Threat landscape

What is the current situation in German offices?

Period for the whole page

Last 30 days: from 01.10.2026 until today. Applies to the situation map, the trend and the lists; the world map has fixed periods, noted below each map.

Situation map

Where the current vulnerabilities sit in a business

All 877 warnings the BSI published or updated in the last 30 days that can be assigned to a place in the building.

Office infrastructure seen from above, with the number of current warnings per area Server room: 449, Software development: 137, Website, hosting and cloud: 108, Firewall, VPN and router: 62, Office workstations: 48, Central AI services: 40, Mobile working and remote access: 33 Your business Internet Workstations 48 Server room 449 Development 137 Central AI 40 Firewall · VPN 62 Hosting & cloud 108 Mobile & remote access 33

Click a circle or area to see the individual advisories. Image: AI-generated.

The larger the circle, the more warnings red outline: at least one critical

Situation map

Central AI services

×

40 warnings 18 high 21 medium 1 low of which 20 newly added

AI services often run with broad access to documents, mailboxes and keys – whoever takes them over sees everything the AI sees.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Firewall, VPN and router

×

62 warnings 5 critical 30 high 26 medium 1 low of which 46 newly added

These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

Known to be exploited (CISA, last 90 days)

  • exploited Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

    Crafted input makes the software do something it should not. The details are in the linked description.

  • exploited Fortinet Multiple Products

    Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials.

  • exploited Cisco Secure Email Gateway

    Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials.

  • exploited Ivanti Connect Secure

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited Citrix NetScaler

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

and 20 more

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Mobile working and remote access

×

33 warnings 13 high 17 medium 3 low of which 13 newly added

The way in is usually a message, a link or an open remote access – on the road, without the protection of the office network.

Known to be exploited (CISA, last 90 days)

  • exploited Google Pixel

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited ConnectWise ScreenConnect

    Privilege escalation: anyone who already has a foot in the door, for example via a phishing email, makes themselves administrator.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Website, hosting and cloud

×

108 warnings 8 critical 57 high 42 medium 1 low of which 28 newly added

The application is reachable from the internet and is scanned automatically around the clock.

I count here the software a website or online shop is made of (such as WordPress, TYPO3, web servers, PHP) and cloud platforms on which you run something yourself. A web server on the internet can therefore have vulnerabilities from two areas: the website software is listed here, while the Linux, database and backup underneath are listed under “Server room”.

Known to be exploited (CISA, last 90 days)

  • exploited Adobe Commerce and Magento

    Unchecked upload: attackers upload a file containing malicious code and then call it.

  • exploited WordPress Core

    Code injection: attackers send data that the server executes as program code – after that, the server is theirs.

  • exploited Adobe Commerce and Magento

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited Adobe Commerce and Magento

    Code injection: attackers send data that the server executes as program code – after that, the server is theirs.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Server room

×

449 warnings 7 critical 208 high 226 medium 8 low of which 119 newly added

If a server sits only inside the building, it is usually the second step: anyone already inside the network, for example after a phishing email, moves on from here to data and backups. Mail and file servers such as Exchange, SharePoint Server or Nextcloud, however, are often connected directly to the internet and are then just as exposed as a website.

I count here software that your business runs on its own servers and has to update itself: operating systems, databases, virtualisation, backup and your own mail and file servers. Whether the server sits in the basement or is rented from a hosting provider makes no difference.

Known to be exploited (CISA, last 90 days)

  • exploited Broadcom VMware ESX

    Crafted input makes the software do something it should not. The details are in the linked description.

  • exploited Microsoft SharePoint

    Code injection: attackers send data that the server executes as program code – after that, the server is theirs.

  • exploited Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in

    Login bypassed: attackers reach functions that should only be open to authorised users – without any valid password.

  • exploited Broadcom VMware vCenter ransomware known

    Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials.

  • exploited Microsoft SharePoint

    Crafted input makes the software do something it should not. The details are in the linked description.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Software development

×

137 warnings 2 critical 47 high 83 medium 5 low of which 31 newly added

Whoever gets in here can smuggle malicious code into your own software and ship it to customers that way.

Known to be exploited (CISA, last 90 days)

  • exploited Atlassian Multiple Products

    Crafted input makes the software do something it should not. The details are in the linked description.

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.
Situation map

Office workstations

×

48 warnings 4 critical 29 high 13 medium 2 low of which 26 newly added

The way in is almost always a person: a link, an attachment or a web page opened at the workstation.

Known to be exploited (CISA, last 90 days)

  • exploited Microsoft Windows

    Command injection: through a crafted request, attackers smuggle in system commands that the device then executes itself.

