Threat landscape

What is the current situation in German offices?

Period for the whole page

This year: from 01.01.2026 until today. Applies to the situation map, the trend and the lists; the world map has fixed periods, noted below each map.

Situation map

Where the current vulnerabilities sit in a business

This year the US agency CISA added 199 vulnerabilities to its catalogue of known exploited vulnerabilities that can be assigned to a place in the building. The catalogue gives no severity: every one of these vulnerabilities is already being used in attacks.

Office infrastructure seen from above, with the number of current warnings per area Firewall, VPN and router: 67, Server room: 42, Office workstations: 37, Website, hosting and cloud: 22, Software development: 12, Central AI services: 10, Mobile working and remote access: 9 Your business Internet Workstations 37 Server room 42 Development 12 Central AI 10 Firewall · VPN 67 Hosting & cloud 22 Mobile & remote access 9

Click a circle or area to see the individual advisories. Image: AI-generated.

The larger the circle, the more warnings red border: at least one critical or known exploited

Situation map

Central AI services

×

10 warnings 10 exploited

AI services often run with broad access to documents, mailboxes and keys – whoever takes them over sees everything the AI sees.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Firewall, VPN and router

×

67 warnings 67 exploited

These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Mobile working and remote access

×

9 warnings 9 exploited

The way in is usually a message, a link or an open remote access – on the road, without the protection of the office network.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Website, hosting and cloud

×

22 warnings 22 exploited

The application is reachable from the internet and is scanned automatically around the clock.

I count here the software a website or online shop is made of (such as WordPress, TYPO3, web servers, PHP) and cloud platforms on which you run something yourself. A web server on the internet can therefore have vulnerabilities from two areas: the website software is listed here, while the Linux, database and backup underneath are listed under “Server room”.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Server room

×

42 warnings 42 exploited

If a server sits only inside the building, it is usually the second step: anyone already inside the network, for example after a phishing email, moves on from here to data and backups. Mail and file servers such as Exchange, SharePoint Server or Nextcloud, however, are often connected directly to the internet and are then just as exposed as a website.

I count here software that your business runs on its own servers and has to update itself: operating systems, databases, virtualisation, backup and your own mail and file servers. Whether the server sits in the basement or is rented from a hosting provider makes no difference.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Software development

×

12 warnings 12 exploited

Whoever gets in here can smuggle malicious code into your own software and ship it to customers that way.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Office workstations

×

37 warnings 37 exploited

The way in is almost always a person: a link, an attachment or a web page opened at the workstation.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.

How I assign them: each warning goes into exactly one area, depending on which software is affected. Rented cloud services such as Microsoft 365, SharePoint Online or Google Workspace do not appear here. Their providers have to close the same vulnerabilities, but they install the fixes themselves, so it does not fall back on your business. The map only shows what you or your IT service provider have to update yourselves. A web server on the internet can appear in two areas: with its website software under “Website, hosting and cloud”, with Linux, database and backup under “Server room”.

Source: BSI, Warning and Information Service (CERT-Bund). General libraries found in almost every piece of software (such as OpenSSL or glibc) are not assigned to any area. The classification is mine, not the BSI’s. This week’s situation in detail ↓

Period: this year, from 01.01.2026 until today, as selected above.

Trend

Advisories per week and area

Each bar shows how many warnings the BSI first published in that calendar week, stacked by severity. Later updates count in the week of the first release. Hover over a bar to see the numbers.

1 5 9 13 17 21 25 29 33 37 41 44 total
Server room 792
Firewall, VPN and router 318
Website, hosting and cloud 251
Office workstations 251
Software development 247
Central AI services 183
Mobile working and remote access 120
All areas 2162

criticalhighmediumlow

Period: this year, from 01.01.2026 until today, as selected above. One bar per calendar week.

World map

State-backed attackers named by CISA

The US cybersecurity agency CISA attributes some of its advisories to state-backed attackers from a particular country. The map shows how often it did so over the last three years. This is a snapshot from the US point of view, not a statistic of attacks on Germany: most advisories name no country at all, including every advisory on ransomware groups (box below the map).

