Threat landscape

What is the current situation in German offices?

Period for the whole page

This year: from 01.01.2026 until today. Applies to the situation map, the trend and the lists; the world map has fixed periods, noted below each map.

Situation map

Where the current vulnerabilities sit in a business

All 3203 warnings the BSI published or updated this year that can be assigned to a place in the building.

Office infrastructure seen from above, with the number of current warnings per area Server room: 1361, Website, hosting and cloud: 412, Software development: 391, Office workstations: 353, Firewall, VPN and router: 345, Central AI services: 192, Mobile working and remote access: 149 Your business Internet Workstations 353 Server room 1361 Development 391 Central AI 192 Firewall · VPN 345 Hosting & cloud 412 Mobile & remote access 149

Click a circle or area to see the individual advisories. Image: AI-generated.

The larger the circle, the more warnings red outline: at least one critical

Situation map

Central AI services

×

192 warnings 8 critical 103 high 76 medium 5 low of which 182 newly added

AI services often run with broad access to documents, mailboxes and keys – whoever takes them over sees everything the AI sees.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Firewall, VPN and router

×

345 warnings 34 critical 138 high 156 medium 17 low of which 317 newly added

These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

Known to be exploited (CISA, last 90 days)

  • exploited Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

    Crafted input makes the software do something it should not. The details are in the linked description.

  • exploited Fortinet Multiple Products

    Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials.

  • exploited Cisco Secure Email Gateway

    Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials.

  • exploited Ivanti Connect Secure

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited Citrix NetScaler

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

and 20 more

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Mobile working and remote access

×

149 warnings 6 critical 69 high 69 medium 5 low of which 120 newly added

The way in is usually a message, a link or an open remote access – on the road, without the protection of the office network.

Known to be exploited (CISA, last 90 days)

  • exploited Google Pixel

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited ConnectWise ScreenConnect

    Privilege escalation: anyone who already has a foot in the door, for example via a phishing email, makes themselves administrator.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Website, hosting and cloud

×

412 warnings 17 critical 186 high 198 medium 11 low of which 251 newly added

The application is reachable from the internet and is scanned automatically around the clock.

I count here the software a website or online shop is made of (such as WordPress, TYPO3, web servers, PHP) and cloud platforms on which you run something yourself. A web server on the internet can therefore have vulnerabilities from two areas: the website software is listed here, while the Linux, database and backup underneath are listed under “Server room”.

Known to be exploited (CISA, last 90 days)

  • exploited Adobe Commerce and Magento

    Unchecked upload: attackers upload a file containing malicious code and then call it.

  • exploited WordPress Core

    Code injection: attackers send data that the server executes as program code – after that, the server is theirs.

  • exploited Adobe Commerce and Magento

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited Adobe Commerce and Magento

    Code injection: attackers send data that the server executes as program code – after that, the server is theirs.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Server room

×

1361 warnings 16 critical 518 high 762 medium 65 low of which 790 newly added

If a server sits only inside the building, it is usually the second step: anyone already inside the network, for example after a phishing email, moves on from here to data and backups. Mail and file servers such as Exchange, SharePoint Server or Nextcloud, however, are often connected directly to the internet and are then just as exposed as a website.

I count here software that your business runs on its own servers and has to update itself: operating systems, databases, virtualisation, backup and your own mail and file servers. Whether the server sits in the basement or is rented from a hosting provider makes no difference.

Known to be exploited (CISA, last 90 days)

  • exploited Broadcom VMware ESX

    Crafted input makes the software do something it should not. The details are in the linked description.

  • exploited Microsoft SharePoint

    Code injection: attackers send data that the server executes as program code – after that, the server is theirs.

  • exploited Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited Broadcom VMware vCenter ransomware known

    Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials.

  • exploited Microsoft SharePoint

    Crafted input makes the software do something it should not. The details are in the linked description.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Software development

×

391 warnings 11 critical 136 high 210 medium 34 low of which 247 newly added

Whoever gets in here can smuggle malicious code into your own software and ship it to customers that way.

Known to be exploited (CISA, last 90 days)

  • exploited Atlassian Multiple Products

    Crafted input makes the software do something it should not. The details are in the linked description.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Office workstations

×

353 warnings 13 critical 223 high 108 medium 9 low of which 251 newly added

The way in is almost always a person: a link, an attachment or a web page opened at the workstation.

Known to be exploited (CISA, last 90 days)

  • exploited Microsoft Windows

    Command injection: through a crafted request, attackers smuggle in system commands that the device then executes itself.

  • exploited Apple Multiple Products

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

  • exploited Google Chromium V8

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

  • exploited Microsoft Windows

    Link trick: with a crafted link, an attacker gets the system to modify protected files.

