For German companies, cyberattacks are no longer a fringe risk in 2026 – they are part of daily business. 96% of all companies were recently affected by data theft, industrial espionage or sabotage, or suspect they were (Bitkom). The damage amounts to 211 to 270.8 billion euros per year, and 76% of that now comes from cyberattacks (Bitkom). What has changed is not so much the number of attacks as their quality: 82% of companies assume that attackers are making greater use of artificial intelligence (Bitkom). This guide shows how to recognize AI-supported attacks, which measures close the most frequently cited causes of damage, and how to align your online shop and your hosting accordingly.
The Current Threat Landscape in Numbers
The figures from the Bitkom economic protection study are based on a representative survey of 1,003 companies with 10 or more employees in Germany (Bitkom). 96% of them were affected by data theft, industrial espionage or sabotage, or suspect they were. 63% recorded an increase in cyberattacks over the past twelve months, 69% expect a further increase over the coming twelve months – not a single company surveyed expects a decline (Bitkom).
Damage from data theft, industrial espionage and sabotage amounts to 211 to 270.8 billion euros per year (Bitkom). 76% of that is attributable to cyberattacks, which comes to 160.4 to 205.8 billion euros (Bitkom). At the same time, the attack surface keeps growing: worldwide, an average of 119 new vulnerabilities in IT systems became known every day, around 24% more than in the preceding reporting period (BSI).
Around 80% of reported attacks targeted small and medium-sized enterprises (BSI). Among small and medium-sized businesses, 26% of known entry paths run through an exploited vulnerability (Verizon). And 58% of all companies surveyed actually suffered damage from cyberattacks over the past twelve months (Bitkom).
How Attackers Weaponize AI
82% of companies assume that attackers are making greater use of artificial intelligence. Only 31% are certain of it, while 51% merely suspect it (Bitkom). The suspicion rests mainly on two observations: the automated adaptation of attack attempts (53%) and the high quality of faked audio and video recordings (48%, Bitkom).
AI-Generated Phishing
The era of clumsy fraud mails is over. 38% of companies recognize the use of AI by the high quality of text messages and mails, 28% by highly personalized content (Bitkom). Two independent studies show that the mailbox remains the way in: around 60% of incidents with a determinable intrusion vector went back to phishing including vishing, malspam and malvertising (ENISA), and in government networks an average of 73% of all spam mails were cyberattacks, with phishing accounting for 93% of the fraudulent mails (BSI).
Deepfakes and Voice Cloning
Faked voices and videos have moved from proof of concept into the damage statistics. Damage caused by automated robo calls jumped from 3 to 14%, damage from deepfakes from 4 to 8% (Bitkom). The level is low, the direction unambiguous – and it matches the fact that 48% of companies identify the use of AI by the high quality of faked audio and video recordings (Bitkom). For approval processes this means one thing: a familiar voice on the phone is not proof of authorization.
Automated Attack Chains
Attack chains increasingly run without manual work. At 53%, the automated adaptation of attack attempts is the most frequently cited characteristic by which companies identify the use of AI (Bitkom). How large the baseline load is becomes clear from the networks themselves: during the reporting period the BSI reported around 40,000 infected systems per day to German network operators (BSI). An attack that adapts to the defense while it is running therefore meets an infrastructure in which permanently compromised machines are already present.
| Characteristic | Traditional attack | AI-supported attack |
|---|---|---|
| Text quality in fraud mails | Often flawed, recognizable patterns | Linguistically clean and context-aware |
| Personalization | Mass mailing with placeholders | Tailored to person, role and occasion |
| Creating malware | Manual work, expertise required | Tool-supported, lower barrier to entry |
| Adapting to the defense | Retrospectively by the attacker | Automated while the attempt is running |
| Faked audio and video content | Laborious, rarely convincing | Quickly produced, hard to verify |
| Attack frequency | Limited by manual work | Scales with the available computing power |
| Recognisability for employees | Often visible in surface features | Barely visible in surface features |
Germany in Focus: Bitkom and BSI Data
The attacker side is shifting. 37% of affected companies were able to attribute at least one attack to a foreign intelligence service (Bitkom). Among the types of damage, ransomware remains at the top: at 25% of all companies, attackers encrypted data and offered to release it only against a ransom – down from 34% the previous year (Bitkom). Next come attacks on passwords at 18% and phishing at 16% (Bitkom).
