chains in both the physical and digital realms can be protected from security risks. To achieve sustainable resilience, cybersecurity and economic security must be addressed in a comprehensive manner. As key competitive factors for Germany as an industrial hub, ensuring these requires joint efforts by the government and the private sector. The existing collaborations between companies and government agencies within the Economic Security Initiative and the Alliance for Cybersecurity are important and effective initiatives in this regard.

The Government and the Business Community Must Work Together

An ever-increasing proportion of German companies are aware of the potential threats in both the analogue and digital spheres and are implementing organisational, personnel-related and technical security measures. Just under half of these companies are also increasingly turning to AI. As a result, willingness to invest has risen: between 2022 and 2025, the proportion of the IT security budget as a share of the total IT budget among the companies surveyed has doubled from 9 to 18 per cent. Companies are also already investing in the security of products, processes and people, and are offering concrete solutions. To support these efforts, uniform EU-wide cybersecurity and economic security requirements are needed, which are set out in the Cyber Resilience Act, the Resilience of Critical Entities Directive and the Network and Information Security 2 Directive.

We need to take security risks more seriously. This means adopting a strategic, forward-looking approach rather than merely reacting in the short term.

Demands from German Industry:

• close integration of expertise from the business sector into the work of the National Security Council
• Close integration of the national economic security strategy and the Federal Government’s cyber security strategy
• the introduction of trustworthiness assessments for all companies falling within the scope of the NIS 2 Implementation and Cybersecurity Strengthening Act and the KRITIS Framework Act,
• the clear designation of contact persons within public authorities,
• enhanced cooperation between the state and the private sector within the Alliance for Cyber Security and the Economic Protection Initiative.