World map of state-backed attackers according to CISA Russia: 8 CISA advisories, 3 at the BSI in the period; China: 6 CISA advisories, 3 at the BSI in the period; Iran: 4 CISA advisories, 0 at the BSI in the period; North Korea: 1 CISA advisories, 12 at the BSI in the period Fidschi Tansania, Vereinigte Republik Westsahara Kanada Vereinigte Staaten von Amerika Kasachstan Usbekistan Papua-Neuguinea Indonesien Argentinien Chile Kongo Somalia Kenia Sudan Tschad Haiti Dominikanische Republik Russische Föderation Bahamas Falklandinseln Norwegen Grönland Osttimor Südafrika Lesotho Mexiko Uruguay Brasilien Bolivien Peru Kolumbien Panama Costa Rica Nicaragua Honduras El Salvador Guatemala Belize Venezuela Guyana Suriname Frankreich Ecuador Puerto Rico Jamaika Kuba Simbabwe Botswana Namibia Senegal Mali Mauretanien Benin Niger Nigeria Kamerun Togo Ghana Elfenbeinküste Guinea Guinea-Bissau Liberia Sierra Leone Burkina Faso Zentralafrikanische Republik Republik Kongo Gabun Äquatorialguinea Sambia Malawi Mosambik Eswatini Angola Burundi Israel Libanon Madagaskar Staat Palästina Gambia Tunesien Algerien Jordanien Vereinigte Arabische Emirate Katar Kuwait Irak Oman Vanuatu Kambodscha Thailand Laos Myanmar Vietnam Nordkorea Südkorea Mongolei Indien Bangladesch Bhutan Nepal Pakistan Afghanistan Tadschikistan Kirgisistan Turkmenistan Iran Syrien, Arabische Republik Armenien Schweden Belarus Ukraine Polen Österreich Ungarn Moldawien Rumänien Litauen Lettland Estland Deutschland Bulgarien Griechenland Türkei Albanien Kroatien Schweiz Luxemburg Belgien Niederlande Portugal Spanien Irland Neukaledonien Salomonen Neuseeland Australien Sri Lanka China Taiwan Italien Dänemark Vereinigtes Königreich Island Aserbaidschan Georgien Philippinen Malaysia Brunei Darussalam Slowenien Finnland Slowakei Tschechische Republik Eritrea Japan Paraguay Jemen Saudi-Arabien Zypern Marokko Ägypten Libyen Äthiopien Dschibuti Uganda Ruanda Bosnien und Herzegowina Nordmazedonien Serbien Montenegro Trinidad und Tobago Südsudan 3 BSI advisories in the period concern vulnerabilities that, according to CISA, are also exploited by actors from Russia. This does not prove an attack on Germany. 3 BSI advisories in the period concern vulnerabilities that, according to CISA, are also exploited by actors from China. This does not prove an attack on Germany. 12 BSI advisories in the period concern vulnerabilities that, according to CISA, are also exploited by actors from North Korea. This does not prove an attack on Germany. Russia: 8 CISA advisories in the last three years 8 Russia China: 6 CISA advisories in the last three years 6 China Iran: 4 CISA advisories in the last three years 4 Iran North Korea: 1 CISA advisory in the last three years 1 North Korea

Number in the circle: CISA advisories from the last three years that name actors from the country Arrow: a vulnerability from these advisories also appears in a BSI advisory in the period, so it affects software that is common here too

No country attribution: criminal groups and ransomware

29 of the 48 CISA advisories from the last three years name no country, 13 of them concern ransomware groups. Such groups work for money, often across borders, and can rarely be tied to a state. For businesses in Germany they are the more common danger: according to the BSI, ransomware is the biggest threat to companies.