  • exploited Apple Multiple Products

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

  • exploited Google Chromium V8

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

  • exploited Microsoft Windows

    Link trick: with a crafted link, an attacker gets the system to modify protected files.

  • exploited Microsoft Windows

    Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

and 3 more

Affected software

Source: BSI, Warning and Information Service (CERT-Bund); CISA, Known Exploited Vulnerabilities Catalog. The links open the original advisory.

How I assign them: each warning goes into exactly one area, depending on which software is affected. Rented cloud services such as Microsoft 365, SharePoint Online or Google Workspace do not appear here. Their providers have to close the same vulnerabilities, but they install the fixes themselves, so it does not fall back on your business. The map only shows what you or your IT service provider have to update yourselves. A web server on the internet can appear in two areas: with its website software under “Website, hosting and cloud”, with Linux, database and backup under “Server room”.

Source: BSI, Warning and Information Service (CERT-Bund). General libraries found in almost every piece of software (such as OpenSSL or glibc) are not assigned to any area. The classification is mine, not the BSI’s. This week’s situation in detail ↓

Period: last 30 days, from 01.10.2026 until today, as selected above.

Trend

Advisories per day and area

Each bar shows how many warnings the BSI first published that day, stacked by severity. Later updates count on the day of the first release. Hover over a bar to see the numbers.

1 6 11 16 21 26 30 total
Server room 119
Firewall, VPN and router 46
Software development 31
Website, hosting and cloud 28
Office workstations 26
Central AI services 20
Mobile working and remote access 13
All areas 13 6 9 11 19 20 24 10 13 34 19 12 7 14 17 16 10 11 5 2 11 283

criticalhighmediumlow

Period: last 30 days, from 01.10.2026 until today, as selected above. One bar per day.

World map

State-backed attackers named by CISA

The US cybersecurity agency CISA attributes some of its advisories to state-backed attackers from a particular country. The map shows how often it did so over the last three years. This is a snapshot from the US point of view, not a statistic of attacks on Germany: most advisories name no country at all, including every advisory on ransomware groups (box below the map).

World map of state-backed attackers according to CISA Russia: 8 CISA advisories, 2 at the BSI in the period; China: 6 CISA advisories, 2 at the BSI in the period; Iran: 4 CISA advisories, 0 at the BSI in the period; North Korea: 1 CISA advisories, 4 at the BSI in the period Fidschi Tansania, Vereinigte Republik Westsahara Kanada Vereinigte Staaten von Amerika Kasachstan Usbekistan Papua-Neuguinea Indonesien Argentinien Chile Kongo Somalia Kenia Sudan Tschad Haiti Dominikanische Republik Russische Föderation Bahamas Falklandinseln Norwegen Grönland Osttimor Südafrika Lesotho Mexiko Uruguay Brasilien Bolivien Peru Kolumbien Panama Costa Rica Nicaragua Honduras El Salvador Guatemala Belize Venezuela Guyana Suriname Frankreich Ecuador Puerto Rico Jamaika Kuba Simbabwe Botswana Namibia Senegal Mali Mauretanien Benin Niger Nigeria Kamerun Togo Ghana Elfenbeinküste Guinea Guinea-Bissau Liberia Sierra Leone Burkina Faso Zentralafrikanische Republik Republik Kongo Gabun Äquatorialguinea Sambia Malawi Mosambik Eswatini Angola Burundi Israel Libanon Madagaskar Staat Palästina Gambia Tunesien Algerien Jordanien Vereinigte Arabische Emirate Katar Kuwait Irak Oman Vanuatu Kambodscha Thailand Laos Myanmar Vietnam Nordkorea Südkorea Mongolei Indien Bangladesch Bhutan Nepal Pakistan Afghanistan Tadschikistan Kirgisistan Turkmenistan Iran Syrien, Arabische Republik Armenien Schweden Belarus Ukraine Polen Österreich Ungarn Moldawien Rumänien Litauen Lettland Estland Deutschland Bulgarien Griechenland Türkei Albanien Kroatien Schweiz Luxemburg Belgien Niederlande Portugal Spanien Irland Neukaledonien Salomonen Neuseeland Australien Sri Lanka China Taiwan Italien Dänemark Vereinigtes Königreich Island Aserbaidschan Georgien Philippinen Malaysia Brunei Darussalam Slowenien Finnland Slowakei Tschechische Republik Eritrea Japan Paraguay Jemen Saudi-Arabien Zypern Marokko Ägypten Libyen Äthiopien Dschibuti Uganda Ruanda Bosnien und Herzegowina Nordmazedonien Serbien Montenegro Trinidad und Tobago Südsudan 2 BSI advisories in the period concern vulnerabilities that, according to CISA, are also exploited by actors from Russia. This does not prove an attack on Germany. 2 BSI advisories in the period concern vulnerabilities that, according to CISA, are also exploited by actors from China. This does not prove an attack on Germany. 4 BSI advisories in the period concern vulnerabilities that, according to CISA, are also exploited by actors from North Korea. This does not prove an attack on Germany. Russia: 8 CISA advisories in the last three years 8 Russia China: 6 CISA advisories in the last three years 6 China Iran: 4 CISA advisories in the last three years 4 Iran North Korea: 1 CISA advisory in the last three years 1 North Korea