The funding gap persists: the share of IT security in the overall IT budget is stagnating at 18%, while the BSI and Bitkom recommend 20% (Bitkom). At the same time, an average of 119 new vulnerabilities became known worldwide every day, around 24% more than in the reporting period before (BSI). Anyone who does not raise the security share is spreading an equally large budget across a growing attack surface.
Practical Protection Measures for Businesses
Typical causes of damage are not exotic attacks but blind spots in your own operations. Companies that suffered damage name insufficient detection of security incidents first (59%), followed by misconfigured IT systems (57%) and insufficient identity and access management (55%, Bitkom). The measures below address exactly these three points.
Multi-factor authentication
According to the vendor, multi-factor authentication blocks over 99.9% of account attacks (Microsoft). Start with administrators, payment approvals and remote access.
Attack detection
59% of companies that suffered damage name insufficient detection of security incidents as the main reason (Bitkom). Central logging with clear responsibility for alerts closes this gap.
Identity and access management
Insufficient identity and access management is among the causes of damage at 55% of the affected companies (Bitkom). Separate roles, withdraw permissions, inventory service accounts.
Clean configuration
57% of companies that suffered damage cite misconfigured IT systems (Bitkom). Default passwords, open administration interfaces and unused services belong in a recurring review.
Patch and change management
In module OPS.1.1.3 the BSI requires patches to be assessed, prioritized and installed promptly after release (BSI). It does not name a fixed number of hours – what matters is a documented process.
E-mail authentication
For DMARC the BSI recognizes only quarantine or reject as a protective recipient policy (BSI). With SPF, DKIM and an enforced policy your domain becomes harder to abuse for fraudulent mail.
Zero Trust and AI Defense in Detail
Zero Trust means that no access is considered trustworthy simply because it comes from your own network. That targets exactly the gap 55% of affected companies name as a cause of damage – insufficient identity and access management (Bitkom). The technical basis is multi-factor authentication, which according to the vendor blocks over 99.9% of account attacks (Microsoft). It has not yet arrived across the board: according to the Cybersicherheitsmonitor, 40% of respondents use two-factor authentication (BSI and Polizeiliche Kriminalpraevention).
Detection comes before defense. The most important technical source of insight remains the analysis of log files (68%, Bitkom). What that is worth is shown by an analysis of data breaches: when the organization's own team discovered the incident, its lifecycle was 61 days shorter and cost almost 1 million USD less than in cases first disclosed by the attacker (IBM).
Start with multi-factor authentication for administrators, payment approvals and remote access. Then set up central logging with clear responsibility for alerts. As a third step, put SPF, DKIM and an enforced DMARC policy in place for your domains. All three address the causes that damaged companies name most often – and none of them requires a multi-year project.
Getting Employee Training Right
Training works, but it is not the lever it is often taken to be: only 18% of companies attribute successful cyberattacks to insufficient security awareness among employees (Bitkom). Even so, people remain the entry point – around 60% of incidents with a determinable intrusion vector went back to phishing including vishing and malvertising (ENISA).
Training is effective where it starts from the observed attack characteristics: the high quality of text messages and mails (38%), highly personalized content (28%) and convincingly faked audio and video recordings (48%, Bitkom). Instead of general warnings, what is needed are fixed callback routes for payment approvals and exercises with real context. We set up processes like these as part of our e-commerce consulting.
Incident Response and Emergency Planning
Preparation and self-assessment diverge: only 43% of companies consider themselves very well prepared for cyberattacks, while at the same time the share of those who see their commercial existence threatened by a successful cyberattack falls to 45% (Bitkom). That the real case hits operations is well documented: 70% of organizations with a data breach reported a significant disruption of business (IBM).
An emergency plan has to serve two clocks at once. The first is the notification duty: a personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33 GDPR). The second is discovery: when the organization's own team found the incident, its lifecycle was 61 days shorter (IBM). The global average cost of a data breach is 4.99 million USD, 12% more than in the previous year (IBM). Which personal data is affected can only be clarified with a maintained record – see our privacy information.
