German Industry Faces Rising Cyber Threats, Strategic Maturity Lags
Cyberattacks are a persistent reality for German industrial companies, posing a serious and growing threat. However, a recent cross-industry survey reveals that many organizations lack a clearly defined and strategically integrated cybersecurity approach.
High Awareness, Low Strategic Maturity
A survey conducted by Diconium among 200 IT decision-makers and managers in Germany found that 74% rate the threat of cyberattacks as high or very high. This indicates a widespread awareness of cyber risks across various sectors, including mechanical engineering, electrical engineering, pharmaceuticals, and food and beverage. Despite this awareness, strategic maturity remains low. Only about half of the companies surveyed have fully integrated cybersecurity as a core component of their corporate strategy, even as another 40% consider it important but position it strategically lower in priority.
“Many companies recognize cyberattacks as a real threat, but are not yet drawing the necessary strategic conclusions from them,” says Michael Achatz, Managing Director of Diconium Germany. “Without clear governance, sufficient resources and practiced responsiveness, cybersecurity remains fragile in an emergency.”
Regulatory Compliance and the Necessitate for Action
The study also highlighted concerns regarding regulatory compliance. Almost a quarter of the companies surveyed are currently unsure whether they meet minimum legal requirements. While approximately two-thirds of companies currently meet these requirements, only a small percentage proactively pursue a cybersecurity strategy that goes above and beyond basic compliance. The upcoming regulatory landscape, such as the EU’s Cyber Resilience Act, presents an opportunity to elevate security standards.
Challenges to Implementation
According to the survey, the primary obstacles to implementing effective cybersecurity measures are structural and organizational. Skill shortages in IT and operational technology (OT) security, coupled with outdated IT and production systems, are the biggest impediments. Financial resources are less of a concern.
Looking ahead, companies are prioritizing investments in secure cloud infrastructures, security awareness training, and AI-based security solutions. However, operational security measures like penetration testing, incident response planning, and simulation-based exercises often receive less attention, leaving organizations vulnerable in real-world attack scenarios.
“The results of our survey present that companies need to think about cybersecurity more holistically,” comments Saul Dickinson, senior director of cybersecurity at Diconium. “Anyone who translates regulatory requirements into sustainable processes and structures at an early stage and consistently establishes operational security measures not only strengthens their own resilience, but also the company’s credibility towards customers and partners.”
Automotive Industry as a Benchmark
A comparison with a previous Diconium survey focused on the automotive sector reveals a notable difference. Cybersecurity is more strategically embedded and advanced in terms of regulatory compliance within the automotive industry. The automotive sector, with its evolving requirements like the Cyber Resilience Act, is increasingly serving as a benchmark for industrial cybersecurity maturity. Cybersecurity in the automotive industry.
About the Study
The survey was conducted in December 2025 by techconsult on behalf of Diconium. It included 200 IT managers and managing directors from German industrial companies of varying sizes.