TÜV Study on Cyber Security: German Companies Still Under Pressure

Companies operate under a “false sense of security,” warn the BSI and TÜV. This may sound surprising given the persistent threats. However, it is backed up by a recent study on cyber security in companies.

Many companies underestimate the situation, overestimate their own capabilities, and fail to take sufficient protective measures. These and other findings were made by the German Technical Inspection Association (TÜV) and the German Federal Office for Information Security (BSI). Only half of those surveyed were aware of NIS-2, which is alarming given that 29,000 additional companies will be affected by it. At the same time, over 90 percent consider their own security to be good or very good. Shockingly, for a quarter, IT security only plays a minor role.

BSI Management Is Concerned

The head of the BSI, Claudia Plattner, is concerned and warns that Germany still faces significant challenges ahead. Plattner also refers to the EU’s Cyber Resilience Act, which prescribes minimum requirements for networked products in Europe. TÜV notes that while awareness of the problem has grown, many companies still are not sufficiently prepared.

Dr. Michael Fübi, President of the TÜV Association, and Claudia Plattner, BSI President, at the presentation of the study, Source: BSI

Four Percent More Victims of Cyber Attacks

The 58-page study contains numerous worrying findings. The number of cyberattacks on companies increased be four percent over the last year – now impacting roughly one in seven. In almost all cases (84 percent) the intrusion was carried out via phishing. More and more threat actors utilise AI in their attacks, while it is hardly used by defenders (51 percent vs. 10 percent). Seven out of ten respondents consider security standards to be important, but only 20 percent put them into practice.

“Cybersecurity in German companies” – the TÜV Cybersecurity Study 2025

The TÜV Association is therefore calling on politicians to prioritize cybersecurity and include it in the overarching security strategy, as well as to clarify responsibilities more clearly. NIS2 and CRA must be “launched swiftly” despite all the delays to date.

TÜV’s Recommendations for Business

According to TÜV, companies should take threats seriously and carry out qualified risk analyses regularly. A cyber strategy is essential, as are security guidelines with measurable objectives, clearly assigned responsibilities, and concrete action plans.

Differences Between Large and Small Companies

The study reveals a striking difference based on company size. While 95% of companies with more than 250 employees give great importance to IT security, only two thirds of companies with up to 50 employees do so. Only in terms of self-assessment do large and small companies agree: over 90% consider themselves to be well protected, regardless of company size. However, almost half of large companies (41%) are aware of the high risk in the supply chain, while only 21% of small companies share this assessment. 78% of companies with fewer than 50 employees also do not believe that the supply chain poses a risk of cyberattack.

Origin Unknown

Although most companies fear criminal or state-sponsored attackers, internal actors are perceived as less of a threat. Only 9 percent were able to attribute attacks to a regional source, with 6 percent of the incidences coming from China, according to the more than 500 respondents.

Investment in Cyber Security

27% of companies also increased their IT security budget over the last year, while 15% hired additional experts – a slightly lower ratio than in the previous year. Around 20 percent of companies try to increase security by either using increasing or reducing the use of cloud services. Pentesting and emergency drills are also at the bottom of the list at around 25% each.

The majority of investments focus on hardware updates, new cybersecurity software, and measures for networked systems – exactly the areas covered by Greenbone’s specialized products.

Conclusion: Unspecific Threat, Known Methods, Lack of Security Discipline

Looking at the results of the study, the conclusion will be evident that, although it is by no means clear where the attacks are coming from, the successful methods of attack seem clear. There is also an asymmetry in the use of technology, as the example of AI shows.

The fact that almost 80 percent of respondents admit to only implementing common security standards to a limited extent is a clear warning sign – for BSI, Politicians, and security experts alike. Unsurprisingly, the TÜV association is calling on the German government to advance cyber security, and implement regulations quickly. After all, this is what the majority of respondents want.