In the period, 17 BSI advisories contain one of these vulnerabilities:

The CISA advisories

Source: CISA cybersecurity advisories (origin according to the advisory title); BSI warning and information service. Map data: Natural Earth. Attribution to a country is a statement by CISA, not evidence of an attack on Germany.

Period: The circles do not follow the selection above: they count CISA advisories from the last three years, because CISA names state-backed attackers only a few times a year. The BSI warnings that appear when you click a country, however, follow the period above.

The situation this year

This year the BSI has warned 804 times about software that runs in businesses every day.

The official reporting situation, tailored to your office workstations. I fetch it twice a day from the German Federal Office for Information Security and show here only what runs on ordinary office computers and in almost every business. Every line leads to the original BSI advisory. The situation map above counts every area in the building, which is why its number is larger.

57

critical

442

high

273

medium

657

newly added

Newly added means: the BSI published these warnings for the first time in this period. All others are updates to older warnings, for example because the vendor delivered a fix later or further versions are affected. The three severity levels count new and updated warnings together.

What’s affected is what runs at your business

Source: BSI, Warning and Information Service (CERT-Bund). As of 30.10.2026, 08:43.

Period: this year, from 01.01.2026 until today, as selected above.

The warnings come from German-language sources and are shown in the original.

And this is already being attacked

A vulnerability is one thing. These ones are demonstrably being exploited — the US cybersecurity agency keeps a public catalogue of them, and its own federal agencies have to act within a deadline.

  • exploited Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

  • exploited Broadcom VMware ESX

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. If a server sits only inside the building, it is usually the second step: anyone already inside the network, for example after a phishing email, moves on from here to data and backups. Mail and file servers such as Exchange, SharePoint Server or Nextcloud, however, are often connected directly to the internet and are then just as exposed as a website.

  • exploited Adobe Commerce and Magento

    How it is exploited: Unchecked upload: attackers upload a file containing malicious code and then call it. The application is reachable from the internet and is scanned automatically around the clock.

  • exploited Google Brotli

    How it is exploited: Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

  • exploited Fortinet Multiple Products

    How it is exploited: Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials. These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

  • exploited Atlassian Multiple Products

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. Whoever gets in here can smuggle malicious code into your own software and ship it to customers that way.

Source: CISA, Known Exploited Vulnerabilities Catalog. The links lead to the description of the vulnerability in the US National Vulnerability Database; the explanation above is my classification of the type of flaw named there.

Period: this year, from 01.01.2026 until today, as selected above. Shown are the six newest entries from this period.

This list doesn’t answer one question: whether your accountant will approve the fake invoice tomorrow. Updates close gaps in software. The gap my training addresses sits between a credible request and a click — and no patch closes it.

By attacks

And what of it actually arrives?

Advisories say where the flaws are. On my own server I see how often someone tries to exploit them: attack attempts per day and hour, what was attempted, where the machines come from and what has to do with the PHP flaw PHP2Shell.

To the view by attacks →

The attacker no longer needs to know you. AI does that part.

For years, poor language was the most reliable sign of a scam email. That sign is gone. What else has shifted, and why your firewall can’t answer the decisive question.

Before

Attacks took time

Anyone targeting a company had to do research, write texts and rebuild websites. That only paid off for big targets; small businesses slipped through the net.

Today

Attacks cost next to nothing

Research, writing and copying are automated. The same effort that used to be needed for one target now covers a thousand — and so it also hits the craft business with twelve employees.

The consequence

“Too small and unknown” no longer protects you

Assuming you’re of no interest to attackers was always risky. Now it’s simply wrong, because there’s no longer any target selection that protects you.

What has actually changed

Four shifts, all pointing the same way: attacks are becoming more credible, more personal and more frequent.

01

Language no longer gives anything away

Spelling mistakes, clumsy grammar, odd greetings: those were the signs we were all trained to spot. Today a language model writes flawless text in the tone of your industry, including the correct technical terms and the right level of formality.

02

The attack knows your context

Legal notice, LinkedIn, company register, press releases, job ads: publicly available information is enough to know who approves invoices at your company, who’s new and which project is currently running. Nobody does this research by hand any more.