  • exploited Microsoft Windows

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

and 3 more

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.

How I assign them: each warning goes into exactly one area, depending on which software is affected. Rented cloud services such as Microsoft 365, SharePoint Online or Google Workspace do not appear here. Their providers have to close the same vulnerabilities, but they install the fixes themselves, so it does not fall back on your business. The map only shows what you or your IT service provider have to update yourselves. A web server on the internet can appear in two areas: with its website software under “Website, hosting and cloud”, with Linux, database and backup under “Server room”.

Source: BSI, Warning and Information Service (CERT-Bund). General libraries found in almost every piece of software (such as OpenSSL or glibc) are not assigned to any area. The classification is mine, not the BSI’s. This week’s situation in detail ↓

Period: this year, from 01.01.2026 until today, as selected above.

Trend

Advisories per week and area

Each bar shows how many warnings the BSI first published in that calendar week, stacked by severity. Later updates count in the week of the first release. Hover over a bar to see the numbers.

1 5 9 13 17 21 25 29 33 37 41 44 total
Server room 792
Firewall, VPN and router 318
Website, hosting and cloud 251
Office workstations 251
Software development 247
Central AI services 183
Mobile working and remote access 120
All areas 2162

criticalhighmediumlow

Period: this year, from 01.01.2026 until today, as selected above. One bar per calendar week.

World map

Where attacks on businesses in Germany come from, according to the businesses

Every year Bitkom Research asks companies in Germany whether they were affected by data theft, espionage or sabotage and where the perpetrators came from. Many businesses name several origins. I therefore convert all answers to 100 percent: the figures show the share an origin has of all answers. It remains the businesses’ own assessment, not technical proof.

World map: origin of attacks according to the Bitkom study China: 22 %; Russia: 21 %; Eastern Europe (excluding EU and Russia): 14 %; USA: 11 %; EU countries (excluding Germany): 11 %; Germany: 5 %; Iran: 4 %; Origin unclear: 11 % Fidschi Tansania, Vereinigte Republik Westsahara Kanada Vereinigte Staaten von Amerika Kasachstan Usbekistan Papua-Neuguinea Indonesien Argentinien Chile Kongo Somalia Kenia Sudan Tschad Haiti Dominikanische Republik Russische Föderation Bahamas Falklandinseln Norwegen Grönland Osttimor Südafrika Lesotho Mexiko Uruguay Brasilien Bolivien Peru Kolumbien Panama Costa Rica Nicaragua Honduras El Salvador Guatemala Belize Venezuela Guyana Suriname Frankreich Ecuador Puerto Rico Jamaika Kuba Simbabwe Botswana Namibia Senegal Mali Mauretanien Benin Niger Nigeria Kamerun Togo Ghana Elfenbeinküste Guinea Guinea-Bissau Liberia Sierra Leone Burkina Faso Zentralafrikanische Republik Republik Kongo Gabun Äquatorialguinea Sambia Malawi Mosambik Eswatini Angola Burundi Israel Libanon Madagaskar Staat Palästina Gambia Tunesien Algerien Jordanien Vereinigte Arabische Emirate Katar Kuwait Irak Oman Vanuatu Kambodscha Thailand Laos Myanmar Vietnam Nordkorea Südkorea Mongolei Indien Bangladesch Bhutan Nepal Pakistan Afghanistan Tadschikistan Kirgisistan Turkmenistan Iran Syrien, Arabische Republik Armenien Schweden Belarus Ukraine Polen Österreich Ungarn Moldawien Rumänien Litauen Lettland Estland Deutschland Bulgarien Griechenland Türkei Albanien Kroatien Schweiz Luxemburg Belgien Niederlande Portugal Spanien Irland Neukaledonien Salomonen Neuseeland Australien Sri Lanka China Taiwan Italien Dänemark Vereinigtes Königreich Island Aserbaidschan Georgien Philippinen Malaysia Brunei Darussalam Slowenien Finnland Slowakei Tschechische Republik Eritrea Japan Paraguay Jemen Saudi-Arabien Zypern Marokko Ägypten Libyen Äthiopien Dschibuti Uganda Ruanda Bosnien und Herzegowina Nordmazedonien Serbien Montenegro Trinidad und Tobago Südsudan 22 % of all origin answers name China 21 % of all origin answers name Russia 14 % of all origin answers name Eastern Europe (excluding EU and Russia) 11 % of all origin answers name USA 11 % of all origin answers name EU countries (excluding Germany) 4 % of all origin answers name Iran 11 % of all answers: the businesses could not attribute the attack to any country. China: 22 % of all origin answers (in the study: 52 % of affected businesses) 22 % China Russia: 21 % of all origin answers (in the study: 49 % of affected businesses) 21 % Russia Eastern Europe (excluding EU and Russia): 14 % of all origin answers (in the study: 34 % of affected businesses) 14 % Eastern Europe USA: 11 % of all origin answers (in the study: 27 % of affected businesses) 11 % USA EU countries (excluding Germany): 11 % of all origin answers (in the study: 26 % of affected businesses) 11 % EU countries Germany: 5 % of all origin answers (in the study: 12 % of affected businesses) 5 % Germany Iran: 4 % of all origin answers (in the study: 9 % of affected businesses) 4 % Iran Origin unclear: 11 % of all origin answers (in the study: 27 % of affected businesses) 11 % Origin unclear