Backup Strategies Against Ransomware
Ransomware remains a type of damage with wide reach: at 25% of all companies, attackers encrypted data and offered to release it only against a ransom (Bitkom). The decline from 34% the previous year shows that prevention works – it is not a reason to scale back your backup strategy.
The second extortion stage makes backups alone insufficient: of the recorded intrusion incidents, 68.6% led to data being exfiltrated and offered for sale on underground forums (ENISA). Anyone who can only restore has survived the incident technically and still has it ahead of them legally.
In the event of a personal data breach the clock starts on becoming aware of it: without undue delay and, where feasible, within 72 hours to the supervisory authority (Art. 33 GDPR). Anyone who clarifies responsibilities only in the real case loses exactly the time needed for containment and evidence preservation. Keep reporting routes, contacts and templates ready and connect them with your privacy information and your e-commerce operations.
AI vs. AI: The Future of Cyber Defense
The direction is set: 69% of companies expect more cyberattacks over the coming twelve months, and not a single one expects a decline (Bitkom). The answer is not a single technology but a robust detection chain – the most important technical source of insight remains the analysis of log files (68%, Bitkom). How logs, access and backups interlock in day-to-day operations is described in our articles on Zero Trust for online shops and backup and disaster recovery.
- Behavior-based analysis: build normal profiles for users, systems and interfaces and report deviations automatically instead of waiting only for known signatures
- Pre-sorted alerts: enrich and bundle security messages automatically so that scarce analysis time goes to the cases that hold up
- Prepared response: define containment steps in advance and implement them technically – approval for critical interventions stays with a human
- Maintained data basis: keep logs complete, time-synchronized and available long enough, otherwise even the best model has nothing to assess
Online shops face an additional risk focus: in retail, 42% of known entry paths run through an exploited vulnerability (Verizon). That hits exactly the layer we look after – shop system, extensions and connected systems. How updates can be kept plannable is shown by our services around the Shopware agency, hosting and integrations.
This is what your secure online presence could look like:
Mechanical Engineering Company
Law Firm
Workflow Platform
Frequently Asked Questions
Highly likely. 96% of all companies in Germany were recently affected by data theft, industrial espionage or sabotage, or suspect they were, and 63% recorded an increase in cyberattacks over the past twelve months (Bitkom). 82% assume that attackers are making greater use of artificial intelligence (Bitkom). For planning purposes this means the question is not whether an attempt comes, but whether it is detected.
Multi-factor authentication. According to the vendor it blocks over 99.9% of account attacks (Microsoft) and at the same time addresses the weakness that 55% of affected companies name as a cause of damage – insufficient identity and access management (Bitkom). Start with administrators, payment approvals and remote access, then cover all remaining accounts.
There is no reliable figure for the individual case, because downtime, sector and data volume vary widely. For orientation: the global average cost of a data breach is 4.99 million USD and thus 12% above the previous year (IBM). In Germany, damage from cyberattacks adds up to 160.4 to 205.8 billion euros per year (Bitkom).
They are harder to recognize. 38% of companies identify the use of AI by the high quality of text messages and mails, 28% by highly personalized content (Bitkom). That removes exactly the features training used to rely on. The mailbox remains the dominant route: around 60% of incidents with a determinable intrusion vector went back to phishing (ENISA).
Zero Trust checks every access individually, regardless of whether it comes from inside or outside the network. That addresses the two most frequently named causes of damage: insufficient detection of security incidents (59%) and insufficient identity and access management (55%, Bitkom). Talk to us if you are planning the first step.
They remain necessary but are not sufficient on their own. At 25% of all companies attackers encrypted data and offered to release it only against a ransom, down from 34% the previous year (Bitkom). In parallel, 68.6% of recorded intrusion incidents led to data being exfiltrated and offered on underground forums (ENISA). No restore helps against publication – only preventing the exfiltration does.
This article draws on the Bitkom economic protection study 2026, the BSI report on the state of IT security in Germany 2025, the Cybersicherheitsmonitor 2026 by the BSI and Polizeiliche Kriminalpraevention, the ENISA Threat Landscape 2025, the Verizon Data Breach Investigations Report 2026 and the IBM Cost of a Data Breach Report 2026. Every figure quoted is backed by source, survey date and reference. Survey periods and populations differ, so a direct comparison of individual values is only possible to a limited extent.