03

Voice and face are no longer proof

A few seconds of audio are enough for a convincing voice clone, and any video on the company website provides the material. The best-known case: an employee of a large corporation transferred around 25 million US dollars after a video conference in which every participant except him was fake.

04

Attacks run in steps, not as a single email

First a harmless contact, then a reference back to your reply, then the actual request. Such multi-step sequences used to need a person who kept at it. Today they run on automatically, even over weeks.

The blind spot

Technology can’t decide whether a request is legitimate.

Spam filters recognise patterns: known senders, suspicious attachments, reported domains. A flawlessly written email from a newly registered, inconspicuous domain that refers to a real process at your company and asks for a plausible action contains not a single technical feature a filter could stop it on.

No product answers the question “Is it right for me to approve this payment now?”. A person answers it, under time pressure and between forty other emails.

That’s why awareness isn’t an add-on to technology, but the layer that starts exactly where technology structurally stops.

What technology reliably does

  • Intercept known malware
  • Block reported senders and domains
  • Isolate suspicious attachments
  • Log access and keep backups

What it cannot do

  • Judge whether a request is plausible in context
  • Recognise that the familiar voice on the phone is synthetic
  • Stop someone from entering their password voluntarily
  • Replace a quick call-back when in doubt
Experience it yourself

How many vulnerabilities can you spot in an office?

Before talking about training, it helps to feel the problem once rather than have it explained. In “Operation ORION” you walk through an ordinary office and look for the places an attacker would use: the sticky note on the monitor, the open mailbox, the USB stick from the trade fair stand. In five minutes it becomes tangible what can’t be fixed technically and why it’s worth training for exactly that. That’s where awareness training comes in.

Free · approx. 5 minutes · no account needed

Operation ORION, the office game

Take on the role of an investigator and uncover the security gaps at a workstation. A playful start with no prior knowledge needed — also ideal for passing on to colleagues.

Start the game →
Identity

The real target is rarely the computer

Anyone with login details doesn’t need malware. A hijacked mailbox reads along, knows your processes, replies in ongoing threads and requests further access in your name. To colleagues and customers it looks like you, because technically it is you.

That’s why protecting your own identity is at the heart of my training: passwords, two-factor authentication, handling confirmation requests, and what to do if it happens anyway.

Resilience

Resilience is measurable, or it’s just a claim.

“Our people are aware” is an assumption. A number showing how many actually click in a realistic situation is a foundation.

For the German economy, becoming resilient here is now a strategic need: with Cybernation Deutschland, the BSI is pursuing exactly this goal — resilience as the normal state rather than a project after an incident. For an individual business that means: know where you stand, improve, measure again.

Measure your own vulnerability

Free, three simulated attacks, anonymised results.

Obligations

And yes, it’s also mandatory.

Two laws, one consequence: train and prove it. Many businesses only associate training obligations with NIS2 and consider themselves unaffected. But the GDPR applies to everyone who processes personal data.

NIS2

Certain sectors above a certain size

The directive obliges management bodies of affected entities to take part in training and to regularly offer training to all employees. Management is explicitly addressed.

Generally affects companies with 50 or more employees or €10 million in turnover in energy, transport, health, water, digital infrastructure, IT services, postal services, waste, chemicals, food and mechanical engineering.

GDPR

Practically every business

Article 32 requires “appropriate technical and organisational measures”. Training and raising staff awareness are organisational measures; Article 39 names them explicitly.

Anyone who processes customer data, job applications or personnel files is affected. That’s every business.

What must be provable

  • That training took place
  • Who took part
  • When it happened
  • That it is repeated

What isn’t documented is, if in doubt, considered not to have happened. With me, all four proofs are created automatically as a by-product of the training.

Loading …

Set up in an hour, trained in a week.

Create a free account, add your team, unlock the course. You only pay when you start. Would you rather see what a test email looks like first? The self-test is free.

Add your team Test it yourself first