Number in the circle: share of all origin answers of affected businesses Arrow: origin named; grey from the Pacific: origin unclear

  • China 22 %
  • Russia 21 %
  • Eastern Europe (excluding EU and Russia) 14 %
  • USA 11 %
  • EU countries (excluding Germany) 11 %
  • Germany 5 %
  • Iran 4 %
  • Origin unclear 11 %

In the study the origin answers add up to 236 percent because businesses could name several. Here they are converted to 100 percent; the tooltip shows the study value for each origin. Due to rounding the total is 99 %.

Who is behind it

62 percent of affected businesses name organised crime as the perpetrator, 37 percent a foreign intelligence service. So an attack coming from a country does not mean a state is behind it.

Source: Bitkom Research, Wirtschaftsschutz study 2026, 1.003 companies with 10 or more employees surveyed, 671 of them affected. Question: “Were you able to determine from where or from which region these actions were carried out?” Map basis: Natural Earth. To the study (PDF)

Period: This map does not follow the selection above. It shows the Bitkom study 2026, a survey with one value for the whole year.

The situation this year

This year the BSI has warned 804 times about software that runs in businesses every day.

The official reporting situation, tailored to your office workstations. I fetch it twice a day from the German Federal Office for Information Security and show here only what runs on ordinary office computers and in almost every business. Every line leads to the original BSI advisory. The situation map above counts every area in the building, which is why its number is larger.

57

critical

442

high

273

medium

657

newly added

Newly added means: the BSI published these warnings for the first time in this period. All others are updates to older warnings, for example because the vendor delivered a fix later or further versions are affected. The three severity levels count new and updated warnings together.

What’s affected is what runs at your business

Source: BSI, Warning and Information Service (CERT-Bund). As of 30.10.2026, 08:43.

Period: this year, from 01.01.2026 until today, as selected above.

The warnings come from German-language sources and are shown in the original.

And this is already being attacked

A vulnerability is one thing. These ones are demonstrably being exploited — the US cybersecurity agency keeps a public catalogue of them, and its own federal agencies have to act within a deadline.

  • exploited Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

  • exploited Broadcom VMware ESX

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. If a server sits only inside the building, it is usually the second step: anyone already inside the network, for example after a phishing email, moves on from here to data and backups. Mail and file servers such as Exchange, SharePoint Server or Nextcloud, however, are often connected directly to the internet and are then just as exposed as a website.

  • exploited Adobe Commerce and Magento

    How it is exploited: Unchecked upload: attackers upload a file containing malicious code and then call it. The application is reachable from the internet and is scanned automatically around the clock.

  • exploited Google Brotli

    How it is exploited: Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

  • exploited Fortinet Multiple Products

    How it is exploited: Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials. These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

  • exploited Atlassian Multiple Products

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. Whoever gets in here can smuggle malicious code into your own software and ship it to customers that way.

Source: CISA, Known Exploited Vulnerabilities Catalog. The links lead to the description of the vulnerability in the US National Vulnerability Database; the explanation above is my classification of the type of flaw named there.

Period: this year, from 01.01.2026 until today, as selected above. Shown are the six newest entries from this period.

This list doesn’t answer one question: whether your accountant will approve the fake invoice tomorrow. Updates close gaps in software. The gap my training addresses sits between a credible request and a click — and no patch closes it.

By attacks

And what of it actually arrives?

Advisories say where the flaws are. On my own server I see how often someone tries to exploit them: attack attempts per day and hour, what was attempted, where the machines come from and what has to do with the PHP flaw PHP2Shell.

To the view by attacks →

The attacker no longer needs to know you. AI does that part.

For years, poor language was the most reliable sign of a scam email. That sign is gone. What else has shifted, and why your firewall can’t answer the decisive question.

Before

Attacks took time

Anyone targeting a company had to do research, write texts and rebuild websites. That only paid off for big targets; small businesses slipped through the net.