Number in the circle: CISA advisories from the last three years that name actors from the country Arrow: a vulnerability from these advisories also appears in a BSI advisory in the period, so it affects software that is common here too

No country attribution: criminal groups and ransomware

29 of the 48 CISA advisories from the last three years name no country, 13 of them concern ransomware groups. Such groups work for money, often across borders, and can rarely be tied to a state. For businesses in Germany they are the more common danger: according to the BSI, ransomware is the biggest threat to companies.

In the period, 3 BSI advisories contain one of these vulnerabilities:

The CISA advisories

Source: CISA cybersecurity advisories (origin according to the advisory title); BSI warning and information service. Map data: Natural Earth. Attribution to a country is a statement by CISA, not evidence of an attack on Germany.

Period: The circles do not follow the selection above: they count CISA advisories from the last three years, because CISA names state-backed attackers only a few times a year. The BSI warnings that appear when you click a country, however, follow the period above.

The situation over the last 30 days

In the last 30 days, the BSI (Germany’s Federal Office for Information Security) has issued 132 warnings about software that runs in businesses every day.

The official reporting situation, tailored to your office workstations. I fetch it twice a day from the German Federal Office for Information Security and show here only what runs on ordinary office computers and in almost every business. Every line leads to the original BSI advisory. The situation map above counts every area in the building, which is why its number is larger.

13

critical

75

high

39

medium

77

newly added

Newly added means: the BSI published these warnings for the first time in this period. All others are updates to older warnings, for example because the vendor delivered a fix later or further versions are affected. The three severity levels count new and updated warnings together.

What’s affected is what runs at your business

Source: BSI, Warning and Information Service (CERT-Bund). As of 30.10.2026, 08:43.

Period: last 30 days, from 01.10.2026 until today, as selected above.

The warnings come from German-language sources and are shown in the original.

And this is already being attacked

A vulnerability is one thing. These ones are demonstrably being exploited — the US cybersecurity agency keeps a public catalogue of them, and its own federal agencies have to act within a deadline.

  • exploited Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

  • exploited Broadcom VMware ESX

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. If a server sits only inside the building, it is usually the second step: anyone already inside the network, for example after a phishing email, moves on from here to data and backups. Mail and file servers such as Exchange, SharePoint Server or Nextcloud, however, are often connected directly to the internet and are then just as exposed as a website.

  • exploited Adobe Commerce and Magento

    How it is exploited: Unchecked upload: attackers upload a file containing malicious code and then call it. The application is reachable from the internet and is scanned automatically around the clock.

  • exploited Google Brotli

    How it is exploited: Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.

  • exploited Fortinet Multiple Products

    How it is exploited: Directory escape: with manipulated file paths, attackers access files outside the permitted area, such as configuration or credentials. These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.

  • exploited Atlassian Multiple Products

    How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. Whoever gets in here can smuggle malicious code into your own software and ship it to customers that way.

Source: CISA, Known Exploited Vulnerabilities Catalog. The links lead to the description of the vulnerability in the US National Vulnerability Database; the explanation above is my classification of the type of flaw named there.

Period: last 30 days, from 01.10.2026 until today, as selected above. Shown are the six newest entries from this period.

This list doesn’t answer one question: whether your accountant will approve the fake invoice tomorrow. Updates close gaps in software. The gap my training addresses sits between a credible request and a click — and no patch closes it.

By attacks

And what of it actually arrives?

Advisories say where the flaws are. On my own server I see how often someone tries to exploit them: attack attempts per day and hour, what was attempted, where the machines come from and what has to do with the PHP flaw PHP2Shell.

To the view by attacks →

The attacker no longer needs to know you. AI does that part.

For years, poor language was the most reliable sign of a scam email. That sign is gone. What else has shifted, and why your firewall can’t answer the decisive question.

Before

Attacks took time

Anyone targeting a company had to do research, write texts and rebuild websites. That only paid off for big targets; small businesses slipped through the net.

Today

Attacks cost next to nothing

Research, writing and copying are automated. The same effort that used to be needed for one target now covers a thousand — and so it also hits the craft business with twelve employees.

