In Germany, cybercrime is no longer a side issue. It now weighs on the whole economy. This piece sums up the state of things in 2023. It shows key market figures and turns them into clear steps that companies can take.
Threat Landscape: Numbers, Not Gut Feel
According to Bitkom, cybercrime cost Germany more than 200 billion euros again in 2023. That is the third year in a row at this level. Ransomware was still the main driver. Most campaigns used double extortion: the data is encrypted, and the attackers also threaten to publish it. Targeted attacks on companies with deep pockets, known as "Big Game Hunting", made things worse.
Cyber threats are growing for structural reasons, not as a passing cycle. Companies that did not invest heavily in resilience in 2023 have much more to catch up on in 2024.
Policy, Institutions and Key Events
The BSI held its 19th German IT Security Congress in 2023. The motto was "Digital Security for a Sustainable Future". At the same time, the German government prepared to turn the NIS 2 Directive into national law. The lack of skilled security staff stayed a major topic.
How the Market Developed
- Market size 2023: approx. €5.81 billion.
- Security services: approx. €3.19 billion, the largest segment.
- Forecast 2028: approx. €7.13 billion, with double-digit yearly growth in services.
What drives this growth:
- more managed security offerings,
- new rules that must be put in place (NIS 2, KRITIS, DORA),
- more demand for expert help with incident response.
Clear Steps for Companies
- Get the basics right: MFA everywhere, EDR on every endpoint, and patch and vulnerability management.
- Make backups hard to break: Offline and immutable backups, with restores tested on a regular basis.
- Prepare for incidents: Playbooks, retainers and practiced communication. See the incident response guide.
- Build awareness that lasts: Repeat training, phishing tests and a culture where people report issues.
- Plan for compliance: Use ISO 27001 and NIS 2 as the common thread through the whole program.
Steps for Individuals
- Use strong, unique passwords and keep them in a password manager.
- Keep software and apps up to date.
- Be wary of unexpected emails, calls or messages.
- Back up and encrypt important data on a regular basis.
- Stay informed about current threats, at work and at home.
Conclusion
The 2023 picture is clear. Cybercrime is a lasting risk, not a phase. New rules, a growing market and skilled attackers all meet a tight job market. Some companies tackle the basics, resilience and incident response together. They lower their risk in a real way. For them, an attack stays an unpleasant incident instead of turning into a company-wide crisis.