Today

Attacks cost next to nothing

Research, writing and copying are automated. The same effort that used to be needed for one target now covers a thousand — and so it also hits the craft business with twelve employees.

The consequence

“Too small and unknown” no longer protects you

Assuming you’re of no interest to attackers was always risky. Now it’s simply wrong, because there’s no longer any target selection that protects you.

What has actually changed

Four shifts, all pointing the same way: attacks are becoming more credible, more personal and more frequent.

01

Language no longer gives anything away

Spelling mistakes, clumsy grammar, odd greetings: those were the signs we were all trained to spot. Today a language model writes flawless text in the tone of your industry, including the correct technical terms and the right level of formality.

02

The attack knows your context

Legal notice, LinkedIn, company register, press releases, job ads: publicly available information is enough to know who approves invoices at your company, who’s new and which project is currently running. Nobody does this research by hand any more.

03

Voice and face are no longer proof

A few seconds of audio are enough for a convincing voice clone, and any video on the company website provides the material. The best-known case: an employee of a large corporation transferred around 25 million US dollars after a video conference in which every participant except him was fake.

04

Attacks run in steps, not as a single email

First a harmless contact, then a reference back to your reply, then the actual request. Such multi-step sequences used to need a person who kept at it. Today they run on automatically, even over weeks.

The blind spot

Technology can’t decide whether a request is legitimate.

Spam filters recognise patterns: known senders, suspicious attachments, reported domains. A flawlessly written email from a newly registered, inconspicuous domain that refers to a real process at your company and asks for a plausible action contains not a single technical feature a filter could stop it on.

No product answers the question “Is it right for me to approve this payment now?”. A person answers it, under time pressure and between forty other emails.

That’s why awareness isn’t an add-on to technology, but the layer that starts exactly where technology structurally stops.

What technology reliably does

  • Intercept known malware
  • Block reported senders and domains
  • Isolate suspicious attachments
  • Log access and keep backups

What it cannot do

  • Judge whether a request is plausible in context
  • Recognise that the familiar voice on the phone is synthetic
  • Stop someone from entering their password voluntarily
  • Replace a quick call-back when in doubt
Experience it yourself

How many vulnerabilities can you spot in an office?

Before talking about training, it helps to feel the problem once rather than have it explained. In “Operation ORION” you walk through an ordinary office and look for the places an attacker would use: the sticky note on the monitor, the open mailbox, the USB stick from the trade fair stand. In five minutes it becomes tangible what can’t be fixed technically and why it’s worth training for exactly that. That’s where awareness training comes in.

Free · approx. 5 minutes · no account needed

Operation ORION, the office game

Take on the role of an investigator and uncover the security gaps at a workstation. A playful start with no prior knowledge needed — also ideal for passing on to colleagues.

Start the game →
Identity

The real target is rarely the computer

Anyone with login details doesn’t need malware. A hijacked mailbox reads along, knows your processes, replies in ongoing threads and requests further access in your name. To colleagues and customers it looks like you, because technically it is you.

That’s why protecting your own identity is at the heart of my training: passwords, two-factor authentication, handling confirmation requests, and what to do if it happens anyway.

Resilience

Resilience is measurable, or it’s just a claim.

“Our people are aware” is an assumption. A number showing how many actually click in a realistic situation is a foundation.

For the German economy, becoming resilient here is now a strategic need: with Cybernation Deutschland, the BSI is pursuing exactly this goal — resilience as the normal state rather than a project after an incident. For an individual business that means: know where you stand, improve, measure again.

Measure your own vulnerability

Free, three simulated attacks, anonymised results.

Obligations

And yes, it’s also mandatory.

Two laws, one consequence: train and prove it. Many businesses only associate training obligations with NIS2 and consider themselves unaffected. But the GDPR applies to everyone who processes personal data.

NIS2

Certain sectors above a certain size

The directive obliges management bodies of affected entities to take part in training and to regularly offer training to all employees. Management is explicitly addressed.

Generally affects companies with 50 or more employees or €10 million in turnover in energy, transport, health, water, digital infrastructure, IT services, postal services, waste, chemicals, food and mechanical engineering.

GDPR

Practically every business

Article 32 requires “appropriate technical and organisational measures”. Training and raising staff awareness are organisational measures; Article 39 names them explicitly.

Anyone who processes customer data, job applications or personnel files is affected. That’s every business.

What must be provable

  • That training took place
  • Who took part
  • When it happened
  • That it is repeated

What isn’t documented is, if in doubt, considered not to have happened. With me, all four proofs are created automatically as a by-product of the training.

Loading …

Set up in an hour, trained in a week.

Create a free account, add your team, unlock the course. You only pay when you start. Would you rather see what a test email looks like first? The self-test is free.

Add your team Test it yourself first