The consequence

“Too small and unknown” no longer protects you

Assuming you’re of no interest to attackers was always risky. Now it’s simply wrong, because there’s no longer any target selection that protects you.

What has actually changed

Four shifts, all pointing the same way: attacks are becoming more credible, more personal and more frequent.

01

Language no longer gives anything away

Spelling mistakes, clumsy grammar, odd greetings: those were the signs we were all trained to spot. Today a language model writes flawless text in the tone of your industry, including the correct technical terms and the right level of formality.

02

The attack knows your context

Legal notice, LinkedIn, company register, press releases, job ads: publicly available information is enough to know who approves invoices at your company, who’s new and which project is currently running. Nobody does this research by hand any more.

03

Voice and face are no longer proof

A few seconds of audio are enough for a convincing voice clone, and any video on the company website provides the material. The best-known case: an employee of a large corporation transferred around 25 million US dollars after a video conference in which every participant except him was fake.

04

Attacks run in steps, not as a single email

First a harmless contact, then a reference back to your reply, then the actual request. Such multi-step sequences used to need a person who kept at it. Today they run on automatically, even over weeks.

The blind spot

Technology can’t decide whether a request is legitimate.

Spam filters recognise patterns: known senders, suspicious attachments, reported domains. A flawlessly written email from a newly registered, inconspicuous domain that refers to a real process at your company and asks for a plausible action contains not a single technical feature a filter could stop it on.

No product answers the question “Is it right for me to approve this payment now?”. A person answers it, under time pressure and between forty other emails.

That’s why awareness isn’t an add-on to technology, but the layer that starts exactly where technology structurally stops.

What technology reliably does

  • Intercept known malware
  • Block reported senders and domains
  • Isolate suspicious attachments
  • Log access and keep backups

What it cannot do

  • Judge whether a request is plausible in context
  • Recognise that the familiar voice on the phone is synthetic
  • Stop someone from entering their password voluntarily
  • Replace a quick call-back when in doubt
Experience it yourself

How many vulnerabilities can you spot in an office?

Before talking about training, it helps to feel the problem once rather than have it explained. In “Operation ORION” you walk through an ordinary office and look for the places an attacker would use: the sticky note on the monitor, the open mailbox, the USB stick from the trade fair stand. In five minutes it becomes tangible what can’t be fixed technically and why it’s worth training for exactly that. That’s where awareness training comes in.

Free · approx. 5 minutes · no account needed

Operation ORION, the office game

Take on the role of an investigator and uncover the security gaps at a workstation. A playful start with no prior knowledge needed — also ideal for passing on to colleagues.

Start the game →
Identity

The real target is rarely the computer

Anyone with login details doesn’t need malware. A hijacked mailbox reads along, knows your processes, replies in ongoing threads and requests further access in your name. To colleagues and customers it looks like you, because technically it is you.

That’s why protecting your own identity is at the heart of my training: passwords, two-factor authentication, handling confirmation requests, and what to do if it happens anyway.

Resilience

Resilience is measurable, or it’s just a claim.

“Our people are aware” is an assumption. A number showing how many actually click in a realistic situation is a foundation.

For the German economy, becoming resilient here is now a strategic need: with Cybernation Deutschland, the BSI is pursuing exactly this goal — resilience as the normal state rather than a project after an incident. For an individual business that means: know where you stand, improve, measure again.

Measure your own vulnerability

Free, three simulated attacks, anonymised results.

Obligations

And yes, it’s also mandatory.

Two laws, one consequence: train and prove it. Many businesses only associate training obligations with NIS2 and consider themselves unaffected. But the GDPR applies to everyone who processes personal data.

NIS2

Certain sectors above a certain size

The directive obliges management bodies of affected entities to take part in training and to regularly offer training to all employees. Management is explicitly addressed.

Generally affects companies with 50 or more employees or €10 million in turnover in energy, transport, health, water, digital infrastructure, IT services, postal services, waste, chemicals, food and mechanical engineering.

GDPR

Practically every business

Article 32 requires “appropriate technical and organisational measures”. Training and raising staff awareness are organisational measures; Article 39 names them explicitly.

Anyone who processes customer data, job applications or personnel files is affected. That’s every business.

What must be provable

  • That training took place
  • Who took part
  • When it happened
  • That it is repeated

What isn’t documented is, if in doubt, considered not to have happened. With me, all four proofs are created automatically as a by-product of the training.

Loading …

Set up in an hour, trained in a week.

Create a free account, add your team, unlock the course. You only pay when you start. Would you rather see what a test email looks like first? The self-test is free.

Add your team Test it yourself first