Cybersecurity trends 2026

The threat situation in Germany is well documented in numbers. The BSI registers an average of 119 new vulnerabilities per day, and Bitkom put the annual total damage from cyberattacks at around 289 billion euros in its 2025 economic protection study. More interesting than the figures is the shift behind them: what was still a recommendation in 2023 is now, on several points, a legal obligation or a technical necessity with a deadline attached.

1. NIS2 applies, the obligation is here

The German NIS2 implementation act came into force on 6 December 2025, with no transition period for the technical and organisational measures. The registration deadline with the BSI expired on 6 March 2026. Around 29,500 entities across 18 sectors are affected, compared with roughly 4,500 previously under BSI supervision.

What is new is above all that this is binding for mid-sized companies. As a rule of thumb: from 50 employees or 10 million euros in annual revenue in a regulated sector. Fines reach up to 10 million euros or 2 percent of global annual revenue, and management is personally liable. Reporting deadlines are tight: 24 hours for an early warning, 72 hours for an initial report, one month for the final report.

What follows from this: two of the ten core measures under the revised BSI act directly affect network procurement, namely supply chain security and contingency planning. Anyone buying connectivity is also buying compliance evidence, or failing to. Even so, according to the Cyber Security Report 2026, around half of the companies surveyed underestimate their own regulatory exposure.

2. AI becomes an actor, not just a tool

The decisive change of the past twelve months is not that attackers use AI. They did that before. What is new is that AI systems carry out attack steps themselves. On 22 June 2026 the BSI published a cybersecurity warning on the impact of AI development on the threat situation, rated criticality 2 of 4. Its core message: AI lowers the effort, time and entry barriers for offensive capabilities. From published patches, patch diffing can reveal within minutes to hours what an exploit needs to look like.

The practical consequence for vulnerability management: CVSS base scores alone are no longer sufficient as a basis for prioritisation, because AI can chain several individually uncritical vulnerabilities into one attack path. The BSI recommends adding environment-dependent risk, for example via the CVSS 4.0 environmental metric and complete inventory lists.

The second half of the problem is a company’s own AI usage. An agent that automates campaign analysis needs access to the CRM, the mail platform, customer data and external APIs. Each of those is a potential entry point, and prompt injection turns it into a realistic path: a manipulated email with hidden instructions can make an agent forward confidential content. This is exactly where Shadow AI governance via SASE comes in.

3. Post-quantum: the crypto inventory becomes mandatory

In the 2026 edition of its technical guideline TR-02102-1, the BSI stated for the first time that companies should no longer rely on classical asymmetric encryption alone, and set a timeframe through 2031. The NIST standards have been available since August 2024: FIPS 203 for key encapsulation, FIPS 204 and FIPS 205 for signatures. For the transition phase the BSI recommends hybrid methods that run classical and quantum-safe algorithms in parallel.

The time pressure does not come from quantum computers themselves but from the lead time. A crypto migration in a grown infrastructure is a multi-year undertaking, and the risk is already running: with harvest now, decrypt later, encrypted traffic is captured today and decrypted later. That matters for data with a long confidentiality period, regardless of when capable quantum computers become available.

The first step is unspectacular and therefore often skipped: a complete inventory of all cryptographic dependencies. TLS certificates, VPN tunnels, embedded SSH keys, applications with their own cryptography. Without this inventory there is no way to prioritise, and without prioritisation the migration becomes arbitrary. For network services, the question of a PQC roadmap therefore belongs in every provider evaluation from now on.

4. Zero Trust becomes operational rather than conceptual

Zero Trust is largely accepted as a principle, and Gartner surveys show a broad majority of companies with a started or partially implemented strategy. The interesting gap sits between started and enforced. A Zero Trust concept that grants exceptions for legacy systems in three places is, in effect, a perimeter model with extra overhead.

Operational means: continuous identity verification instead of location-based trust, least privilege including for privileged accounts, and consistent policy enforcement regardless of whether access comes from headquarters, a home office or a mobile device. This is exactly where isolated implementations fail: maintaining a separate rule set per access path produces inconsistencies that become a problem during an incident.

The transition from classical VPN structures to Zero Trust is therefore less a product decision than a matter of operational discipline. What helps is an architecture that knows only one rule set.

5. Consolidation: SASE and SSE instead of point solutions

The driver of stack consolidation is not security but operational effort. Separate systems for secure web gateway, CASB, ZTNA and DLP mean separate rule sets, separate logs and, during an incident, separate support chains. Gartner expects around half of all new SASE deployments to be single-vendor by 2028, compared with roughly 30 percent in 2025.

Technically, inspection thus moves from appliances into a distributed cloud fabric with single-pass inspection at global points of presence. This avoids the latency penalty that arises when traffic has to pass through several separate inspection stages. The path there runs in stages in practice, usually starting with remote access.

The point that regularly gets lost in platform comparisons: SASE only works as well as the underlay. A platform with a first-class policy engine is of little use if site connectivity is the bottleneck. Platform choice and underlay procurement should therefore be evaluated separately and decided together.

6. Resilience instead of pure prevention

The BSI observes that attackers take the path of least resistance and pick the targets with the lowest level of protection. This disproportionately affects small and mid-sized companies. At the same time the BSI warns of a false sense of security: many companies rate themselves well above their actual maturity.

This shifts the metric. No longer only how many attacks were repelled, but how long operations stand still after a successful one. This is also where NIS2 and the new rules of resilience converge: contingency planning is no longer optional but part of the required risk management measures.

In concrete terms: redundant connectivity per site, a tested recovery plan and the ability to stay operational while the actual systems are restored. For the last point, emergency workstations provide an answer that can be arranged contractually in advance instead of being improvised in an emergency.