German Mid-Market Machinery: NIS-2 Extension, IEC 62443, and Industrial Espionage Risk

In 2026, German mid-sized machine builders are a target for two reasons. First, Industry 4.0 links machines to networks, and that opens new ways to attack. Second, these firms hold decades of know-how: engineering data, CAD models and tool shapes. For spies, that is a top prize. On top of this, the NIS-2 extension now reaches many firms that thought they were "not critical infrastructure".

Who Falls Under NIS-2 in 2026, Even If They Didn't Expect It

Annex I and II of the NIS-2 Directive cover, among others, the groups below. Germany puts the directive into law through the NIS-2 Implementation Act.

• Makers of essential digital devices: this includes industrial devices with IT parts.
• Makers of machines used in critical infrastructure sectors: for example pumps for water utilities or turbines for power plants.
• Key suppliers to critical infrastructure operators: thresholds are 50 employees or €10 M revenue.

In 2026, many mid-sized firms with 80–500 employees face a new question for the first time. Their supervisory board or a critical infrastructure customer asks: "Are we now in scope?" The answer is often yes.

The Second Stress Factor: Industrial Espionage in 2026

The German BfV report 2025 shows a 240 % rise in detected spying cases against mid-sized German firms compared with 2022. The main targets are machinery, optics, semiconductors and medical technology. Attackers often work like this:

• Buying a supplier: they buy a small supplier that has direct access to the engineering data of a larger customer.
• Spear phishing: a fake customer contact asks for a CAD file "for clarification".
• Recruiting insiders: engineering staff with foreign links, often during a job change.
• OT lateral movement: they get in through a connected machine on the shop floor and move on into the engineering network.

IEC 62443 as the Technical Framework for OT

IEC 62443 is the international standard for industrial automation and control systems. It is large (parts 1–4). For mid-sized firms, three areas matter most in practice:

1. Zones and conduits (62443-3-2): keep the production network strictly apart from the office network. Traffic only flows through defined, filtered conduits.
2. Security Level (SL) 2 as a realistic goal: it protects against deliberate attacks with simple means. SL 3 and 4 are for high-security sites.
3. Security lifecycle for components: machine vendors need patch processes, written update duties and EOL clauses in the contract.

Five Levers That Work in Machine Building

1. Keep a Separate OT Asset Inventory

List PLCs, HMIs, robots and sensors. Record the vendor, software version, EOL date and network zone for each. The asset module has its own OT class and a separate protection-need rating.

2. Enforce the Zone Model With Coraza/OPNsense

Split the office, engineering and production networks strictly. Define each conduit with allow lists. Wazuh watches traffic between zones for anomalies.

3. Mail Security That Checks CAD Attachments

CAD attachments (.step, .dwg, .iges) are a common tool for spear phishing. The CAPE sandbox can run CAD loaders safely, analyze macro code and pull out embedded scripts.

4. Look at Supplier Risk With Espionage in Mind

Who has access to engineering data? Which sub-processors are involved? Check ownership once a year. TPRM uses geography as one factor in the risk score.

5. Insider Threat Signals in the SIEM

Watch for unusual data exports, such as large CAD packages sent to cloud storage. Also watch for USB mass storage and access outside working hours. Wazuh correlation rules for this exist as Sigma templates.

What Machine Builders' CIOs Often Underestimate

• "Our machines aren't on the internet." Often they are: through the vendor's service VPN, the ERP link or a service technician's mobile devices.
• "CAD data isn't personal data." True. But the German trade secrets act (GeschGehG) sets its own duties to keep data confidential.
• "IEC 62443 is for the big players." True today. But insurers, critical infrastructure customers and auditors expect it more and more from mid-sized firms too.
• "Espionage doesn't hit us." It does, and the numbers show the risk is growing.

What to Expect for Setup

• Machine builder with 250 employees and 1 plant: 9 months for the ISMS base and OT segmentation, 12 months to be ready for NIS-2. The first investment is about €180 k.
• Several plants and international sites: 12 months and about €280 k. Here a central platform brings even more benefit.

Compliance Mapping

• NIS-2 Art. 20–23: duties of the management, minimum measures and an early warning within 24h.
• IEC 62443: OT security, zone model and the security lifecycle of components.
• ISO 27001 + ISO 27019: the energy extension for suppliers to the energy sector.
• GeschGehG (German trade secrets act): protects trade secrets, but only if you have documented measures to keep them confidential.
• Machinery Regulation 2023/1230: cyber security rules for machine makers, in force from 2027.

Conclusion

For German mid-sized machine builders, 2026 brings three changes. The NIS-2 extension hits more firms than most expect. Industrial espionage is real and growing. And IEC 62443 is turning from a topic for big industry into a minimum standard for insurers. Start now with an OT asset inventory, a segmented zone model, mail security that handles CAD files and supplier ratings. Then you can be ready for an audit in 12 months, and you lower the risk of espionage in a way you can see.